Cyberpediaby Brain
ENDEFR

Active Directory and Entra ID

The company directory decides who is who and who can access what. What employees do, what the administrator does, and the pitfalls.

In 30 seconds

Where it happens
At every sign-in, including to Microsoft 365, because every subscriber to Microsoft 365, Azure or Dynamics CRM Online already uses Entra ID2.
What the attacker wants
A valid account. MITRE ATT&CK describes accounts targeted by brute force, by phishing or by other means3.
The reflex
Approve an approval request only if you have just signed in yourself, and report any request you did not trigger4.

What it is

A company directory keeps the list of accounts and sets what each one can do. On site, this is often Active Directory Domain Services (AD DS), which stores information about user accounts: names, passwords, phone numbers1. In the cloud, it is Microsoft Entra ID, an identity and access management service that handles authentication, policy enforcement and the protection of users, devices, applications and resources2.

For an employee, the directory stays invisible. It appears in two forms: the sign-in screen and the approval request on the phone. This article explains what the employee does at those two moments, what the directory administrator does, and where the pitfalls lie.

Straight answers

What is a directory for?

A directory is a hierarchical structure that stores information about objects on a network. A directory service such as AD DS makes this data available to users and administrators1. These objects include shared resources (servers, volumes, printers) and user and computer accounts1. Security is built in through authentication at sign-in and through access control on the directory's objects1.

What is the difference between Active Directory and Entra ID?

AD DS, part of Windows Server, is a directory service1. Entra ID is the cloud identity service of Microsoft, and every Microsoft 365 tenant is automatically an Entra tenant2. The two can coexist. A cloud account can be hybrid, meaning synchronized or federated with an on-premises directory such as Active Directory3. The same password then works in both worlds, which widens the damage from a theft3.

Why is a password alone not enough?

According to Microsoft, a password alone leaves an insecure attack vector: if it is weak or has been exposed elsewhere, an attacker can use it5. Multifactor authentication requires at least two items out of three: something you know (typically a password), something you have (a phone, a hardware key), something you are (a fingerprint, a face)5. The second factor is not easy for an attacker to obtain or duplicate5.

The organization can also set context rules. Microsoft Entra Conditional Access policies are "if… then" statements: if a user wants to access an application such as Microsoft 365, they must go through multifactor authentication6. They can leave the normal sign-in alone on the company network or on a registered device, and require an extra factor when remote or on a personal device5.

What should I do with an approval request I did not start?

Refuse it and report it. MITRE ATT&CK describes the MFA request generation technique: an attacker who has a password but not the second factor triggers push notifications (Duo Push, Microsoft Authenticator, Okta or equivalent) so that the victim accepts4. The attacker can repeat the attempts to flood the user with notifications, text messages and calls until the user accepts, which the source calls "MFA fatigue"4. Among MITRE's measures: train users to accept only requests that come from sign-ins they started, to check the location of the attempt, and to report suspicious or unsolicited requests4.

What can an attacker do with a stolen account?

It depends on the account. Domain accounts are those managed by AD DS, and cover users, administrators and services7. Once compromised, they can be used for initial access, persistence, privilege escalation or defense evasion7. On the cloud side, a highly privileged account, whether federated, synchronized or cloud-only, can allow a pivot to the on-premises environment3.

What is Kerberoasting?

In this attack, an adversary who holds a valid Kerberos ticket requests service tickets for service principal names (SPNs) from a domain controller8. Some of these tickets may be encrypted with the RC4 algorithm. The service account's hash then serves as the key, and it becomes vulnerable to an offline brute-force attack, which can reveal plaintext credentials8. Cracked hashes can give access to valid accounts, with persistence, privilege escalation and lateral movement8. The employee has nothing to do with it: defense falls to those who manage service accounts.

1How it works1 min

The AD DS directory includes a schema, which defines object classes and their attributes, a global catalog, a query mechanism and a replication service1. All domain controllers in a domain take part in replication and hold a complete copy of their domain's information: a change made on one is replicated to all1.

Entra ID is the base product of the Microsoft Entra family2. This family also includes Entra ID Governance, which automates access requests, assignments and reviews, and can remove the rights of an employee who leaves the company2. Entra ID Protection detects and flags identity risks2. For older applications that cannot use modern authentication, Entra Domain Services offers managed services such as group policy, LDAP and Kerberos/NTLM authentication2.

Conditional Access decides from signals: user or group, IP location, device, application, detected risk6. Its decisions range from blocking to granting access under conditions: multifactor authentication, a compliant device, a password change6. These policies apply after authentication with the first factor6. Security defaults quickly enable Microsoft Authenticator for all users of a tenant5.

