Active Directory vs Entra ID security assessment

Which Active Directory vs Entra ID security assessment fits your tenant

Start with an on-premises Active Directory assessment if your domain controllers still hold the keys to your estate. An AD review is the right first step when identity is mostly on-premises, when Entra Connect or Entra Cloud Sync pushes accounts and credentials to the cloud, or when your privileged groups, delegated OUs and service accounts were built over many years. It checks whether Tier 0 is truly contained: domain controllers, the control plane, and the accounts and groups that can reach them. Microsoft's enterprise access model asks for a hierarchy that stops control of higher planes from lower ones, so an AD review tests exactly that boundary. Its limit is scope. It does not show what a cloud-only administrator can do in Entra ID, so it should not be treated as a finding that the cloud side is covered.

Start with an Entra ID review if your identity is cloud-first, or if most of your privileged roles, conditional access policies and app consents live in the tenant. The review should cover role assignments, privileged role eligibility, conditional access, application registrations and service principals with high-impact permissions, and the audit and sign-in logs that show how those controls are used. Confirm which Entra Connect or sync path your tenant uses before you scope the work. If you still run Azure AD Connect V1, which Microsoft retired on 31 August 2022, treat that as a finding in its own right and plan the migration first, because Microsoft warns that V1 installations may stop working unexpectedly.

A hybrid tenant needs both reviews run together and their findings reconciled. An on-premises account that is synchronized to Entra ID can inherit cloud privileges, and a cloud admin can often change configuration that flows back down through the sync path. Password hash synchronization, pass-through authentication and AD FS each create a different trust relationship, so the assessor should map which one you use and who can alter it. The two reviews are complementary, not substitutes: an AD review cannot clear the cloud, and an Entra review cannot clear domain controllers. Ask your provider to confirm in writing how the findings from each side will be correlated into a single privilege path analysis.

Active Directory and Entra ID assessments compared factor by factor

This table compares an on-premises Active Directory assessment (approach A) with a Microsoft Entra ID assessment (approach B) across scope, access, method, findings, deliverables, data dependencies and effort. Read each row as a question to put to a provider, and treat hybrid tenants as needing both columns reviewed together.

Factor	Approach A: On-premises Active Directory	Approach B: Microsoft Entra ID
Primary goal	Find weak tier boundaries, delegation and privileged paths inside the domain forest	Find weak conditional access, role assignments, app consents and sync trust in the cloud tenant
Scope boundary	Domains, domain controllers, admin workstations, AD CS and trusts within agreed scope	Tenant, directories, enterprise apps, service principals and any Entra Connect or Cloud Sync servers in scope
Access the assessor needs	Standard domain user for escalation tests, plus read-only directory and GPO access for review	Read-only directory and audit access for review, plus test accounts for authenticated checks. Confirm exact roles with the tenant owner
Method at buyer level	Configuration review of tiers and delegation, then authenticated tests from a standard user toward higher privilege	Configuration review of identity settings, then authenticated checks of roles, consents and conditional access. Confirm whether tests are permitted on the tenant
Typical findings	Excess privileged group membership, weak delegation, admin logons on lower-tier systems, escalation paths to domain admin	Standing privileged roles, missing or bypassable conditional access, risky app permissions, sync accounts with broad rights
Deliverables to request	Tier map, attack path evidence, prioritized remediation and a retest plan agreed in writing	Role and consent inventory, policy gap analysis, sync path diagram and a retest plan agreed in writing
Licensing or data dependencies	Domain controller access and logs. Licensing depends on the tools used, so confirm what is needed	Tenant license tier determines which audit and sign-in logs are available. Confirm the tier before scoping
Hybrid dependency	Shows how on-premises accounts reach the cloud through sync and federation paths	Shows which cloud identities can alter on-premises objects through the sync path. Review with the AD side
Effort drivers	Forest and domain count, number of tier boundaries, size of delegation model, and how many paths the team must validate	Number of tenants, enterprise apps, role assignments and conditional access policies, plus the sync design in use

How the tier model and control plane shape both assessments

Microsoft's enterprise access model extends the Active Directory tier model, and that model is the frame a reviewer should use for both an on-premises AD assessment and an Entra ID assessment. Tier 0 expands to cover the control plane: domain controllers, the AD services that issue trust, and the identity systems that hold domain-wide authority. Tier 1 splits into the management plane (administrative tooling and servers) and the data and workload plane (applications and their data). Tier 2 splits into user access and app access. The defining rule is a hierarchy that stops a lower plane from controlling a higher one, so a helpdesk account or a workstation admin should have no path to Tier 0 objects.

A reviewer checks that hierarchy by mapping every privileged group, delegated permission, GPO link, service account and management tool to a tier, then looking for paths that cross upward. In AD, that means tracing group nesting, ACLs on the domain root and AdminSDHolder, and where Tier 0 accounts log on. In Entra ID, the equivalent questions cover role assignments that reach the tenant, administrative units, service principals with directory permissions, and the Entra Connect or Cloud Sync sync account, which sits on the boundary between the two directories. Microsoft also asks for continuous auditing of configuration that could cause inadvertent privilege escalation, which is a standing control, not a single finding.

