Every ransomware crew, every state-sponsored intrusion set, and every bored teenager with a credential-stuffing list eventually arrives at the same door: the directory. Active Directory and Entra ID are where authentication, authorization, group membership, and trust converge — which makes them the single highest-leverage target in almost any enterprise network. If you protect the identity plane well, you collapse most lateral movement paths before they start. If you don’t, every other control — EDR, firewalls, DLP — becomes a speed bump on the way to domain admin.
Identity is the control plane, not a compliance checkbox
For two decades, Active Directory was treated as plumbing: something the infrastructure team configured once and revisited only for patching or a forest migration. That model is obsolete. In a hybrid enterprise, the on-premises domain controller and the Entra ID (formerly Azure AD) tenant form a single, continuously synchronized trust fabric via Entra Connect (or Entra Cloud Sync), and that fabric now authenticates humans, service accounts, CI/CD pipelines, SaaS integrations, and autonomous agents alike. Compromise the directory and you don’t just get a foothold — you get the keys to every downstream system that trusts a Kerberos ticket, a SAML assertion, or an OAuth token.
The shift in adversary tradecraft over the last several years confirms this. Verizon’s breach data, Mandiant’s incident response retrospectives, and Microsoft’s own Digital Defense Report all converge on the same finding: credential abuse and identity-based attack paths now outnumber malware-based initial access. Attackers have realized that living off valid identity is cheaper, quieter, and more durable than deploying custom malware that an EDR agent might flag. A Kerberoasted service account ticket looks like normal traffic. A stolen primary refresh token looks like a normal sign-in. Identity security is therefore not a subset of endpoint or network security — it is the control plane those other domains ultimately depend on.
This article treats Active Directory and Entra ID as one interconnected attack surface and lays out the concrete architecture required to defend it: identity threat detection and response (ITDR), privileged access management (PAM), identity governance, and the analytics layer that ties detection to response. Throughout, we treat human and non-human identity as the same unit of risk, because in most enterprises today the majority of authentications are machine-to-machine.
Anatomy of the hybrid identity attack surface
On-premises Active Directory exposure
On-premises AD exposure concentrates around a handful of well-understood but persistently under-remediated mechanisms. Kerberoasting extracts service ticket hashes for accounts with Service Principal Names (SPNs) and cracks them offline against weak passwords. AS-REP roasting targets accounts with Kerberos pre-authentication disabled. DCSync abuses replication permissions (Replicating Directory Changes and Replicating Directory Changes All) to pull password hashes directly from a domain controller without ever touching the DC’s disk. Golden Ticket and Silver Ticket attacks forge Kerberos TGTs and service tickets respectively once the krbtgt or a service account’s hash is stolen, granting persistence that survives ordinary password resets unless the krbtgt secret is rotated twice. NTLM relay chains — especially those combined with Active Directory Certificate Services misconfigurations (the ESC1 through ESC8 escalation paths catalogued by security researchers) — let an attacker pivot from a low-privilege foothold to domain-level certificate-based authentication in a single relay.
What makes these techniques dangerous operationally is that most of them generate no malware artifact at all. They are abuses of legitimate protocol behavior and legitimate permissions that were granted, often years earlier, by an administrator who no longer works at the company. This is why attack path mapping tools built on the BloodHound data model matter so much: they reveal the graph of effective privilege — who can reset whose password, who is a member of a group nested three levels deep into Domain Admins, which service account has GenericAll rights on an OU — that no static permissions report will surface.
Entra ID exposure
Entra ID introduces a parallel but distinct set of exposures. Consent phishing tricks a user into granting an OAuth application broad Graph API scopes, giving the attacker mail, file, and directory read access without ever needing a password. Primary Refresh Token (PRT) theft from a compromised endpoint grants an attacker a long-lived, device-bound token that satisfies most Conditional Access checks. Seamless SSO abuse and pass-the-cookie attacks bypass MFA entirely by replaying a session artifact rather than authenticating fresh. Misconfigured Conditional Access policies — a legacy authentication protocol left enabled, a break-glass account excluded from every policy and never monitored, or a policy that only checks device compliance but not sign-in risk — create quiet bypass lanes. And because Entra ID is the identity provider for most SaaS estates, a single compromised Global Administrator account, or a rogue enterprise application with static Graph API permissions, can cascade into every connected SaaS tenant.