2What you do2 min
  • Turn on multifactor authentication when it is offered to you. The available methods include Microsoft Authenticator, Windows Hello for Business, passkeys (FIDO2), a hardware token, text message and voice call5. Methods are managed in My Profile5.
  • Approve only the requests you triggered. If a request arrives when you have attempted nothing, refuse it and report it to the IT team4.
  • Choose a unique, complex password for each service: MITRE recommends complex and unique passwords for cloud accounts3.
  • Do not reuse your work password elsewhere. MITRE's page on domain accounts lists password reuse among the ways accounts get compromised7.

What the directory administrator does:

  • Limit service accounts to the minimum rights needed, including membership in privileged groups such as Domain Administrators8.
  • Require long passwords for service accounts (ideally 25 characters or more), renew them, and consider group managed service accounts or a password vault8.
  • Limit the use of privileged accounts according to administrative tiers, and do not place user or domain administrator accounts in local administrator groups without strict control9.
  • Regularly review the permissions of privileged cloud accounts, such as Global Administrator and Privileged Role Administrator, check that no unauthorized privileged account has been created, and consider temporary (just-in-time) privileged access rather than permanent assignment3.
  • Review inactive or unnecessary accounts and delete them3.
  • Disable legacy authentication, which does not handle multifactor authentication3.
3Pitfalls2 min

Too many administrator accounts. Privileged accounts are targets. DCSync, for example, makes it possible to pull password data from Active Directory by simulating the replication of a domain controller9. Members of the Administrators, Domain Admins and Enterprise Admins groups, or the controller's machine accounts, can run it9. The hashes obtained, including that of the KRBTGT account, are then used to forge a Golden Ticket or to change a password9.

The missing second factor. MITRE reports that Storm-0501 used a victim's Global Administrator account with no MFA method registered to access its cloud environments3. The same group exploited compromised accounts to reach Microsoft Entra Connect, which synchronizes on-premises identities and Entra, so that users sign in to both with the same password3.

Push notification fatigue is a documented way of bypassing multifactor authentication4. MITRE advises replacing simple push with entering a one-time code shown on the sign-in screen, and limiting the number of requests sent over a period4.

Forgotten service accounts. These are what Kerberoasting targets, including with tools such as Rubeus, or the Invoke-Kerberoast command from PowerSploit8. MITRE recommends preferring AES encryption to RC4 when possible8.

The reference framework. NIST published the final version of SP 800-63B-4, on authentication and authenticator management, on July 31, 202510. The text covers the authentication of people who interact with US government information systems and defines technical requirements for each of its three assurance levels10. It replaces the March 2020 version of SP 800-63B10.

4Real cases1 min

2025: wiper attacks in Poland

MITRE ATT&CK notes, for the "2025 Poland Wiper Attacks", two uses of credentials in the same episode. The attackers used privileged accounts to access the FortiGate VPN solution and the subnets behind it7. They also exploited credentials stolen from on-premises environments to access cloud services3.

Fact sheet

Identifier
CP-199
Wing
3. Protocols and defence
Brain skill
Controlling Access (control_access)
Brain reflex
cr-062
Diagram
G3 · System & Protocol Anatomy
Languages
de, en, fr
Sources
10 sources checked on 3 November 2026
Sources10 sources
  1. Microsoft, “Active Directory Domain Services overview”. https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/virtual-dc/active-directory-domain-services-overview (accessed 3 November 2026)
  2. Microsoft, “What is Microsoft Entra?”. https://learn.microsoft.com/en-us/entra/fundamentals/what-is-entra (accessed 3 November 2026)
  3. MITRE ATT&CK, “Valid Accounts: Cloud Accounts, Sub-technique T1078.004 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1078/004/ (accessed 3 November 2026)
  4. MITRE ATT&CK, “Multi-Factor Authentication Request Generation, Technique T1621 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1621/ (accessed 3 November 2026)
  5. Microsoft, “How it works: Microsoft Entra multifactor authentication”. https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mfa-howitworks (accessed 3 November 2026)
  6. Microsoft, “What is Conditional Access?”. https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview (accessed 3 November 2026)
  7. MITRE ATT&CK, “Valid Accounts: Domain Accounts, Sub-technique T1078.002 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1078/002/ (accessed 3 November 2026)
  8. MITRE ATT&CK, “Steal or Forge Kerberos Tickets: Kerberoasting, Sub-technique T1558.003 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1558/003/ (accessed 3 November 2026)
  9. MITRE ATT&CK, “OS Credential Dumping: DCSync, Sub-technique T1003.006 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1003/006/ (accessed 3 November 2026)
  10. NIST, “SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management”, 31 July 2025. https://csrc.nist.gov/pubs/sp/800/63/b/4/final (accessed 3 November 2026)

Cite this article

Brain, “Active Directory and Entra ID”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/active-directory-entra-id-identity/

BibTeX 
@misc{brain_cp199_en_2026,
  author = {Brain},
  title = {Active Directory and Entra ID},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/active-directory-entra-id-identity/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence