Active Directory and Entra ID Security: Hybrid Identity, Tiering and Privileged Identity Management

Active Directory and Microsoft Entra ID are among the most critical components in the identity and access security of modern organizations. Many organizations still use on-premises Active Directory while at the same time having moved to a cloud identity architecture over Microsoft 365, Azure and different SaaS applications. For this reason identity security can no longer be handled only as domain controller security or only as cloud tenant security. The real risk emerges in the Hybrid Identity structure where the two worlds connect to each other.

The Hybrid Identity model enables the user to use both local resources and cloud services with the same corporate identity. This structure is extremely efficient operationally but when designed incorrectly it can also form a strong transition path for the attacker. A privileged identity obtained on the on-premises Active Directory can because of synchronization or federation relationships also be effective on the cloud. Similarly a Global Administrator or high-privilege identity obtained on the cloud side can weaken the organization's identity governance structure and can be used to provide access to other systems.

For this reason Active Directory and Entra ID security must be thought of together.

The fundamental question of the modern approach is this:

"When one side of an identity infrastructure is compromised how much can the other side be affected and how can we limit this effect?"

The answer to this question can be given not only with technology but with architectural design, privilege separation, tiering, MFA, Conditional Access, PIM and continuous monitoring.

Why Is Active Directory Still Critical?

Active Directory has for many years been the foundation of enterprise identity infrastructure. User accounts, computer accounts, group memberships, authentication and authorization processes can largely be managed over Active Directory.

The information located on a Domain Controller does not consist only of usernames.

Active Directory at the same time contains:

group memberships,

service accounts,

Kerberos relationships,

computer identities,

trust relationships,

administrative privileges

many critical security relationships such as these.

For this reason when Active Directory is compromised the attacker has come close not only to a single user but to the organization's identity control plane.

Especially a compromise at the Domain Admin or Enterprise Admin level can create a high impact.

For this reason Active Directory security is not only a server hardening subject.

It is actually an Identity Security problem.

What Is the Active Directory Attack Surface?

The Active Directory attack surface expresses all the identities, misconfigurations, privileges and attack paths the attacker can use inside the domain infrastructure.

Inside this attack surface:

Excessive Group Memberships

Old Administrator Accounts

Service Accounts

Weak Delegation

Legacy Protocols

Misconfigured Trusts

Dormant Accounts

Local Administrator Password Reuse

many areas such as these can be included.

One of the fundamental reasons for the attack surface growing is the operational changes made over the years.

New administrators are added.

Old accounts are not removed.

Service accounts gain privilege.

Temporary permissions become permanent.

For this reason Active Directory security requires a continuous hygiene and governance process.

Why Are Domain Admin Accounts One of the Most Critical Targets?

A Domain Admin account has broad authority on Active Directory.

For this reason it is one of the most valuable targets for the attacker.

However, the important problem is not only whether the Domain Admin password is strong.

Where the Domain Admin identity is used is also critical.

If the Domain Admin account is being used in daily work such as:

a normal workstation,

an e-mail client,

a web browser,

internet access

the attack surface grows seriously.

For this reason the privileged identity and the standard user identity must be separated.

For example while the user carries out their daily work with the account:

ramazan.gultekin

for privileged operations they can use a separate:

adm-ramazan.gultekin

identity.

However, in the modern approach instead of permanent Domain Admin membership temporary privilege models such as JIT or PIM are safer.

What Is Tier 0?

Tier 0 is the security layer in which the systems and identities that can create the highest impact on the identity infrastructure are located.

Tier 0 does not mean only Domain Controllers.

For example:

Domain Controllers

PKI Infrastructure

PAM Platform

Identity Synchronization Servers

Cloud Identity Connectors

systems such as these can be evaluated as Tier 0.

Because when these systems are compromised the attacker can create a high effect on the identity control plane.

The fundamental principle in Tier 0 security:

A Tier 0 credential should not be used on systems at a lower security level.

For this reason an administrator logging in to a normal workstation with Tier 0 credentials creates a serious risk.

What Is Administrative Tiering?

Administrative Tiering is the architectural approach that aims to separate privileged systems and identities according to security levels.

For example:

Tier 0

Identity Infrastructure

Tier 1

Servers and Business Applications

Tier 2

User Workstations

it can be thought of in this way.

