ITP-PCCE Checks

On the Verify Privileged Identity Platform, Checks for Identity Threat Protection (ITP) and Privilege Control for Cloud Entitlements (PCCE) provide comprehensive visibility into identity security posture across multi-cloud environments and SaaS applications.

See the complete list of available CID Checks.

When you enable ITP/PCCE functionality on the Platform, checks automatically run and evaluate entitlements. But to receive alerts and view cases for failed ITP and PCCE checks, you must enable Analytics. See Getting Started with Analytics.

General Checks (across multiple apps)

This section describes general ITP/PCCE checks.

Admins without MFA

Detects admin user accounts that do not have multi-factor authentication enabled. Accounts without multi-factor authentication are vulnerable to credential and token theft.

Verify Privileged Identity Platform searches for any user account with the MFA property set to false. To ensure that the user has a chance to set up MFA before being detected, Verify Privileged Identity Platform ignores any account that was never activated (staged) and any account that never performed an initial login (with a login date that is empty or set to 1970).

Apps with unused federated access

Detects federated applications that have not been accessed in the past 90 days. Applications created within the past 90 days are not evaluated. Unused federated access increases the blast radius of a compromised identity provider account, since the unused application is still reachable.

Remove access to the application, or remove the application entirely, to reduce the attack surface.

Supported for Okta and Microsoft Entra ID.

Avoid NHI with super admin permissions

Flag and investigate service accounts (non-human identities) with excessive or unnecessary super admin permissions. These accounts often operate without sufficient oversight, making them high-risk if compromised.

Supported for Active Directory, AWS, Azure, GCP.

Excessive number of non-human administrators

Detects non-human accounts (service accounts, workloads, and similar identities) that hold administrative privileges. The check fails when the number of non-human administrators reaches the configured threshold (default: 5); every non-human administrator is listed regardless of the threshold. Non-human admin accounts can indicate attacker persistence or lateral movement; validate the source and business justification for each one.

Review the affected non-human accounts and remove administrative access that is not justified.

Supported for Active Directory (on-premises), Microsoft Entra ID, Okta, Google Cloud Platform, and Ping Identity.

The threshold is configurable per application.

External access to app

Identifies external accounts that have access to an application. Review every external account and confirm it should retain access; remove access from any account that does not need it. External accounts are defined through the customer-editable External Accounts system collection on the Collections page.

This check does not evaluate disabled accounts, and only evaluates accounts that have access to at least one federated application.

Supported for AWS, AWS IAM Identity Center, Google Cloud Platform, Google Workspace, Okta, Ping Identity, Microsoft Entra ID, and Microsoft Azure.

Limit number of administrators [federated access]

Detects federated admin accounts, as a new administrative account might be an indication of persistence or later movement achieved by an attacker. Validate that the user should be an admin; otherwise remove admin privileges.

Supported for apps that are not IdPs.

You can set a threshold to define the expected number of admins so the check won't fail.

Limit number of external administrators

Detects external admin accounts, as a new administrative account might be an indication of persistence or later movement achieved by an attacker. Validate that the user should be an admin; otherwise remove admin privileges.

You can configure external accounts on the Collections page.

Limit number of human administrators

Detects human accounts, as new administrative account might be an indication of persistence or later movement achieved by an attacker, valid each account becoming an admin, validating the source and the reason for it being high privileged.

You can set a threshold to define the expected number of admins so the check won't fail.

Nested administrative group membership

Detects when a principal inherits membership in a high-value administrative group through a chain of nested groups. Nested group chains create hidden privilege escalation paths that are easy to miss during a manual access review.

Remove the principal (user or group) from the base group, flatten unnecessary group nesting, and review nested administrative groups on a regular schedule.

Supported for AWS, AWS IAM Identity Center, Google Cloud Platform, Google Workspace, Okta, Ping Identity, Microsoft Entra ID, Microsoft Azure, Active Directory (on-premises), and Snowflake.