The critical operational point is that AD and Entra ID are not two separate problems to be solved by two separate teams with two separate tools. Entra Connect synchronizes password hashes or enables pass-through authentication in near real time; a compromised on-prem admin account frequently has an Entra ID mirror with cloud privileges, and a compromised cloud identity with hybrid join can push code back down to on-prem endpoints via device management. The defensible unit is the whole trust fabric, and your detection and governance architecture has to span it natively rather than bolt two disconnected consoles together.
Non-human identity: the fastest-growing and least-governed attack surface
Service accounts, group Managed Service Accounts (gMSAs), Entra ID service principals, managed identities, API keys, CI/CD pipeline credentials, and increasingly autonomous AI agents now outnumber human identities in most enterprises by a wide margin. Non-human identities (NHIs) are attractive to attackers for three structural reasons. First, they are almost never subject to MFA, because the protocols they use — Kerberos with a keytab, client-credential OAuth flows, certificate-based auth — have no interactive step at which to challenge. Second, they are frequently over-provisioned at creation time because a developer requested broad Graph API permissions or domain-wide replication rights to unblock a project deadline, and nobody circled back to right-size the grant. Third, they are rarely owned by an accountable human after the original requester leaves the company, which means access reviews silently skip them.
A rigorous non-human identity program treats every service account, service principal, and workload identity as a first-class entity in the identity graph with the same lifecycle discipline applied to humans: an accountable owner, a documented business justification, a scoped set of entitlements, an expiration or recurring review date, and behavioral baselining. Practically, this means migrating legacy service accounts with static passwords to gMSAs (which rotate their own password automatically and cannot be interactively logged on with), migrating Entra ID app registrations from client secrets to certificate-based or federated workload identity credentials, and building an inventory that reconciles what exists in the directory against what exists in your CMDB or infrastructure-as-code repository — because the accounts nobody remembers creating are exactly the ones that show up in a DCSync six months later.
Autonomous AI agents deserve explicit mention because they are a new and rapidly expanding category of non-human identity. An agent that can read a mailbox, query a database, or trigger a remediation workflow needs its own scoped identity, its own audit trail, and its own Conditional Access posture — not a shared service account inherited from whichever engineer stood up the pilot. Algomox’s own agentic layer, Norra, is built specifically around this principle: every autonomous action an AI worker takes is executed under a distinct, governed, revocable identity with least-privilege scoping and full action logging, which is the same standard you should demand of any AI tooling you connect to Active Directory or Entra ID.
ITDR architecture: detecting identity compromise in real time
Identity Threat Detection and Response is the discipline of instrumenting the authentication and authorization layer itself — not just the endpoints and network segments around it — so that credential misuse is caught while it is happening rather than reconstructed afterward from logs. A mature ITDR architecture has four components working together: telemetry collection at the protocol level, a normalized identity graph that captures effective privilege, behavioral baselining per identity, and automated response actions that can act at machine speed.
Telemetry sources that actually matter
On the AD side, the highest-value telemetry sources are Windows Security Event Log IDs 4768/4769/4770 (Kerberos ticket requests and renewals, essential for spotting Kerberoasting via abnormal encryption types and ticket request volume), Event ID 4662 with the correct SACL configured on directory-replication properties (the only reliable way to catch DCSync at the API level), Event ID 4624/4625 logon type analysis (type 3 network logons combined with NTLM in an environment that should be Kerberos-only is a strong pass-the-hash indicator), and a dedicated identity threat sensor deployed on domain controllers, which instruments LDAP and Kerberos traffic directly and ships purpose-built detections for DCSync, Golden Ticket, and remote code execution attempts against DCs. On the Entra ID side, the sign-in logs (interactive and non-interactive), audit logs, and the risk-detection feed from Entra ID Protection (impossible travel, anonymous IP, atypical travel, token replay) are the backbone; the non-interactive sign-in log in particular is where PRT and refresh-token abuse shows up, because the attacker is authenticating without a fresh interactive challenge.