A Tier 0 administrator logging in on a Tier 2 workstation can be prevented.

In this way when a low security level endpoint is compromised the possibility of the attacker obtaining a high privilege credential is reduced.

This model limits the credential exposure risk.

What Is a Privileged Access Workstation – PAW?

A PAW, that is, a Privileged Access Workstation, is the hardened and dedicated workstation used for the administrator to carry out high-privilege operations.

On this device activities such as:

general internet browsing,

personal e-mail,

unapproved software

can be limited.

The aim is for the privileged credential to be used only inside a trusted administration environment.

The PAW approach provides a strong security layer especially for Tier 0 administrators.

The modern model can be thought of in this way:

Trusted Admin Identity + Trusted Admin Device + Controlled Privileged Session

When these three layers work together the credential theft risk can be reduced significantly.

What Is Microsoft Entra ID?

Microsoft Entra ID is a cloud identity and access management platform.

It can offer many capabilities such as workforce identities, authentication, SSO, MFA, Conditional Access, application access and privileged role management.

It is positioned as the central identity platform for Microsoft 365 and Azure environments.

However, Entra ID should not be thought of only as a cloud directory.

Inside a modern identity architecture it plays a critical role in areas such as:

Authentication

Authorization

Conditional Access

Application Federation

Identity Governance

Privileged Identity Management

these.

For this reason when Entra ID is compromised the impact may not be limited only to e-mail access.

What Is Hybrid Identity?

Hybrid Identity is the model in which on-premises Active Directory and a cloud identity platform work together.

The user is created in the local directory.

The identity is synchronized to the cloud.

The same user can access Microsoft 365 or other cloud applications.

This model provides great convenience in terms of user experience and administration.

However, because of the identity relationship a security dependency arises.

For example a compromised on-prem identity can turn into cloud access.

For this reason the hybrid identity architecture must be designed safely.

What Is Password Hash Synchronization?

Password Hash Synchronization is the method that enables user password information after particular cryptographic processing to be synchronized to the cloud identity platform.

In this model cloud authentication can be carried out on Entra ID.

The user's direct dependency on the on-premises environment at every login can decrease.

However, the synchronization infrastructure becomes critical.

If the sync server is compromised a high risk can arise in terms of identity security.

For this reason identity synchronization servers must be protected as high-value systems.

What Is Pass-through Authentication?

Pass-through Authentication enables the authentication request during cloud login to be verified over the on-premises Active Directory.

This model can be used for particular architecture requirements.

However, it creates a dependency on the on-prem authentication infrastructure.

The security and availability design must be made accordingly.

Which authentication model will be used must be evaluated according to the organization's:

security requirements,

availability expectations,

hybrid architecture

situation.

What Is Federation and Why Can It Create Risk?

Federation creates trust between different identity domains.

The user authenticates over one identity provider and another service accepts this authentication.

This structure is strong for enterprise SSO.

However, if the federation relationship is compromised the attacker can try to produce fake identity assertions.

For this reason the federation infrastructure and certificates are extremely critical security assets.

Inside a modern architecture federation must be seen not only as convenience but as a high-value trust relationship.

Why Is Entra ID Connect Security Important?

The components that provide synchronization between the on-premises Active Directory and Entra ID are one of the most critical points of hybrid identity.

On these servers there can be high privilege or sensitive credentials.

For this reason synchronization servers must be protected as:

dedicated,

hardened,

with restricted network access,

with strong monitoring

these.

They should not be evaluated like a normal application server.

Because they are an identity bridge, in the case of a compromise an attack path can arise between on-prem and cloud.

What Is PIM – Privileged Identity Management?

Privileged Identity Management enables cloud privileged roles to be used as eligible and temporary instead of being kept continuously active.

For example instead of a user being a permanent Global Administrator they can be eligible for the Global Administrator role.

At the moment of need with:

MFA,

justification,

approval,

a limited duration

the role is activated.

At the end of the period the role automatically becomes passive.

This model reduces the Standing Privilege risk.

The fundamental logic of PIM is the transformation:

Permanent Admin → Eligible Admin → Temporary Activation

this transformation.

Why Is a Permanent Global Administrator Risky?

If a user continuously has the Global Administrator role, when the account is compromised the attacker obtains high privilege directly.

