Lab · 15 / 16
One foot in Active Directory.
Almost no company starts from zero. Active Directory still runs file shares, servers and old apps, while new apps live in the cloud. This is how the two worlds are joined, and where attackers look for the seams.
Scenario 1 of 7
Two worlds, one identity
In plain words The same person has one account that works both in the office building and in the cloud.
Active Directory remains the authority for on-premises resources. A cloud IdP handles modern sign-in and SaaS. Sync, federation and proxies keep one identity across both.
Scenario 2 of 7
Syncing identities to the cloud
In plain words A copy of the phone book is sent to the cloud, so you can use the same password there.
A sync agent copies users and groups from AD. With password hash sync the cloud checks a hash of the hash, and keeps working if on-premises is down. With pass-through authentication the cloud asks an agent in AD to check each password.
Scenario 3 of 7
Federation with AD FS
In plain words The cloud sends you back to the office to show your badge there. It works, but it adds a fragile door.
With federation the cloud IdP trusts AD FS to authenticate users. It gives full on-premises control but adds servers to patch and a token-signing key that, if stolen, lets attackers forge any sign-in. Many companies are moving to cloud authentication.
Scenario 4 of 7
Conditional access
In plain words The guard at the door also looks at where you come from and which device you carry.
Each sign-in is evaluated with signals: device compliance from MDM, location, user and sign-in risk, the app being opened. The outcome is allow, require MFA or a compliant device, or block.
Scenario 5 of 7
Legacy apps without a VPN
In plain words An old app that only knows the office badge gets a modern entrance in front of it.
An app proxy publishes the internal app. The user signs in to the cloud IdP with MFA first, then a connector inside the network, which only opens outbound connections, talks to the app with Kerberos constrained delegation. No inbound firewall ports.
Scenario 6 of 7
Partners with their own accounts
In plain words The consultant signs in with the badge from their own company, and you decide what they can open.
B2B collaboration invites guests who authenticate at their home IdP. You keep control of their access, apply your conditional access, and review guests periodically, because nobody else will remove them.
Scenario 7 of 7
Protect the seams: tier 0
In plain words Whoever controls the machines that copy the phone book controls everyone. Guard them like the safe.
Domain controllers, sync servers and AD FS are tier 0: manage them only from dedicated admin workstations, with separate admin accounts. Keep cloud-only break-glass accounts, and do not sync on-premises admin accounts to the cloud.