Each approach confirms different parts of this. A configuration review can show, at one point in time, that the tier mapping exists and that the recorded paths and role assignments respect it, which is the evidence most auditors ask for. It cannot prove that no unrecorded path exists through a forgotten delegation or an old trust. A penetration test that starts as a standard user can show whether a real escalation chain reaches Tier 0, but a clean run only covers the paths the tester found and the time allowed. Ask the assessor to state which tier boundaries were checked by configuration, which were checked by attack, and which were out of reach, and confirm the tier model against Microsoft's current guidance before scoping.

What each assessment finds and what it misses

A configuration review of Active Directory and Entra ID finds different weaknesses, and each one leaves gaps the other can close. The cards below set out what each review surfaces, the sync path between them, and what neither review proves on its own.

Active Directory delegation and privileged paths

A review of on-premises AD looks for delegated rights on high-value objects, nested membership in privileged groups, and ACL paths that let a lower-tier account reach Tier 0. NIST SP 800-115 notes that internal testers are often given access as general users and try to escalate, for example from system administrator to domain administrator. A review shows which paths exist on paper. Confirm whether any path is reachable from a standard account, and whether it is monitored.

Entra ID role assignments and conditional access

A cloud-side review examines who holds directory roles, whether privileged roles are permanent or eligible, and whether conditional access policies cover administrators, legacy authentication and risky sign-ins. These settings can be correct in the portal and still leave a gap, such as an exclusion group that bypasses a policy. Ask for the effective policy for each privileged account, not only the list of policies.

Synchronization path findings

Entra Connect, pass-through authentication, federation with AD FS and Entra Cloud Sync each create a path from on-premises identity into the cloud. A review should record which method is in use, which accounts and attributes sync, and which servers hold sync credentials. Microsoft states that Azure AD Connect V1 was retired on 31 August 2022 and may stop working unexpectedly, so confirm the installed version on every sync host.

Blind spots of a configuration review alone

A configuration review shows the settings and the paths they permit, but it does not prove that an attacker can use them. It will not show whether a detection fires, whether a chained path works under live conditions, or whether a sync server can be reached from a workstation. Pair the review with a scoped penetration test that starts from a standard user, and ask the tester to report which paths were exploited and which were only observed.

Why a retired Azure AD Connect V1 install belongs in scope

A retired Azure AD Connect V1 installation belongs in scope because it is a sync host that Microsoft no longer supports, and the assessment should treat it as a finding in its own right. Azure AD Connect V1 was retired on 31 August 2022, and Microsoft warns that V1 installations may stop working unexpectedly. An unsupported server that still writes identity data between on-premises Active Directory and Microsoft Entra ID is a reliability risk, and it is also a security risk because it may not receive the fixes a supported component would. Ask the client to confirm in writing which sync engine is running on each server that holds the Microsoft Entra Connect role, rather than relying on the server inventory.

Start by identifying the sync server and checking its version against Microsoft's current documentation, which you should confirm on Microsoft Learn before the engagement begins. Then review the service account the sync engine runs under, the directory permissions that account holds on the on-premises domain, and the synchronization rules and connector configuration. A sync account with replication or domain-level write rights is a path to the same control plane the tier model protects, so it should be assessed as a Tier 0 asset. Record who administers the sync host, whether it sits in a Tier 0 management boundary, and whether its logs reach a monitored store.

A legacy sync host is a high-value target because compromising it can expose both directories at once. An attacker who controls the server may extract credentials or sync-related secrets, alter what flows into the cloud tenant, or use the sync account to reach privileged on-premises objects. Treat the migration path as an open decision: confirm with the client and with Microsoft Learn whether the environment should move to the supported successor, and whether a migration changes password hash synchronization, pass-through authentication or federation settings. Put the migration plan into the remediation roadmap with an owner and a date agreed in the written scope.

Which assessment to start with, by environment

When every identity, group and trust lives in on-premises Active Directory, the starting point is a configuration-led review of the tier model. The reviewer checks who holds Tier 0 rights, how the control plane is isolated, and which delegations and nested group paths lead to domain administrator. Microsoft's enterprise access model expects a hierarchy that stops lower planes from controlling higher ones, so the review tests that boundary directly.

Read access to directory objects: a domain user account with broad read rights is usually enough for the configuration review, plus documented access to domain controller and administrative tier systems.
Privileged group membership: an export of Tier 0 groups and their nested members, so the reviewer can trace escalation paths.
Delegation and GPO data: delegated permissions, ACL exports and Group Policy objects that affect administrative systems.
Logging context: domain controller security event settings, so findings can be checked against what is recorded.
Internal test scope: the follow-on internal penetration test starts from a standard user account, and NIST SP 800-115 notes that testers often attempt escalation from system administrator to domain administrator, so that scope should be agreed in writing.