Remove active users without login activity

Detect active users who haven't logged in for 180 days. To increase security posture and prevent stolen credentials from being used, enforce that users must re-log in to their accounts.

Remove disabled users with admin privileges

Detects disabled users who still have administrative rights. Such accounts are vulnerable to reactivation or abuse.

Remove empty groups with entitlements

Tracks empty groups that still have entitlements, meaning any member that joins those groups will be able to gain those privileges. Empty groups with entitlements can lead to undesired access to assets the group is entitled to.

Remove inactive human accounts

Inactive human accounts are identified after 90 days of inactivity. These accounts retain access rights despite no recent activity, creating security vulnerabilities.

Inactivity days filed is configurable under Alerts Settings.

Remove inactive human admin accounts

Inactive human admin accounts are identified after 30 days of inactivity due to their elevated privileges. These accounts retain administrative access rights despite no recent activity, making them high-value targets for attackers seeking to compromise your organization.

Inactivity days filed is configurable under Alerts Settings.

Remove partially off‑boarded accounts

Detects user identities that were terminated in Workday but are still enabled in the application.

Need to connect Workday to see results.

Remove partially suspended/disabled users

Flags user accounts that are suspended or disabled in one identity provider (e.g., Okta) but still enabled in the application.

Need to connect IdP to see results.

Remove shadow admin human accounts

Detects Human accounts with shadow admin entitlements, the policy logic tracks both local and federated accounts. The full list of shadow admin permissions that are evaluated and their combinations can be found here. A shadow admin is a user who does not have full administrative privileges but has sensitive privileges that grant them control over other users or over sensitive administrative tasks.

Supported for Active Directory, AWS, Azure, GCP.

Remove stale administrative non-human identities

Stale administrative non-human identities are identified after 30 days of inactivity due to their elevated privileges. These service accounts, API keys, or automated identities retain administrative access rights despite no recent activity, making them critical security risks if compromised.

Inactivity days filed is configurable under Alerts Settings

Remove stale non-human identities

Stale non-human identities are identified after 90 days of inactivity. These service accounts, API keys, or automated identities retain access rights despite no recent activity, creating security vulnerabilities. Attackers often target stale NHIs as they're less monitored than human accounts.

Inactivity days filed is configurable under Alerts Settings.

Remove suspended accounts with admin privileges

Detects accounts that are suspended. A suspended user is a potential risk to the organization because attackers can take advantage of unmonitored accounts, and We recommend removing these accounts.

Remove unused custom roles

Detects custom roles that have not been used in the past 90 days. Unused roles with standing privileges increase the blast radius of a compromised credential.

Review the role's last-used date and confirm with the owning team, then delete the custom role if it is no longer required. Removing the role's assignments does not clear the finding; only deleting or using the role does.

Supported for AWS, AWS IAM Identity Center, Google Cloud Platform, Google Workspace, Okta, Ping Identity, Microsoft Entra ID, and Microsoft Azure.

Shadow admin non-human identities

Detects non-human identities — service accounts, workloads, secrets, and keys — that hold sensitive administrative privileges without full administrative rights. Shadow admin non-human identities are especially risky because they often carry long-lived credentials and operate with less oversight than human accounts.

The full list of shadow admin permissions that are evaluated can be found here.

Supported for AWS, Microsoft Azure, Google Cloud Platform, and Active Directory (on-premises).

Users with weak MFA

Detects user accounts enrolled with weak MFA authentication factors, such as SMS, voice, phone, email, and security questions. Disabling these factors and replacing them with stronger alternatives helps reduce exposure to account compromise.

Users without MFA

Detects user accounts that do not have multi-factor authentication enabled. Accounts without multi-factor authentication are vulnerable to credential and token theft.

Weak MFA authentication factors in use

Detects MFA attempts that use a weak multi-factor authentication (MFA) factor. Weak factors are easier for attackers to intercept or bypass than an authenticator app or a hardware key, so continued use of them increases the risk of account takeover even when MFA is technically enabled.

Review the affected accounts and require a stronger MFA factor going forward.

Supported for Okta and Microsoft Entra ID.