From raw events to identity risk score
Raw event volume defeats human analysts long before it defeats the adversary — a mid-size enterprise domain controller can generate tens of millions of Kerberos ticket-request events a day. The architectural answer is to normalize every identity event, human and non-human, into a common identity graph keyed on the account, its group memberships, its effective entitlements, and its historical behavioral baseline, then score deviations rather than alert on raw events. A service account that has requested the same three service tickets every day for two years and suddenly requests a ticket for a domain controller’s CIFS SPN is a high-confidence anomaly regardless of whether any individual event crosses a static threshold. This is precisely the pattern-of-life analytics problem that Algomox’s MoxDB data foundation and CyberMox’s detection engines are built to solve at scale — ingesting AD, Entra ID, EDR, and network telemetry into one normalized graph so that identity risk scoring, lateral movement path analysis, and cross-domain correlation happen against a single source of truth instead of three disconnected consoles.
Privileged access management: closing the standing-privilege gap
The tiering model as the foundation
The tiered administration model remains the single most effective structural control against credential escalation, and it is remarkable how many enterprises still have it only partially implemented years after it was first published. The model separates administrative control into Tier 0 (domain controllers, federation servers, Entra Connect servers, PKI infrastructure, and anything that can compromise the forest), Tier 1 (server administration), and Tier 2 (workstation and end-user support), with the hard rule that credentials from a higher tier must never be used to log on to a lower-tier asset. The single most common violation Algomox incident responders encounter is a Domain Admin account used interactively to troubleshoot a help desk ticket on a Tier 2 workstation — at which point that credential’s hash is cached in memory on an asset with a vastly larger, less controlled attack surface, one credential-dumping tool away from full domain compromise.
Enforcing tiering requires more than a policy document. It requires Authentication Silos and Authentication Policies to technically restrict where Tier 0 credentials can authenticate, dedicated Privileged Access Workstations (PAWs) for all Tier 0 administrative activity, and a Local Administrator Password Solution (LAPS) to eliminate shared local administrator passwords that let an attacker pivot laterally across every machine in a build image. None of this is optional in a defensible architecture — it is the difference between an incident that is contained to one workstation and one that ends in ransomware across the entire estate.
Just-in-time and just-enough access
Standing privilege is the single largest reducible risk in most identity estates. Every account that is a permanent member of Domain Admins, Enterprise Admins, or an Entra ID Global Administrator role is a target that is valuable to compromise at any hour of any day, whether or not anyone is actively using that privilege. Just-in-time (JIT) elevation — via Entra ID Privileged Identity Management (PIM) for cloud roles, and via a PAM vaulting solution with time-boxed checkout for on-prem privileged accounts — converts permanent privilege into privilege that exists only for the duration of an approved, logged, time-limited activation window, typically requiring MFA and manager or peer approval to activate. Just-Enough-Administration (JEA) takes this further at the workload level, constraining what an elevated PowerShell session can actually execute to a defined command allowlist rather than granting full administrative shell access for a task that only needed to restart one service.
The combined effect of tiering plus JIT/JEA plus PAW plus LAPS is to shrink the population of standing privileged credentials that exist at any given moment to nearly zero, and to force every privileged action through a vault, an approval, and an audit trail. This is the architecture that converts a stolen credential from an instant domain compromise into, at worst, a contained, alertable, time-boxed exposure. Organizations building this out should look at the identity and PAM solution layer as the operational blueprint for tying tiering, PAW enforcement, and JIT elevation into one workflow rather than three unrelated projects.
