Identity and Privileged Access Security
Hybrid Identity and Federation
We review the sync and federation connections between on-premises Active Directory and Entra ID. We show whether a breach on one side grants admin rights to the other.
What it is
In hybrid identity, users work on-premises and in the cloud with the same account. Sync servers and federation trust enable this. For example, anyone who obtains the federation signing certificate can sign in to the cloud as any user. The review covers how these components are protected and the bidirectional transition paths.
Scope
- Identity sync server and sync account privileges
- Authentication method: password hash sync, pass-through authentication or federation
- AD FS or other federation servers and signing certificates
- On-premises accounts that are also cloud administrators
- Cloud features that can write back to on-premises, such as password writeback
- Sync scope and privileged accounts that should not be synchronized
The need
When organizations need it
- When on-premises Active Directory is synchronized with Entra ID and exposed to cloud applications.
- When planning a transition from AD FS to cloud authentication.
- When, after a merger, multiple directories begin syncing to the same tenant.
Method
How we work
-
Component inventory
We identify sync, federation and writeback components along with the servers and accounts they use.
-
Privilege analysis
We add these components' privileges in both directories to the privilege graph.
-
Cross-directory paths
We map the paths from on-premises to cloud admin and from cloud to domain admin.
-
Protection model
We propose a model that places critical components in the same protection tier as domain controllers.
Outcome
What you have at the end
You know the risk of every trust link between on-premises and cloud identities. The changes that block bidirectional paths are prioritized.
Frequently asked questions
Should we move from federation to cloud authentication?
Microsoft's guide for moving off AD FS recommends password hash sync for cloud authentication. The decision should follow a review of the specific needs currently met by federation.
Should cloud admin accounts be synced from on-premises?
Microsoft recommends assigning the most privileged cloud roles to cloud-only accounts with no connection to on-premises Active Directory. This prevents an on-premises breach from directly leading to cloud admin access.
Identity and Privileged Access Security
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting