Protecting Active Directory from management plane attacks

Great session. I wish there was a better guide / in-depth session to the 'in-the-middle' solution however. Not the old tier model, and not the model where everything is running in Azure. But perhaps one that considers DCs, etc running on premises, but branching out to all these cloud solutions (like Entra). It seems like a lot of guidance today skips over those details.