In the JIT/PIM model even if the attacker compromises the normal user account they can be obliged to activate the privileged role separately.

This additional control forms an additional barrier for the attacker.

For this reason high-impact cloud roles can as far as possible be defined as eligible instead of permanent.

Should the Number of Global Administrators Be Minimal?

Yes.

High-impact administrative roles must as far as possible be given to a minimum number of users.

Not every IT employee should be a Global Administrator.

Role-specific permissions must be used.

For example:

Exchange Administrator

Security Administrator

User Administrator

more limited roles such as these can be used.

This is the Least Privilege approach.

In a cloud identity environment too granular role design should be preferred instead of broad privilege.

How Is Conditional Access Used in Hybrid Identity Security?

Conditional Access applies a security policy during login according to the identity and context.

For example:

User = Administrator

Device = Managed

MFA = Phishing-Resistant

Location = Allowed

↓

Access

a policy such as this can be applied.

In another case:

Device = Unmanaged

↓

Block

This model provides stronger control for administrators.

For privileged users Conditional Access policies different from the normal workforce must be applied.

Why Is an Authentication Strength Policy Important?

MFA being active is not sufficient on its own.

If the administrator is using SMS MFA the phishing resistance can be limited.

For this reason for privileged roles stronger authentication methods such as FIDO2 or a passkey can be made mandatory.

This approach rests on the principle:

Higher Privilege = Stronger Authentication

this principle.

Why Is a Break-Glass Account Necessary for Entra ID?

Because of a wrong configuration of Conditional Access or the identity infrastructure administrators' access can be cut completely.

For this reason Break-Glass accounts can be necessary for emergency access.

However, these accounts should not be used during normal operations.

For a break-glass account:

a strong credential,

restricted usage,

continuous monitoring,

alerting

must be applied.

Every usage can be reviewed like a security incident.

Why Should Legacy Authentication Be Closed?

Legacy Authentication protocols may not support modern MFA and Conditional Access capabilities.

For this reason the attacker can try to provide access with password-only authentication.

One of the important steps of modern identity hardening is to reduce or close legacy protocols.

This is important especially for hybrid environments.

Because even if the organization is applying MFA in cloud authentication a bypass path can remain over an old protocol.

Privilege Separation Between Active Directory and Entra ID

In a hybrid environment the same administrator being both on-prem Domain Admin and cloud Global Admin can create a high risk.

Because a single identity compromise can affect both environments.

For this reason privileged roles can be separated.

For example:

On-Prem Admin Identity

and

Cloud Admin Identity

can be kept different.

This reduces the blast radius.

What Is Blast Radius?

Blast Radius expresses how wide a system and resource a compromise event can affect.

A standard user compromise can create limited impact.

However, if the same user is:

Domain Admin

Global Admin

Backup Admin

the blast radius grows a lot.

One of the fundamental targets of an identity architecture is to reduce this blast radius.

What Is a Hybrid Identity Attack Path?

A Hybrid Identity Attack Path is the relationship that enables the attacker to progress from a compromise in one environment to the other identity environment.

For example:

Compromised Workstation

↓

Admin Credential Theft

↓

Active Directory Privilege

↓

Sync Infrastructure

↓

Cloud Identity

a chain such as this can arise.

For this reason identity relationships must be examined with attack path analysis.

Active Directory Attack Path Analysis

Inside AD environments permissions and group memberships can create complex relationships.

A user may not be a Domain Admin directly.

However, over another group or delegated permission they can eventually obtain high privilege.

For this reason looking only at the group membership list is not sufficient.

Attack Path Analysis analyzes the privilege relationships between identities.

This is related to Identity Security Posture Management.

What Is Identity Security Posture Management – ISPM?

ISPM can be thought of as the approach that aims to provide visibility over misconfigurations, excessive privileges and attack paths inside the identity infrastructure.

For example:

a Dormant Admin Account

Excessive Group Membership

Risky Delegation

Service Account Overprivilege

issues such as these can be detected.

This is a proactive security layer.

While ITDR detects attacks ISPM aims to reduce the attack surface beforehand.

How Do AD Security and ITDR Work Together?

Active Directory hardening provides preventive security.

ITDR, on the other hand, carries out detection when identity attacks start.