Identity governance: entitlement hygiene at scale
Detection and privileged access controls fail quietly if the underlying entitlement model is a mess — nested groups eight levels deep, orphaned accounts from employees who left eighteen months ago, and service accounts with domain-wide GenericAll rights granted for a project that shipped years ago. Identity governance is the discipline that keeps the entitlement graph itself clean, and it operates on three cadences: continuous (automated lifecycle joiner-mover-leaver enforcement), periodic (quarterly or semi-annual access certification campaigns for privileged and sensitive roles), and event-driven (immediate revocation triggered by a role change, contract termination, or a detected risk signal).
Segregation of duties (SoD) analysis is the piece most programs under-invest in. It is not enough to confirm that an individual account has appropriate access at a point in time; you have to confirm that combinations of access don’t create an unacceptable risk — the classic example being a single identity that can both create a vendor in the ERP system and approve payment to that vendor, or in identity terms, an account that can both request a certificate template modification and approve Active Directory Certificate Services template changes, which together enable an escalation with a single set of compromised credentials. Effective SoD analysis requires the entitlement graph to be modeled with the same fidelity attack-path tooling applies to reconnaissance — because an SoD violation is functionally just an attack path that happens to be legitimate on paper.
Access certification campaigns fail for a predictable reason: reviewers are shown a list of raw group memberships with no context and rubber-stamp everything to clear their queue. The fix is to present reviewers with risk-contextualized certifications — flagging accounts with no recent usage, accounts whose access exceeds their peer group’s norm, and accounts sitting on a known attack path to Tier 0 — so that the small fraction of entitlements that actually matter get real scrutiny instead of being buried in a five-hundred-line spreadsheet.
- Joiner-mover-leaver automation: entitlements provisioned and de-provisioned automatically from HR system-of-record events, not ticket queues, closing the average multi-week gap between termination and access removal.
- Privileged access certification: quarterly minimum for Tier 0 and Global Administrator-equivalent roles, with named business owner sign-off, not a blanket IT approval.
- Dormant and orphaned account sweeps: automated flagging of accounts with no interactive sign-in in 45+ days and no owning manager in HR data.
- Nested group depth limits: policy-enforced maximum nesting to keep effective privilege computable and auditable rather than opaque.
- Certificate template and PKI entitlement review: explicit inclusion of certificate enrollment rights in every governance cycle, since certificate-based escalations are routinely missed by reviewers unfamiliar with certificate services.
Detection engineering: worked examples analysts can operationalize this week
Catching Kerberoasting without drowning in false positives
A naive Kerberoasting detection alerting on every ticket-request event with a weak encryption type will generate thousands of false positives in any environment with legacy applications. A better approach baselines, per requesting account, the normal set of SPNs it requests tickets for and at what frequency, then alerts on a requesting account pulling tickets for an unusual number of distinct SPNs in a short window — the classic signature of an automated enumeration tool running a mass Kerberoasting sweep. Layer in a check for weak-cipher tickets requested for accounts that are known to support stronger encryption (indicating a downgrade attempt) and you get a high-precision signal with minimal tuning overhead.
Catching DCSync
DCSync detection depends entirely on having the SACL configured on the domain naming context to audit the replication-related extended rights, then alerting on any account performing this replication request that is not one of the domain controllers themselves or an explicitly allow-listed backup or replication service account. This is a near-zero-false-positive detection when configured correctly, and its absence is one of the most common gaps found in AD security assessments — many environments never enable this SACL at all, meaning DCSync is entirely invisible to them.
Catching Entra ID token replay and impossible travel
Token theft detection in Entra ID leans on cross-referencing the non-interactive sign-in log against device compliance state and IP reputation: a non-interactive token redemption from a device that has never been seen for that user, from an autonomous system number associated with a VPN exit node or hosting provider, immediately following an interactive sign-in from a completely different geography, is a strong token-theft signal even when the platform’s own risk score doesn’t fire. Combining this with continuous access evaluation, which allows Entra ID to revoke a token near-instantly on a critical event such as account disable or password reset rather than waiting for the token’s natural expiry, meaningfully shrinks the window in which a stolen token remains useful.