Active Directory-Specific

This section describes ITP/PCCE checks unique to Active Directory.

Account privileged in both on-premises AD and Entra ID

Detects identities that hold administrative rights in both on-premises Active Directory and Microsoft Entra ID. On the cloud side, administrative access to Azure subscriptions also counts. An account with administrative access on both sides of a hybrid environment gives an attacker a path to escalate from one environment to the other.

Review the affected accounts and confirm that administrative access on both sides is necessary.

Supported for Active Directory (on-premises) and Microsoft Entra ID. The check is evaluated only when both applications are connected.

Accounts missing AES Kerberos encryption

Detects Active Directory accounts, including user, computer, and group managed service accounts, that do not support AES Kerberos encryption. Disabled accounts are not evaluated. Accounts without AES support are more vulnerable to credential theft and Kerberos downgrade attacks.

Accounts using DES encryption

Detects user accounts configured to allow DES encryption for Kerberos authentication. DES is a deprecated, insecure encryption type.

Clear the “Use DES encryption types” option on the affected accounts.

AD service account with weak password encryption

Detects Active Directory accounts with weak Kerberos password encryption. An account fails this check if it has a Service Principal Name (SPN) and its encryption type is explicitly unset (defaulting to RC4), or if it was created on or before 31 December 2012 and its password was last changed on or before 31 December 2012. Disabled accounts are excluded.

Rotate the password on affected accounts and configure a modern encryption type.

Admin account does not follow naming convention

Detects administrative accounts that do not follow your organization's naming convention. Consistent naming makes it easier to audit privileged accounts and spot ones created by an attacker or through shadow IT.

Configure the naming convention using the compliant admin accounts collection on the Collections page.

Built‑in Administrator account usage

Detects any recent usage of the default built-in Administrator account, which bypasses typical auditing mechanisms.

Built‑in Administrator account with password older than 90 days

The password for the built-in administrator account must be changed at least every 90 days.

Built‑in Guest account is enabled

Detects whether the guest account is enabled in Active Directory. This account is commonly targeted by attackers.

Computer password stale 90 days

Detects computer accounts whose password has not changed in more than 90 days. Disabled computer accounts are included. Stale computer passwords can indicate an offline, decommissioned, or compromised machine with disabled password rotation.

Computers can retrieve gMSA password

Detects group Managed Service Accounts (gMSAs) where a non-privileged principal — a user, group, or computer — is permitted to retrieve the gMSA's password. These principals can authenticate as the service account, enabling lateral movement and privilege escalation.

Remove non-privileged principals from the gMSA's list of accounts permitted to retrieve its managed password.

Constrained delegation to krbtgt

Detects computer objects configured with constrained delegation to the krbtgt account. This configuration can enable Golden Ticket–equivalent attacks and should not exist in a healthy environment. User and service accounts are covered by the Unsecure Kerberos delegation check.

Remove the delegation configuration from the affected computer.

Constrained delegation to SSO account

Detects delegation rights configured to the AZUREADSSOACC account used by Microsoft Entra Connect Seamless Single Sign-On. No account should have delegation rights to this service account, since it enables generation of Entra ID service tickets.

Remove the delegation configuration from the affected account.

This check produces results only in hybrid environments where Entra Connect Seamless SSO is enabled.

Critical obsolete OS detected

Detects domain-joined computers running an operating system with no vendor security support. The current list covers 28 operating system versions from Windows NT 4.0 through Windows Server 2012/R2, including Windows Server 2003, Windows Vista, Windows 7 and 8, and Windows Server 2008.

Upgrade or decommission the affected computers.

DC machine account password stale

Detects domain controller machine accounts that have not rotated their password within 30 days. This shorter window matches the Windows default rotation interval for domain controller machine accounts and helps catch domain replication issues, stale systems, or misconfigurations that weaken the secure channel between domain controllers.

This check does not overlap with Computer password stale 90 days, which excludes domain controllers.

Supported for Active Directory (on-premises).

