No hybrid user with permanent role assignment on Control Plane
Description
Permanent Assignments of high-privileged Entra ID directory roles will be checked to identify privileges for hybrid users. Related roles will be identified based on the classification model from the EntraOps project which helps to identify directory roles with Control Plane (Tier0) permissions.
How to fix
It's recommended to use cloud-only accounts for privileges with Control Plane privileges to avoid attack paths from on-premises environment.