Honeytokens as a tripwire
One of the highest signal-to-noise detections available costs almost nothing to deploy: decoy privileged accounts and decoy SPNs that have no legitimate business purpose and therefore should never be touched. A honeytoken Domain Admin account that is never used for any real activity, monitored for any authentication attempt whatsoever, converts an attacker’s own reconnaissance — enumerating privileged group membership, which they must do to plan an escalation — into an immediate, unambiguous, high-confidence alert.
Incident response: when directory compromise is confirmed
The moment DCSync, a Golden Ticket, or a compromised Global Administrator account is confirmed, the response sequence is time-critical and unforgiving of hesitation, because the attacker’s persistence mechanisms are specifically designed to survive routine remediation. The krbtgt account password must be reset twice, with sufficient replication time between resets, because forged tickets are only invalidated once the krbtgt hash they were signed with has fully rotated out of use across every domain controller. Every credential the attacker could plausibly have touched — not just the ones with direct evidence of use — must be treated as compromised and rotated, because attackers routinely harvest far more credential material than they immediately use. Entra ID Global Administrator sessions must be revoked tenant-wide, and Conditional Access break-glass accounts must be verified as untouched and then themselves rotated as a precaution.
Parallel to credential rotation, the incident response team needs to answer the attack-path question that raw log review cannot answer alone: what could this compromised identity have reached, and did it actually traverse those paths? This is where an identity graph with historical snapshots becomes indispensable — reconstructing the exact effective privilege of the compromised account at the time of compromise, not its current (possibly already-remediated) privilege, so that the scope of the blast-radius assessment is accurate rather than optimistic. Algomox’s XDR detection and response capability is built to support exactly this workflow: agentic investigation playbooks that reconstruct the attack path graph, correlate it against the timeline of authentication events across both AD and Entra ID, and hand analysts a scoped, evidence-backed containment plan instead of a wall of raw logs to manually cross-reference.
Post-incident, the highest-value remediation is almost never "buy a new tool." It is closing the specific privilege escalation paths the attacker used — removing the unnecessary nested group membership, fixing the certificate-template misconfiguration, revoking the over-scoped OAuth application consent — and then re-running attack path analysis to confirm no equivalent path remains, because attackers who successfully exploited one path in an environment will very often find a structurally identical second path if only the first is patched.
Air-gapped, on-prem, and sovereign deployment considerations
A meaningful fraction of critical infrastructure, defense, and regulated financial environments run Active Directory with no Entra ID hybrid join at all, either by policy or by physical air-gap, and identity security architecture for these environments cannot simply assume cloud-delivered detection services are available. In these environments, the ITDR telemetry pipeline has to be self-hosted end to end: on-box event collection, an on-premises analytics engine, and locally maintained detection content that is updated through a controlled, auditable release process rather than a live cloud feed.
This is a deliberate design point for Algomox’s platform architecture: ITMox, CyberMox, and MoxDB are built to run fully on-premises or in air-gapped enclaves with no mandatory outbound dependency, so that a defense contractor or a sovereign government customer gets the same identity graph analytics, attack path detection, and behavioral baselining as a cloud-connected enterprise, just without the telemetry ever leaving the boundary. The tiering model, PAM architecture, and governance cadence described above apply identically in an air-gapped estate — the only material difference is that detection content updates, threat intelligence, and model retraining have to be delivered through a controlled import process rather than continuous cloud sync, which means the operational discipline of keeping that import process current becomes a security control in its own right.
ITDR
Protocol-level telemetry and per-identity baselining to catch credential misuse in real time.
PAM
Tiering, JIT/JEA, PAWs and LAPS to shrink standing privilege toward zero.
Governance
Joiner-mover-leaver automation, access certification, and SoD analysis to keep entitlements clean.
Analytics
A unified identity graph and risk scoring that ties detection to response across AD and Entra ID.
Metrics that separate real identity security from a compliance checkbox
Executive reporting on identity security tends to drift toward vanity metrics — "we deployed MFA to 98% of users" — that say nothing about actual risk reduction. A more honest metric set tracks structural exposure: the count of standing Tier 0 credentials outside a vault, the median time an entitlement remains unreviewed past its certification due date, the number of distinct attack paths from a standard user to Domain Admin as computed by graph analysis, and the mean time to detect and contain a confirmed identity compromise. These numbers move slowly and are uncomfortable to report, which is exactly why they are the ones worth tracking — they cannot be gamed by a policy update the way an MFA-enrollment percentage can.
