Blog Post

Core Infrastructure and Security Blog
9 MIN READ

Protecting Tier 0 the Modern Way

DagmarHeidecker's avatar
DagmarHeidecker
Icon for Microsoft rankMicrosoft
Feb 19, 2024
How should your Tier 0 Protection look like?   Almost every attack on Active Directory you hear about today – no matter if ransomware is involved or not – (ab)uses credential theft techniq...
Updated Feb 19, 2024
Version 5.0
DagmarHeidecker
svhelden's avatar
svhelden
Brass Contributor
Nov 04, 2024

testuser7 

we  create one  Entra-group  and  then writeback that group  under the  built-in  "Domain Admins"  group as child-group. (member of)

Interesting idea. Obviously this would make your domain security rely on Entra ID, meaning, any Entra admin could become a Tier 0 admin. Thus Entra would be part of Tier 0, too. If the workstation of a Global Admin is compromised, the attacker could use it to break into your AD. 


What do others think about that? For me it sounds like a violation of tier boundaries.