--- id: CP-199 slug: active-directory-entra-id-identity lang: en title: Active Directory and Entra ID description: The company directory decides who is who and who can access what. What employees do, what the administrator does, and the pitfalls. canonical_url: https://startbrain.io/cyberpedia/en/articles/active-directory-entra-id-identity/ markdown_url: https://startbrain.io/cyberpedia/en/articles/active-directory-entra-id-identity.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "Active Directory and Entra ID", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/active-directory-entra-id-identity/ (CC BY 4.0) wing: 3 theme: control_access reflex: cr-062 schema: G3 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/active-directory-entra-id-identity/ fr: https://startbrain.io/cyberpedia/fr/articles/active-directory-entra-id-identites/ de: https://startbrain.io/cyberpedia/de/articles/active-directory-entra-id-identitaten/ es: https://startbrain.io/cyberpedia/es/articles/active-directory-entra-id-identidades/ sources: - "n": 1 title: Active Directory Domain Services overview publisher: Microsoft url: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/virtual-dc/active-directory-domain-services-overview accessed: "2026-11-03" - "n": 2 title: What is Microsoft Entra? publisher: Microsoft url: https://learn.microsoft.com/en-us/entra/fundamentals/what-is-entra accessed: "2026-11-03" - "n": 3 title: "Valid Accounts: Cloud Accounts, Sub-technique T1078.004 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1078/004/ accessed: "2026-11-03" - "n": 4 title: Multi-Factor Authentication Request Generation, Technique T1621 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1621/ accessed: "2026-11-03" - "n": 5 title: "How it works: Microsoft Entra multifactor authentication" publisher: Microsoft url: https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mfa-howitworks accessed: "2026-11-03" - "n": 6 title: What is Conditional Access? publisher: Microsoft url: https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview accessed: "2026-11-03" - "n": 7 title: "Valid Accounts: Domain Accounts, Sub-technique T1078.002 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1078/002/ accessed: "2026-11-03" - "n": 8 title: "Steal or Forge Kerberos Tickets: Kerberoasting, Sub-technique T1558.003 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1558/003/ accessed: "2026-11-03" - "n": 9 title: "OS Credential Dumping: DCSync, Sub-technique T1003.006 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1003/006/ accessed: "2026-11-03" - "n": 10 title: "SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management" publisher: NIST url: https://csrc.nist.gov/pubs/sp/800/63/b/4/final published: "2025-07-31" accessed: "2026-11-03" --- # Active Directory and Entra ID A company directory keeps the list of accounts and sets what each one can do. On site, this is often Active Directory Domain Services (AD DS), which stores information about user accounts: names, passwords, phone numbers [1]. In the cloud, it is Microsoft Entra ID, an identity and access management service that handles authentication, policy enforcement and the protection of users, devices, applications and resources [2]. For an employee, the directory stays invisible. It appears in two forms: the sign-in screen and the approval request on the phone. This article explains what the employee does at those two moments, what the directory administrator does, and where the pitfalls lie. ## In 30 seconds - Where it happens: at every sign-in, including to Microsoft 365, because every subscriber to Microsoft 365, Azure or Dynamics CRM Online already uses Entra ID [2]. - What the attacker wants: a valid account. MITRE ATT&CK describes accounts targeted by brute force, by phishing or by other means [3]. - The reflex: approve an approval request only if you have just signed in yourself, and report any request you did not trigger [4]. ## Straight answers ### What is a directory for? A directory is a hierarchical structure that stores information about objects on a network. A directory service such as AD DS makes this data available to users and administrators [1]. These objects include shared resources (servers, volumes, printers) and user and computer accounts [1]. Security is built in through authentication at sign-in and through access control on the directory's objects [1]. ### What is the difference between Active Directory and Entra ID? AD DS, part of Windows Server, is a directory service [1]. Entra ID is the cloud identity service of Microsoft, and every Microsoft 365 tenant is automatically an Entra tenant [2]. The two can coexist. A cloud account can be hybrid, meaning synchronized or federated with an on-premises directory such as Active Directory [3]. The same password then works in both worlds, which widens the damage from a theft [3]. ### Why is a password alone not enough? According to Microsoft, a password alone leaves an insecure attack vector: if it is weak or has been exposed elsewhere, an attacker can use it [5]. Multifactor authentication requires at least two items out of three: something you know (typically a password), something you have (a phone, a hardware key), something you are (a fingerprint, a face) [5]. The second factor is not easy for an attacker to obtain or duplicate [5]. The organization can also set context rules. Microsoft Entra Conditional Access policies are "if… then" statements: if a user wants to access an application such as Microsoft 365, they must go through multifactor authentication [6]. They can leave the normal sign-in alone on the company network or on a registered device, and require an extra factor when remote or on a personal device [5]. ### What should I do with an approval request I did not start? Refuse it and report it. MITRE ATT&CK describes the MFA request generation technique: an attacker who has a password but not the second factor triggers push notifications (Duo Push, Microsoft Authenticator, Okta or equivalent) so that the victim accepts [4]. The attacker can repeat the attempts to flood the user with notifications, text messages and calls until the user accepts, which the source calls "MFA fatigue" [4]. Among MITRE's measures: train users to accept only requests that come from sign-ins they started, to check the location of the attempt, and to report suspicious or unsolicited requests [4]. ### What can an attacker do with a stolen account? It depends on the account. Domain accounts are those managed by AD DS, and cover users, administrators and services [7]. Once compromised, they can be used for initial access, persistence, privilege escalation or defense evasion [7]. On the cloud side, a highly privileged account, whether federated, synchronized or cloud-only, can allow a pivot to the on-premises environment [3]. ### What is Kerberoasting? In this attack, an adversary who holds a valid Kerberos ticket requests service tickets for service principal names (SPNs) from a domain controller [8]. Some of these tickets may