A useful maturity framework treats identity security as progressing through four stages: reactive (password policy and periodic audits only, no real-time detection), instrumented (ITDR telemetry and PAM vaulting deployed but not correlated), integrated (AD and Entra ID telemetry unified into a single identity graph with automated response), and adaptive (the identity graph feeds continuous risk scoring that dynamically tightens Conditional Access and PAM approval requirements based on live threat context, not a static policy). Most enterprises Algomox assesses sit at instrumented — they have bought an identity threat sensor and a PAM vault, but the two systems don’t share a risk model, so a PAM approval workflow has no idea an account was flagged as anomalous by ITDR an hour earlier, and vice versa. Programs like continuous threat exposure management exist precisely to close that gap by treating identity misconfigurations and attack paths as a continuously re-scored exposure surface rather than an annual audit finding.
| Technique | Primary data source | Key detection signal | Primary mitigating control |
|---|---|---|---|
| Kerberoasting | Kerberos ticket request events | Abnormal SPN request breadth per account; weak-cipher downgrade | Long, random gMSA passwords; strong-cipher-only SPNs |
| AS-REP roasting | Kerberos AS request events | Pre-auth-disabled accounts requesting AS-REP | Disable "do not require Kerberos preauth" |
| DCSync | Directory object access events (replication SACL) | Replication rights invoked by non-DC principal | Restrict Replicating Directory Changes rights |
| Golden Ticket | Identity sensor / ticket anomalies | TGT with mismatched or stale krbtgt key version | Double krbtgt password rotation; ticket lifetime limits |
| Pass-the-hash | Logon events, NTLM audit | NTLM auth from account expected to use Kerberos only | LAPS, Authentication Silos, NTLM restriction |
| Certificate template abuse | CA audit logs, certificate issuance events | Enrollment by low-privilege principal on sensitive templates | Template ACL hardening; disable SAN specification |
| Consent phishing | Entra ID audit logs (app consent events) | New app registration granted broad Graph scopes | Admin consent workflow; restrict user consent |
| PRT / token theft | Non-interactive sign-in logs | Token redemption from new device/IP post interactive sign-in | Continuous access evaluation; device compliance CA policy |
A reference architecture for hybrid identity defense
Pulling the preceding sections together, a defensible reference architecture places a normalized identity graph at the center, ingesting Windows Security Event Log data, identity sensor telemetry, Entra ID sign-in and audit logs, PAM vault activity, and HR system-of-record data as the joiner-mover-leaver source of truth. That graph feeds three consuming functions: a real-time detection engine scoring behavioral deviation per identity, a governance engine driving certification campaigns and SoD analysis, and an attack-path engine continuously recomputing the shortest path from any standard identity to Tier 0 so that the highest-leverage remediation — the one nested group membership that collapses five different attack paths at once — is always visible and prioritized ahead of lower-impact fixes.
This is the architectural thesis behind how Algomox’s platform components fit together for identity security specifically: identity security and PAM capability within CyberMox handles the ITDR telemetry and privileged session vaulting, the identity and PAM solution layer operationalizes the tiering and JIT elevation workflows across hybrid AD/Entra ID estates, continuous threat exposure management keeps the attack-path graph current as part of a broader exposure management cycle rather than a point-in-time assessment, and Norra’s autonomous investigation agents execute the correlation and triage work — reconstructing attack paths, cross-referencing HR and directory data, and drafting containment recommendations — at a speed and consistency no purely human SOC team can sustain across a 24/7 rotation. None of this replaces the fundamentals covered above; it exists to make those fundamentals operationally sustainable at enterprise scale rather than dependent on a handful of senior analysts who happen to remember every attack path by heart.