For example:

a new Domain Admin membership,

unusual Kerberos activity,

a service account anomaly,

a privileged login

can be monitored by ITDR.

For this reason the ideal model:

Identity Posture + Identity Detection + Identity Response

is in this way.

Entra ID and ITDR Integration

Cloud identity events are also a critical data source for ITDR.

For example:

Risky Sign-In

New MFA Method

New Application Consent

Privileged Role Activation

New Service Principal

events such as these can be monitored.

These signals can be correlated on the SIEM or XDR.

Cloud identity compromise detection should not be limited only to failed login monitoring.

OAuth and Application Consent Risks

In an Entra ID environment third-party applications can request OAuth permissions.

The user can give consent to a malicious application.

In this case the attacker can provide data access without stealing the password.

For this reason:

Enterprise Applications

OAuth Grants

App Registrations

Service Principals

must be reviewed regularly.

Identity Security must cover not only user accounts but also application identities.

Service Principals and Workload Identities

Inside cloud environments applications do not log in like human users.

Service Principals and Workload Identities can be used.

These identities can have high permissions.

However, most of the time MFA cannot be applied.

For this reason for machine identities controls such as:

Least Privilege

Short-Lived Credentials

Secret Rotation

Monitoring

become critical.

Modern Hybrid Identity Security must handle human and machine identities together.

Active Directory Service Account Security

Service accounts inside AD can carry long-lived passwords and broad privileges.

These accounts should not be used for interactive login and should have the necessary minimum permissions.

Managed service account models can be preferred in suitable environments.

The aim is to reduce manual password management and to make the credential lifecycle safer.

Service accounts must also be taken into the ITDR and PAM scope.

Local Administrator Security

Even if the domain security is strong, if common local administrator passwords are used on endpoints a lateral movement risk can arise.

Using different local administrator credentials on every device and managing the credentials centrally is safer.

Local admin rights must be reduced as far as possible.

Endpoint Privilege Management can strengthen this area.

Active Directory Backup Security

Identity infrastructure backups are also critical security assets.

A Domain Controller backup or system state backup can be targeted by the attacker.

For this reason backup access must be managed with separate privileged identities.

In ransomware scenarios identity recovery capability is extremely important.

For this reason AD backup and forest recovery plans must be tested regularly.

Why Is Active Directory Forest Recovery Important?

In the case of a large identity compromise restoring only a single server may not be sufficient.

Forest-level recovery can be necessary.

For this reason the organization:

Recovery Procedures

Clean Infrastructure

Backup Validation

Credential Reset Strategy

must plan subjects such as these in advance.

Identity Disaster Recovery must be thought of differently from general server DR.

A Hybrid Identity Disaster Scenario

For example the on-prem Active Directory has been compromised.

In this case these questions must be answered quickly:

Could the cloud identities have been affected?

Is the sync infrastructure trustworthy?

Could the federation trust have been compromised?

Should privileged sessions be revoked?

Should cloud admin roles be reviewed again?

For this reason a Hybrid Identity Incident Response Playbook must be created.

Can a Cloud Compromise Affect On-Prem?

Yes, depending on the architecture it can be possible.

Cloud administrator access:

application integrations,

device management,

identity synchronization,

remote access

can create an impact on on-prem systems over paths such as these.

For this reason the thought "cloud is separate, on-prem is separate" is misleading for hybrid environments.

The real security boundary:

Identity Trust Relationships

must be evaluated over these.

Should PAM Be Used for Tier 0?

Yes, high impact privileged identities must be taken into the scope of PAM.

For accounts such as Domain Admin, Enterprise Admin, PKI Admin:

PAM

JIT

Strong MFA

Session Monitoring

can be used.

In this way permanent privilege can be reduced.

The PAW + PAM + PIM Model for Tier 0

A modern high-security architecture can be designed in this way:

Dedicated Admin Identity

↓

PAW

↓

Phishing-Resistant MFA

↓

PAM/PIM

↓

JIT Privilege

↓

Tier 0 Resource

This model reduces the credential exposure and standing privilege risks at the same time.

The Product Ecosystem in Active Directory and Entra ID Security

Microsoft Entra ID, Microsoft Defender for Identity, PAM platforms and different identity security tools can be used together.

On the PAM side platforms such as CyberArk, BeyondTrust and Delinea can control privileged access.

