Active Directory (AD) and Microsoft Entra ID sit at the centre of most enterprise identity estates, and they remain the most common path to full compromise. Ransomware operators and state actors alike aim for domain admin or Global Administrator, because from there they control everything that trusts the directory. Much of the risk comes from years of accumulated configuration: excessive privileged group membership, weak service accounts, legacy protocols, risky delegation, misconfigured certificate services and hybrid synchronisation that links on-premises compromise to the cloud. This guide sets out a practical, prioritised hardening approach for AD, Entra ID and the connection between them.
Key takeaways
- Use a tiered administration model: protect tier-zero assets (domain controllers, Entra ID, identity sync, certificate services, PAM) with separate accounts, devices and controls.
- Shrink standing privilege: few permanent Domain Admins or Global Administrators, just-in-time elevation for the rest.
- Fix the common attack paths: Kerberoastable service accounts, unconstrained delegation, vulnerable certificate templates, legacy authentication and stale objects.
- Treat hybrid identity infrastructure (synchronisation and federation servers) as tier zero; a compromise there can reach both environments.
- Protect non-human identities in both directories: service accounts, app registrations and service principals are frequent targets.
Understand tier zero
Tier zero includes anything that can control identities across the environment:
- Domain controllers, AD administrative groups and Group Policy affecting them.
- Entra ID privileged roles (such as Global Administrator and Privileged Role Administrator).
- Identity synchronisation and federation servers.
- Active Directory Certificate Services and other CAs trusted for authentication.
- PAM, backup and management systems with rights over tier-zero assets.
Administer tier zero only from dedicated privileged access workstations, with dedicated admin accounts that are never used for email or browsing.
Active Directory hardening priorities
Privileged groups
- Reduce membership of Domain Admins, Enterprise Admins, Schema Admins, Administrators and built-in operator groups to the minimum.
- Remove service accounts from privileged groups; grant specific delegated rights instead.
- Add privileged users to the Protected Users group where compatible.
- Monitor all changes to privileged groups and to AdminSDHolder.
Credentials and authentication
- Use Windows LAPS to randomise local administrator passwords.
- Replace service account passwords with group managed service accounts where possible; otherwise use long random passwords and AES encryption to resist Kerberoasting. See the Service Account Security Guide.
- Disable NTLMv1 and reduce NTLM use; enforce SMB and LDAP signing and channel binding.
- Rotate the KRBTGT account password periodically and after suspected compromise, following Microsoft's guidance to avoid disruption.
Delegation and ACLs
- Remove unconstrained delegation; use constrained or resource-based constrained delegation where needed.
- Review dangerous ACLs (for example, rights to reset passwords or modify group membership on privileged objects) using attack path analysis.
Certificate services
- Audit certificate templates for misconfigurations that allow users to request certificates for other identities, and restrict enrolment rights.
- Treat CA servers and their keys as tier zero.
Hygiene
- Disable and remove stale user, computer and service accounts.
- Remove legacy operating systems and trusts no longer needed.
Entra ID hardening priorities
Privileged roles
- Keep Global Administrators to a small number of cloud-only accounts with phishing-resistant MFA.
- Use least-privilege built-in roles and Privileged Identity Management for just-in-time activation with approval.
- Maintain two tested emergency access accounts, excluded carefully from policies and monitored. See the Break-Glass Account Guide.
Authentication and Conditional Access
- Require MFA for all users and phishing-resistant MFA for admins.
- Block legacy authentication.
- Require compliant or managed devices for privileged access and sensitive applications.
- Use sign-in and user risk policies where licensed.
Applications and service principals
- Restrict user consent to low-risk permissions; review admin-consented apps. See the SaaS and OAuth App Governance Guide.
- Find service principals with high-privilege application permissions (for example, broad Microsoft Graph write permissions) and reduce them.
- Prefer managed identities and certificate or federated credentials over client secrets; alert on new credentials added to existing apps.
- Assign owners to every app registration.
Tenant settings
- Restrict who can register applications, create tenants and invite guests.
- Review cross-tenant access and external collaboration settings.
Hybrid identity
- Treat synchronisation servers and any federation servers as tier zero.
- Do not synchronise on-premises privileged accounts to cloud privileged roles; use separate cloud-only admins.
- Consider moving from on-premises federation to cloud authentication where appropriate, reducing tier-zero infrastructure.
- Monitor for changes to synchronisation configuration and federation settings.
Monitoring
- Collect domain controller security logs and Entra ID sign-in and audit logs centrally.
- Detect Kerberoasting, DCSync, unusual ticket activity, privileged group changes, new federation trusts, new app credentials and role activations. See the ITDR Guide.
- Run regular attack path analysis to find new routes to tier zero.
Real-world lessons
- The Midnight Blizzard breach began with a legacy test account without MFA and an OAuth app with elevated permissions.
- The Cisco data breach involved leaked Active Directory credentials.
- The Entra ID tenant flaw showed the importance of monitoring even platform-level changes.
Practitioner checklist
- Define tier zero and administer it from dedicated accounts and workstations.
- Minimise permanent Domain Admins and Global Administrators; use just-in-time elevation.
- Deploy LAPS; move service accounts to gMSAs; enforce AES and strong passwords.
- Remove unconstrained delegation and fix vulnerable certificate templates.
- Block legacy authentication; require phishing-resistant MFA for admins.
- Reduce service principal permissions and restrict user consent.
- Protect hybrid sync and federation servers as tier zero.
- Monitor for directory attacks and run regular attack path analysis.
Standards and references
- Microsoft: Enterprise access model
- Microsoft: Best practices for Entra roles
- MITRE ATT&CK T1558: Steal or Forge Kerberos Tickets
- MITRE ATT&CK T1003.006: DCSync
- ASD Essential Eight (restrict administrative privileges; MFA)
Related NHI Mgmt Group resources: IdP and SSO Security Guide · Privileged Access Management Guide · ITDR Guide · Workforce Identity Security Guide