be encrypted with the RC4 algorithm. The service account's hash then serves as the key, and it becomes vulnerable to an offline brute-force attack, which can reveal plaintext credentials [8]. Cracked hashes can give access to valid accounts, with persistence, privilege escalation and lateral movement [8]. The employee has nothing to do with it: defense falls to those who manage service accounts. ## How it works The AD DS directory includes a schema, which defines object classes and their attributes, a global catalog, a query mechanism and a replication service [1]. All domain controllers in a domain take part in replication and hold a complete copy of their domain's information: a change made on one is replicated to all [1]. Entra ID is the base product of the Microsoft Entra family [2]. This family also includes Entra ID Governance, which automates access requests, assignments and reviews, and can remove the rights of an employee who leaves the company [2]. Entra ID Protection detects and flags identity risks [2]. For older applications that cannot use modern authentication, Entra Domain Services offers managed services such as group policy, LDAP and Kerberos/NTLM authentication [2]. Conditional Access decides from signals: user or group, IP location, device, application, detected risk [6]. Its decisions range from blocking to granting access under conditions: multifactor authentication, a compliant device, a password change [6]. These policies apply after authentication with the first factor [6]. Security defaults quickly enable Microsoft Authenticator for all users of a tenant [5]. ## What you do - Turn on multifactor authentication when it is offered to you. The available methods include Microsoft Authenticator, Windows Hello for Business, passkeys (FIDO2), a hardware token, text message and voice call [5]. Methods are managed in My Profile [5]. - Approve only the requests you triggered. If a request arrives when you have attempted nothing, refuse it and report it to the IT team [4]. - Choose a unique, complex password for each service: MITRE recommends complex and unique passwords for cloud accounts [3]. - Do not reuse your work password elsewhere. MITRE's page on domain accounts lists password reuse among the ways accounts get compromised [7]. What the directory administrator does: - Limit service accounts to the minimum rights needed, including membership in privileged groups such as Domain Administrators [8]. - Require long passwords for service accounts (ideally 25 characters or more), renew them, and consider group managed service accounts or a password vault [8]. - Limit the use of privileged accounts according to administrative tiers, and do not place user or domain administrator accounts in local administrator groups without strict control [9]. - Regularly review the permissions of privileged cloud accounts, such as Global Administrator and Privileged Role Administrator, check that no unauthorized privileged account has been created, and consider temporary (just-in-time) privileged access rather than permanent assignment [3]. - Review inactive or unnecessary accounts and delete them [3]. - Disable legacy authentication, which does not handle multifactor authentication [3]. ## Pitfalls Too many administrator accounts. Privileged accounts are targets. DCSync, for example, makes it possible to pull password data from Active Directory by simulating the replication of a domain controller [9]. Members of the Administrators, Domain Admins and Enterprise Admins groups, or the controller's machine accounts, can run it [9]. The hashes obtained, including that of the KRBTGT account, are then used to forge a Golden Ticket or to change a password [9]. The missing second factor. MITRE reports that Storm-0501 used a victim's Global Administrator account with no MFA method registered to access its cloud environments [3]. The same group exploited compromised accounts to reach Microsoft Entra Connect, which synchronizes on-premises identities and Entra, so that users sign in to both with the same password [3]. Push notification fatigue is a documented way of bypassing multifactor authentication [4]. MITRE advises replacing simple push with entering a one-time code shown on the sign-in screen, and limiting the number of requests sent over a period [4]. Forgotten service accounts. These are what Kerberoasting targets, including with tools such as Rubeus, or the Invoke-Kerberoast command from PowerSploit [8]. MITRE recommends preferring AES encryption to RC4 when possible [8]. The reference framework. NIST published the final version of SP 800-63B-4, on authentication and authenticator management, on July 31, 2025 [10]. The text covers the authentication of people who interact with US government information systems and defines technical requirements for each of its three assurance levels [10]. It replaces the March 2020 version of SP 800-63B [10]. ## Real cases ### 2025: wiper attacks in Poland MITRE ATT&CK notes, for the "2025 Poland Wiper Attacks", two uses of credentials in the same episode. The attackers used privileged accounts to access the FortiGate VPN solution and the subnets behind it [7]. They also exploited credentials stolen from on-premises environments to access cloud services [3]. ## Sources 1. Microsoft, "Active Directory Domain Services overview". https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/virtual-dc/active-directory-domain-services-overview (accessed 3 November 2026) 2. Microsoft, "What is Microsoft Entra?". https://learn.microsoft.com/en-us/entra/fundamentals/what-is-entra (accessed 3 November 2026) 3. MITRE ATT&CK, "Valid Accounts: Cloud Accounts, Sub-technique T1078.004 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1078/004/ (accessed 3 November 2026) 4. MITRE ATT&CK, "Multi-Factor Authentication Request Generation, Technique T1621 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1621/ (accessed 3 November 2026) 5. Microsoft, "How it works: Microsoft Entra multifactor authentication". https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mfa-howitworks (accessed 3 November 2026) 6. Microsoft, "What is Conditional Access?". https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview (accessed 3 November 2026) 7. MITRE ATT&CK, "Valid Accounts: Domain Accounts, Sub-technique T1078.002 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1078/002/ (accessed 3 November 2026) 8. MITRE ATT&CK, "Steal or Forge Kerberos Tickets: Kerberoasting, Sub-technique T1558.003 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1558/003/ (accessed 3 November 2026) 9. MITRE ATT&CK, "OS Credential Dumping: DCSync, Sub-technique T1003.006 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1003/006/ (accessed 3 November 2026) 10. NIST, "SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management", 31 July 2025. https://csrc.nist.gov/pubs/sp/800/63/b/4/final (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/active-directory-entra-id-identity/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.