On the IGA side solutions such as SailPoint and Saviynt can provide governance.

On the identity threat detection side Microsoft Defender for Identity and other ITDR solutions can be used.

However, the products being present together does not on its own form a security architecture.

What is important is data and control integration.

How Is Hybrid Identity Security Measured?

Identity security KPIs can include these areas:

Permanent Global Admin Count

Permanent Domain Admin Count

PIM Adoption Rate

Privileged MFA Coverage

Phishing-Resistant MFA Coverage

Legacy Authentication Usage

Dormant Admin Accounts

Tier 0 Direct Login Count

Service Account Risk Count

Risky Application Consents

High-Risk Sign-In Count

metrics such as these can be used.

The number of permanent privileges being reduced in particular is an important maturity indicator.

The Most Frequently Made Mistakes in Active Directory and Entra ID Security

These mistakes are frequently seen in organizations:

• Using the Domain Admin account in daily use
• Using Tier 0 identities on a normal workstation
• Leaving permanent Global Administrator roles
• Not using PIM
• Not making phishing-resistant MFA mandatory for privileged users
• Leaving Legacy Authentication open
• Not monitoring Break-Glass accounts
• Protecting sync servers like a normal application server
• Accepting the federation infrastructure as low-risk
• Combining on-prem and cloud administrators in the same identity
• Leaving Service Accounts outside governance
• Not monitoring OAuth Application Consent
• Not cleaning up dormant privileged accounts
• Not controlling Local Admin rights
• Not carrying out AD backup and forest recovery tests
• Trusting only hardening without using ITDR
• Ignoring the on-prem impact of a cloud compromise
• Not creating a Hybrid Identity Incident Response plan

Active Directory and Entra ID Security Checklist

Organizations can evaluate the following controls:

• Are Domain Admin accounts at a minimum number?
• Are Enterprise Admin accounts under control?
• Have privileged identities been separated from daily-use accounts?
• Is a Tier 0 model defined?
• Is a PAW or secure admin workstation being used?
• Is PIM being applied?
• Is permanent Global Admin being reduced?
• Is JIT privilege being used?
• Do privileged users use phishing-resistant MFA?
• Is Conditional Access being applied?
• Are Authentication Strength policies present?
• Is Legacy Authentication being closed?
• Are Break-Glass accounts being monitored?
• Is the hybrid sync infrastructure protected as Tier 0?
• Are the federation certificates safe?
• Is a Service Accounts inventory present?
• Are Local Administrator passwords centralized?
• Are OAuth Application Consents being reviewed?
• Are Service Principals being taken into the governance scope?
• Are Workload Identities under monitoring?
• Are dormant admin accounts being removed?
• Are AD attack paths being analyzed?
• Is ITDR being applied?
• Are identity logs being transferred to the SIEM?
• Is an AD backup strategy present?
• Is Forest Recovery being tested?
• Is there a Hybrid Identity Incident Response plan?
• Are cloud and on-prem privileges governed separately?

Active Directory and Entra ID Security Maturity Model

Level 1 – Traditional Domain Security: Active Directory is the fundamental authentication platform. Privileged accounts can be permanent and broad. Cloud identity has limited governance.

Level 2 – Hybrid Identity Controls: Entra ID, MFA and Conditional Access are applied. Cloud and on-prem identities become central but permanent privilege can continue.

Level 3 – Privileged Identity Separation: Tiering, PAW, PIM and dedicated admin identities are applied. Privileged access becomes more controlled.

Level 4 – Identity Threat Defense: ITDR, attack path analysis, PAM and cloud risk analytics are used together. An identity compromise is detected quickly.

Level 5 – Adaptive Hybrid Identity Security: Human, Machine and AI Agent identities are managed with real-time risk, JIT privilege and continuous access evaluation. Permanent trust and permanent privilege are brought down to the minimum level.

This transformation:

Domain-Centric Identity

↓

Hybrid Identity

↓

Privileged Identity Separation

↓

Identity Threat Defense

↓

Adaptive Identity Security

proceeds in this way.

Frequently Asked Questions

What is Active Directory?

Active Directory is the enterprise directory and identity platform that enables users, computers, groups and authentication relationships to be managed centrally.

What is Microsoft Entra ID?