DC RBCD enabled

Detects domain controllers configured with Resource-Based Constrained Delegation (RBCD), which allows specified accounts to impersonate any user to domain controller services. This configuration is rarely legitimate and should be treated as a critical finding.

Remove the RBCD configuration from the affected domain controller.

Delegation to ghost SPN

Detects constrained delegation configured to a Service Principal Name (SPN) that no longer exists anywhere in the environment. An attacker who registers that SPN could hijack the delegated credentials.

Remove the stale delegation configuration.

Disable non‑expiring password for AD accounts

Detects AD user accounts with passwords that never expire, which could lead to credential compromise.

Disable users' right to add computers to the domain

Finds where the default permission “Add workstations to domain” is enabled for Authenticated Users. This permission can be exploited by attackers.

Do not require Kerberos pre‑authentication

Detects accounts that do not require Kerberos pre-authentication, exposing them to AS-REP roasting attacks.

Excessive local administrators on computer

Detects Windows computers with more than 5 human local administrator accounts. Disabled accounts are counted. Excessive local administrator accounts increase the risk of lateral movement if any one of them is compromised.

Review the local administrators on the affected computer and remove accounts that do not need administrative access.

The per-computer limit of 5 human local administrator accounts is not configurable. The Affected Entities Threshold (default: 5) is configurable; it sets how many flagged local administrator assignments cause the check to fail.

Insufficient Domain Admin redundancy

Ensure that at least one additional trusted domain administrator exists. Lack of redundancy may prevent necessary administrative operations during emergencies. Domain admin is the most privileged role in Active Directory.

The check fails when there is only one administrator, or none.

Limit number of Domain Admins

The Domain Admins group should contain only the minimum number of necessary users. Domain admin is the most privileged role in Active Directory. Excessive membership increases risk and management complexity.

You can set a threshold to define the expected number of admins so the check won't fail.

Microsoft Entra Seamless SSO account stale password

Detects when the Kerberos password for the Microsoft Entra Seamless SSO account (AZUREADSSOACC) has not been changed in more than 30 days, or when no password-set date is recorded, matching Microsoft's guidance to rotate this key regularly. Only enabled accounts are evaluated.

Rotate the Kerberos key for the Seamless SSO account using Microsoft's documented procedure.

Applies in hybrid environments with Entra Connect Seamless SSO enabled.

Non-standard primary group ID

Detects Active Directory user accounts with a non-standard primary group ID. The default primary group for a user account is Domain Users; Domain Admins and Enterprise Admins are also treated as expected primary groups. Any other value may indicate an attempt to bypass access control checks or hide privilege.

Review the affected accounts and correct the primary group assignment.

Print Spooler service enabled on DC host

Detects domain controllers where the Print Spooler service is present. The Print Spooler service is a known vector for privilege escalation and lateral movement (for example, PrintNightmare-style attacks) and should be disabled on domain controllers unless explicitly required.

Disable the Print Spooler service on the affected domain controller.

Requires the Active Directory connector to inventory Windows services on the domain controller.

Privileged account with unprivileged owner

Flags privileged Active Directory accounts whose owner does not have equivalent or appropriate permissions.

Privileged accounts with RODC credential caching

Detects privileged accounts that are permitted to have their credentials cached on a Read-Only Domain Controller (RODC). Credential caching for privileged accounts increases exposure to credential theft if the RODC is compromised.

Remove the affected accounts from the RODC's allowed-caching list.

Privileged computer with delegation rights

Detects computers with Tier-0 or infrastructure roles (identified by service principal names associated with domain controller, certificate services, SQL Server, and similar high-value roles) that are configured to allow delegation. Delegated privileged computer accounts pose a critical risk for lateral movement and privilege escalation.

Remove the delegation configuration from the affected computer.

Supported for Active Directory (on-premises).

Privileged SIDs in sIDHistory

Detects enabled accounts with a Domain Admins, Enterprise Admins, or BUILTIN Administrators SID in their sIDHistory attribute. Groups and disabled accounts are not evaluated. This can indicate a hidden grant of administrative privilege, often used to preserve access across a migration or as a persistence mechanism.

