Active Directory and Entra ID security audit program.
How to audit whether the central directory services are protected against takeover, privileged rights stay tightly limited and recovery after an attack is possible.
Last updated: 13 October 2026 · Sample, not legal advice
Download the sample as PDF 8 pages, no sign-up
Download as Excel template with columns for result and notes, no sign-up
Audit objective
The audit assesses whether Active Directory and Entra ID are operated under a clear administration model, whether highly privileged groups and accounts are minimal and monitored and whether sign-in methods, service accounts, guest access and synchronisation between both directories are set up securely. It also assesses whether the directory service can be recovered after a compromise.
Scope
- On-premises Active Directory with all domains and domain controllers
- Entra ID tenant including conditional access, guest accounts and application registrations
- Synchronisation between the on-premises directory and Entra ID
- Out of scope: permissions within individual business applications
Audit program
| No. | Criterion | Reference | Audit procedure | Expected evidence |
|---|---|---|---|---|
| 1 | Responsibility and the operating concept for the directory services are documented and current. | BSI APP.2.1; BSI APP.2.2 | Read the operating concept and compare it with the actual domain and tenant structure. | Operating concept, overview of domains and trusts |
| 2 | A tiered administration model separates administration of the directory services from administration of servers and workstations. | BSI APP.2.2; ISO/IEC 27001:2022 Annex A 8.2 | Have the model explained and check whether domain administrators sign in only on designated systems. | Administration model description, logon restrictions, sign-in logs |
| 3 | Highly privileged groups and roles have few, personally assigned members and are reviewed regularly. | ISO/IEC 27001:2022 Annex A 8.2; BSI APP.2.2 | Read members of highly privileged groups and Entra roles and reconcile them with approved assignments. | Readout of groups and roles, approvals, recertification record |
| 4 | Administrative sign-ins and remote access are protected with multiple factors; conditional access rules have no unreviewed gaps. | § 30(2) no. 10 BSIG; ISO/IEC 27001:2022 Annex A 8.5 | Analyse conditional access rules, list exceptions and check factor registration status. | Export of conditional access rules, exception list, registration report |
| 5 | Emergency access accounts are set up, stored securely, monitored and tested. | ISO/IEC 27001:2022 Annex A 8.2 | Check number, storage and monitoring of emergency access accounts and review the last test. | Emergency access rule, alert rule for sign-ins, test record |
| 6 | Accounts are adjusted promptly for joiners, movers and leavers; inactive accounts are disabled. | ISO/IEC 27001:2022 Annex A 5.16 and 5.18; BSI ORP.4 | Read accounts without sign-in for 90 days and check five leavers for prompt disabling. | List of inactive accounts, leaver notifications, disabling times |
| 7 | Service accounts have owners, only necessary rights and strong, rotated or managed passwords. | ISO/IEC 27001:2022 Annex A 5.17; BSI APP.2.2 | Read service accounts, flag privileged ones and check password age and owners. | List of service accounts with owners, password age, rights |
| 8 | Password rules are adequate, and legacy authentication protocols and encryption types are disabled. | ISO/IEC 27001:2022 Annex A 8.5; BSI APP.2.2 | Read password policies and settings for legacy protocols; review results of a directory assessment tool. | Policy extract, assessment tool report |
| 9 | The server synchronising the on-premises directory with Entra ID is protected like a domain controller. | ISO/IEC 27001:2022 Annex A 8.2 | Check administration, network access and permissions of the synchronisation server and its service accounts. | System documentation, members of local administrators, rights of the synchronisation account |
| 10 | Guest accounts and external identities are approved, time-limited and reviewed regularly. | ISO/IEC 27001:2022 Annex A 5.16 | Read guest accounts, flag the oldest and inactive guests and trace the review process. | List of guest accounts, invitation settings, review evidence |
| 11 | Application registrations and granted consents are controlled; users cannot grant applications far-reaching permissions. | ISO/IEC 27001:2022 Annex A 5.18 | Check user consent settings and list applications with high permissions. | Consent settings, list of applications with permissions |
| 12 | Sign-ins and changes to directory objects are logged, analysed centrally and alerted on when anomalous. | ISO/IEC 27001:2022 Annex A 8.15 and 8.16; BSI APP.2.2 | Review monitoring rules for changes to privileged groups and trace one alert. | Monitoring policy, rule catalogue, alert example |
| 13 | Recovery of the directory service after compromise is planned, backed up and tested. | ISO/IEC 27001:2022 Annex A 8.13; BSI APP.2.2 | Read the recovery plan, check domain controller backups and review the last recovery test. | Recovery plan, backup evidence, test record |
Documents to request
- Operating concept of the directory services and administration model
- Readout of privileged groups and Entra roles
- Export of conditional access rules with exceptions
- Rule on emergency access accounts
- List of service accounts with owners
- List of guest accounts and applications with permissions
- Report of a directory assessment tool
- Recovery plan and test record
Typical findings
- Domain administrators sign in on ordinary workstations.
- Highly privileged groups contain service accounts and former employees.
- Exceptions from the second factor are broad and not time-limited.
- Service accounts have had unchanged passwords and administrator rights for years.
- Guest accounts remain active after projects end.
- Recovery of the directory service has never been rehearsed.
Note on references
The references point to laws, regulations and standards so that you can read the requirement in the original. No normative text is reproduced. Criteria and procedures are original wording and replace neither the text of the provisions nor legal advice. Whether and to what extent a provision applies to your organisation should be clarified before the audit.
The complete package
This sample shows the objective, the audit steps and the document list on one page. For your own audit topic, ProAuditMap creates the complete package: audit plan, audit program per audit dimension, document request list, interview guides, schedule, communication and report template. You review the draft, approve it and export to Excel and Word.
Create account View a complete sample package View pricing