Enterprises evaluating where to invest first should resist the temptation to buy detection tooling before the entitlement graph itself is clean. A best-in-class ITDR product layered on top of an AD forest with years of accumulated nested-group sprawl will generate an unmanageable number of true-positive alerts on legitimate-looking but genuinely excessive privilege, because the underlying access model was never disciplined in the first place. The sequencing that actually works in practice is: clean the Tier 0 boundary and eliminate standing privilege first, instrument detection second, then layer governance automation on top to keep the newly-cleaned graph from drifting back into sprawl. Skipping straight to advanced analytics on top of a messy foundation is the single most common reason identity security programs stall after an expensive tool purchase.
Key takeaways
- Active Directory and Entra ID must be defended as one interconnected trust fabric, not two separately managed consoles — Entra Connect synchronization means a compromise in one frequently cascades into the other.
- Non-human identities now outnumber human identities in most enterprises and are systematically under-governed; treat every service account, service principal, and AI agent identity as a first-class, owned, reviewed entity.
- ITDR detection precision depends on correctly configured SACLs (especially for DCSync), behavioral baselining per identity, and Entra ID continuous access evaluation — not just turning on a vendor product.
- The tiered administration model, Privileged Access Workstations, LAPS, and Authentication Silos are the structural foundation of PAM; just-in-time elevation via Entra ID PIM and vault checkout eliminates standing privilege that attackers otherwise target regardless of activity.
- Identity governance fails when access certifications are presented without risk context; contextualized, evidence-backed reviews catch the small percentage of entitlements that actually matter.
- Incident response after directory compromise requires a double krbtgt reset, full credential rotation, and attack-path reconstruction using historical identity graph snapshots — not just password resets on the accounts with obvious evidence of use.
- Air-gapped and sovereign environments need the same identity graph analytics as cloud-connected enterprises, delivered through a fully on-premises architecture with controlled, auditable detection content updates.
- Sequence investment correctly: clean the Tier 0 boundary and standing privilege first, instrument detection second, then automate governance to prevent the entitlement graph from drifting back into sprawl.
Frequently asked questions
Is a native Entra ID risk feed or an on-prem identity sensor sufficient on its own for identity threat detection?
Both are strong, purpose-built signal sources but neither alone gives you the cross-domain correlation that catches hybrid attack chains — for instance, an on-prem Kerberoasting event followed six hours later by an anomalous Entra ID sign-in using credentials harvested from that same account. You need a layer above both that normalizes AD and Entra ID telemetry into one identity graph and correlates across the boundary, which is the gap platforms like CyberMox are built to close.
How often should Tier 0 access be recertified, and who should own that review?
Quarterly at minimum, with a named business owner — not a blanket IT manager sign-off — accountable for every Domain Admin, Enterprise Admin, and Global Administrator-equivalent membership. Reviews should be risk-contextualized, surfacing dormant accounts, accounts with usage inconsistent with peer group norms, and accounts sitting on a known attack path, rather than a flat list reviewers rubber-stamp to clear a queue.
What is the single highest-impact first step for an enterprise that has done little formal identity security work?
Run an attack path analysis against the current AD and Entra ID entitlement graph to find the shortest paths from a standard user account to Domain Admin or Global Administrator, then close the handful of nested group memberships and stale permissions that collapse the most paths at once. This single exercise typically eliminates more real risk than any detection tool purchase, because it removes the escalation routes the tool would otherwise need to catch in progress.
How does non-human identity governance differ meaningfully from human identity governance?
Non-human identities have no interactive MFA step, are frequently over-provisioned at creation because a deadline pressure led to a broad grant, and lose their accountable owner the moment the original requester leaves the company. Effective governance requires explicit ownership assignment, migration to gMSA or certificate-based/federated workload identity credentials in place of static secrets, and inclusion in the same certification cadence as privileged human accounts rather than being silently excluded.
Bring identity security up to the level of the threat
Algomox's CyberMox and Norra combine ITDR, PAM, and identity governance on a single identity graph — deployable in cloud, on-premises, or fully air-gapped environments — so your directory stops being the weakest link in the stack.
Talk to us