PŻ.
    Ask the SI

    Identity attack paths in hybrid estates

    Attackers do not need a vulnerability if a chain of legitimate permissions gets them to Domain Admin. Path analysis finds those chains before they do.

    By Piotr Zenon Żabrowski · Published · Updated

    1Request

    • User or workload
    • Target application
    • Requested scope

    2Signals

    • Identity strength
    • Device compliance
    • Risk score
    • Location / network

    3Decision

    • Allow
    • Allow with step-up
    • Allow limited session
    • Block

    4Enforcement

    • Session controls
    • Just-in-time privilege
    • Continuous evaluation
    • Audit trail
    Where access decisions are made in a hybrid estate

    Recurring findings

    • Nested group membership granting effective admin to a helpdesk role nobody reviews.
    • Hybrid sync accounts with excessive cloud rights bridging on-prem compromise to the tenant.
    • Service accounts with unconstrained delegation and no password rotation.
    • Conditional Access exclusions applied to break-glass accounts that are then used routinely.
    • Owner permissions on app registrations allowing credential addition to privileged service principals.
    • Federation trust configurations that would let a compromised identity provider or ADFS server forge assertions for any user — the classic golden SAML path, still viable wherever federation trust is unmonitored.
    • Legacy per-user MFA or the old Entra ID Protection risk policies left active alongside newer Conditional Access policies, producing inconsistent enforcement until one path is fully retired.

    Remediation order

    1. 01Cut the shortest paths

      Remove the two or three edges that collapse the graph before doing anything structural.

    2. 02Tier the identities

      Separate privileged administration from daily-use accounts and devices, following the control-plane / management-plane / workload-plane split that superseded the old flat AD tier model.

    3. 03Make privilege temporary

      PIM-style elevation with approval and logging replaces standing rights.

    4. 04Re-run the graph

      Path analysis becomes a recurring control, not a one-off exercise.

    5. 05Retire the parallel policy paths

      Legacy authentication policy tracks (old per-user MFA, classic sign-in/user risk policies) get a hard retirement date rather than an indefinite parallel-run, because their existence is itself a bypass edge in the graph.

    Frequently asked questions

    Is BloodHound safe to run in production?

    Collection is read-only and well-understood, but coordinate with detection teams — the collector looks like reconnaissance because it is. AzureHound and similar Entra ID collectors are also what threat actors use for the same purpose, so an unannounced run will and should trigger an alert.

    Does this only cover Active Directory?

    On-premises AD tooling maps well to a single forest. Modern identity estates add Entra ID, and increasingly SaaS identity providers and AI agents with their own service identities, each contributing edges to the same graph. Path-analysis tooling has followed: current versions extend attack-path mapping to Entra ID objects and, more recently, to non-Microsoft identity providers and to AI agent identities — the underlying question does not change, only the number of edge types.

    Related

    Identity & Zero Trust

    Entra ID hardening, Conditional Access authentication strengths, privileged access management and identity attack-path analysis with BloodHound.

    BloodHound

    BloodHound for mapping privilege escalation paths across Active Directory, Entra ID and — via OpenGraph — cloud, SaaS and agentic identities.

    Microsoft Entra ID

    Entra ID hardening: Conditional Access design, PIM, phishing-resistant authentication, app registration governance and agent identity.

    Cloud security assessment

    Configuration and architecture assessment for Azure, GCP and Alibaba Cloud: identity, network, data, logging and CSPM findings with a fix roadmap.

    Conditional Access baseline

    An Entra ID Conditional Access baseline ordered by blast radius: which policies to ship first, how to stage them, the legacy-policy retirement dates that create silent gaps, and the exclusions that quietly undo them.

    Oh My Hack

    Recorded Oh My Hack 2024 talk (Polish): modelowanie zagrożeń w skali Allegro — od STRIDE do sukcesu.