Remove the unexpected SID from the account's sIDHistory attribute.

Supported for Active Directory (on-premises).

Protocol transition to DC

Detects constrained delegation with protocol transition configured to domain controller services (identified by LDAP or CIFS service principal names). This configuration allows impersonating any user to domain controller services without that user's interaction and should not exist in a healthy environment.

Remove the delegation configuration from the affected account.

RBCD enabled on krbtgt account

Detects when the krbtgt account is configured to allow Resource-Based Constrained Delegation. Any finding here is a critical security issue with no legitimate justification.

Remove the delegation configuration from the krbtgt account immediately.

Remove adminCount flag from non‑privileged accounts

Detects accounts with an unnecessary adminCount=1 value that could inherit elevated permissions unintentially.

Remove delegation trust from privileged accounts

Detects accounts configured for delegation (especially unconstrained) that also have privileged roles. These accounts pose high impersonation risks.

Rotate Entra Connect password

Detects whether the password used for Entra Connect sync has not been rotated in 180 days.

Same domain SID history injection

Detects sIDHistory entries that reference a SID from the same domain as the account. Only enabled accounts are evaluated. This pattern has no legitimate migration use case within a single domain and indicates a confirmed SID History injection attack.

Remove the sIDHistory entry from the affected account.

Supported for Active Directory (on-premises).

Service accounts with stale password

Detects AD service accounts that haven't rotated their password in 90 days.

Shadow admin — DACL-based privilege escalation paths

Detects non-administrative accounts that hold DACL permissions on high-value Active Directory objects, enabling privilege escalation to Domain Admin through Kerberoasting, Shadow Credentials, group membership manipulation, Resource-Based Constrained Delegation, or LAPS password theft. A finding indicates a shadow administrator — an account with no explicit administrative group membership but with effective administrative control over the domain.

Review the affected account's permissions and remove the unnecessary DACL grant.

Unsecure Kerberos delegation

Detects Kerberos delegation misconfigurations, including unconstrained delegation, constrained delegation, and Resource-Based Constrained Delegation, that allow an attacker to impersonate users to services.

Review and remove unnecessary delegation configurations on the affected accounts.

Supported for Active Directory (on-premises).

Users with password not required

Detects user accounts that have the “Password Not Required” flag set.

Users with stale password

Detects Active Directory accounts whose password has not been changed within the required rotation period (90 days by default). Stale passwords increase the risk of unauthorized access from credential reuse or password spraying.

Accounts with the password-never-expires option enabled are excluded from this check; they are covered separately by the Disable non‑expiring password for AD accounts check.

Supported for Active Directory (on-premises) only.

Users with unconstrained delegation

Flags users with unconstrained delegation rights in Active Directory. These accounts can impersonate others and should be carefully reviewed.

AWS-Specific

This section describes ITP/PCCE checks unique to Amazon Web Services (AWS).

Avoid AWS privileged/shadow/admin role chaining

Helps to detect chaining of AWS roles, which can facilitate lateral movement and privilege escalation. You can configure which destination roles should be included. For example, you can configure it to track any role that can assume an administrative role.

To calculate this check, Verify Privileged Identity Platform analyzes the trust policies and checks whether one role can assume another.

Avoid AWS role chaining

To calculate this check, Verify Privileged Identity Platform analyzes the trust policies and checks whether one role can assume another.

Non-rotated AWS access keys

Detects AWS IAM user access keys that have not been rotated and have not been used within the past 60 days. Static, non-rotated keys pose a compliance and security risk.

Rotate the affected access keys according to your organization's key rotation policy.

Refactor excessive privileges for AWS policy

Detects IAM policies that can be refactored with a narrower scope based on activity during the last X days. Use the policy definition to define the number of days this detection should look back in order to identify unused permissions.

Reducing excessive privileges on a policy helps mitigate the blast radius of a breach, and keeps the organization secure by ensuring least privilege.