Microsoft Entra ID is a cloud-based identity and access management platform. It can offer SSO, MFA, Conditional Access, application access and privileged identity capabilities.

Are Active Directory and Entra ID the same thing?

No. While Active Directory is a traditional on-prem directory and domain infrastructure, Entra ID is a cloud identity platform. They can work together inside a Hybrid Identity architecture.

What is Hybrid Identity?

It is on-premises Active Directory and a cloud identity platform being used together inside a common identity lifecycle and authentication architecture.

What is Tier 0?

It is the security level in which the systems and privileged identities that when compromised can create a very high impact on the identity infrastructure are located.

What is a PAW?

A Privileged Access Workstation is the dedicated and hardened workstation used for the administrator to carry out high-risk administrative operations.

What is PIM?

Privileged Identity Management is the approach and technology category that enables privileged roles to be activated temporarily and in a controlled way instead of being kept continuously active.

Are PIM and PAM the same thing?

No. While PIM concentrates on privileged roles and activation, PAM can contain broader capabilities such as credential vaulting, session management, password rotation and endpoint privilege.

Should a Global Administrator be permanent?

As far as possible the number of permanent Global Administrators must be kept to a minimum and eligible/JIT activation models must be evaluated.

Why should a Domain Admin not be used as a daily account?

E-mail, web browsing and standard endpoint use increase the Domain Admin credential exposure risk.

What is a Hybrid Identity attack?

It is the attack model in which the attacker tries to progress from one environment to the other using the on-prem and cloud identity relationships.

What is Password Hash Synchronization?

It is the method that enables cloud authentication to be carried out by synchronizing a processed form of the on-prem password hash information to the cloud identity platform.

What is Pass-through Authentication?

It is the hybrid authentication method that enables the cloud authentication request to be verified over the on-premises Active Directory.

Why is Legacy Authentication risky?

Because some legacy protocols do not support MFA and Conditional Access controls they can create a password-only attack path.

What is a Break-Glass Account?

It is the special, strictly protected administrator account used for emergency access when the normal identity controls are inaccessible.

What is a Service Principal?

It is the non-human identity type used by cloud applications or automation workloads.

Can an AD compromise affect the cloud?

Depending on the hybrid architecture yes. Because of synchronization, federation or privileged relationships an on-prem compromise can create an impact on cloud security.

Can a cloud compromise affect on-prem systems?

Depending on the architecture it can be possible. For this reason cloud and on-prem identity relationships must be evaluated together.

Conclusion: In Hybrid Identity Security the Boundary Is No Longer the Domain but the Trust Relationship

Even though Active Directory and Entra ID are separate technologies they should not be thought of as security domains independent of each other inside a modern enterprise architecture.

Because the identities can be common.

Authentication flows can be connected to each other.

Synchronization systems can form a bridge between the two environments.

Privileged users can have authority on both sides.

For this reason the most important principle of Hybrid Identity Security:

Trust Relationships Are Security Boundaries

can be summarized as this.

The on-premises Active Directory may have been hardened extremely well.

However, if the cloud administrator account is using weak authentication the risk continues.

Cloud Conditional Access can be extremely strong.

However, if the Tier 0 administrator credential is being used on a normal workstation the risk continues.

Therefore modern Identity Security cannot be built over a single control.

A strong architecture must use these layers together:

Tiering + Dedicated Admin Identity + PAW + Phishing-Resistant MFA + PIM/PAM + JIT Access + Conditional Access + ITDR + Continuous Monitoring

This approach reduces the privileged identity compromise risk.

The modern target:

No Shared Admin

No Daily-Use Privileged Identity

No Permanent Global Admin

No Unmonitored Tier 0 Access

can be thought of in this way.

As Hybrid Identity grows machine identities, service principals and AI Agents must also be included in this architecture.

Because in the identity infrastructure of the future there will not be only employee accounts.

Human identities,

service accounts,

workloads,

cloud applications

and AI Agents will move inside the same trust ecosystem.

For this reason the future of Active Directory and Entra ID security will be not only account protection but:

Identity Relationship Security

this.

And the most important sentence of this chapter:

In Hybrid Identity environments the real security boundary is not the physical separation between Active Directory and the cloud; it is how controlled the identity, authority and trust relationships created between the two environments are.