Confirm with your own team which accounts are in scope and whether any tier boundary is enforced by policy or only by convention.

What drives the cost and effort of each assessment

An Active Directory and Entra ID assessment is priced by how much identity estate it must cover and how much access the tester is granted. The cards below cover the scope drivers, the access model, and the internal time that is easy to overlook in a quote.

Forest, domain and tenant count

Each forest, domain and Entra ID tenant is a separate body of configuration to collect, analyze and report on. A hybrid estate with several forests or a tenant per business unit multiplies the collection and review work, even when the findings repeat. Ask the provider to state the number of forests, domains and tenants in scope and whether each is priced separately. Scope size is the largest single driver of effort.

Sync topology and federation

Assessing the path between on-premises AD and Entra ID takes more time when the estate uses password hash synchronization, pass-through authentication or AD FS federation, or a mix of them. The sync engine itself must be checked, including whether it still runs the retired Azure AD Connect V1 or has moved to Entra Cloud Sync. Ask whether the quote covers the sync server, its service account and the federation trust, or only the directories.

Privileged role and tier count

The number of privileged groups, Entra roles and delegated administrative paths determines how many control-plane and management-plane relationships the reviewer must trace. Mapping against the tier model is a one-time build, while reviewing new delegations is recurring. Ask the provider how it will count privileged roles, how it treats custom roles, and whether the quote includes a re-check after administrative changes.

Access granted to the tester

A read-only configuration review needs a reader account and collection tooling. Escalation testing, where the tester starts as a standard user and tries to reach domain administrator rights, needs authorized credentials, a rules of engagement document and more senior tester time. NIST SP 800-115 describes this internal escalation pattern. Ask whether the quote is for read-only review, escalation testing or both, and what credentials the client will provide.

Internal staff time for evidence and fixes

Client staff must export logs, confirm group membership, approve test windows and review remediation plans. These tasks are often missing from the provider's quote but still consume the client's identity team. Remediation of tiering findings usually recurs as administrative models change. Ask the provider which evidence it expects from your team, how many review rounds the quote includes, and whether a retest after fixes is one-time or ongoing.

How to run a combined AD and Entra ID review

This sequence turns a hybrid tenant into one reviewed system, so that on-premises and cloud findings about the same privileged accounts are traced end to end and retested after fixes.

Agree rules of engagement first
The client and the assessment team agree written rules of engagement before any testing starts, using the rules of engagement template in Appendix B of NIST SP 800-115 as the starting structure. The document names in-scope forests, tenants, subscriptions and sync servers, the permitted test types, the accounts the testers may use, the time windows, the escalation contacts and the conditions that stop testing. Testing does not begin until the client has signed the document and named a contact who can halt the work.
Inventory tiers and synchronization paths
Map every Active Directory tier, including the control plane, management plane and data and workload plane described in Microsoft's enterprise access model, and every Entra ID role that sits above them. Record each sync path: password hash synchronization, pass-through authentication, federation with AD FS, or Entra Cloud Sync, and confirm which tool performs each one. Flag any Azure AD Connect V1 installation, since that version was retired on 31 August 2022. The inventory is complete when the team can draw one diagram that links each privileged on-premises identity to its cloud counterpart.
Run the configuration review
Review delegation, group membership, privileged role assignments, sync service accounts, conditional access policies and admin consent settings on both sides, reading configuration rather than exploiting it. The reviewer checks whether lower tiers can control higher ones and whether any configuration could cause inadvertent privilege escalation, which is the continuous auditing concern in Microsoft's model. The step closes with a list of configuration findings, each tagged with the tier, the system and the evidence that supports it.
Validate escalation paths in a controlled way
Testers attempt privilege escalation from a standard user account, following the pattern NIST SP 800-115 describes, such as moving from system administrator to domain administrator rights. Each path is tested in the agreed scope, stops at proof of access where the rules of engagement require it, and uses non-destructive methods on production identities. Sync accounts and cloud admin roles are tested only as far as the rules allow. The step is done when every path from the configuration review is marked as confirmed, not reproducible, or out of scope, with the steps that proved it recorded.
Retest after remediation
After the client fixes the confirmed findings, the same team repeats the configuration checks and the specific escalation paths against the changed environment. Retesting confirms that a fix closed the path and did not create a new one, such as a replacement group with the same rights. The output is a retest record per finding, showing the original evidence, the change made and the result. Findings stay open until the retest record exists.
Feed results into monitoring
Each validated technique is passed to the security monitoring team so that detections exist for the paths the testers used, which reflects the intent of CIS Safeguard 18.4 on validating security measures after each test. The monitoring team confirms which sign-in, directory change and privilege assignment events are logged for both on-premises and Entra ID, and whether alerts fire. The step closes when the monitoring team can show, for each tested path, the alert or log entry that would have recorded it, or a documented gap with an owner.

Questions buyers ask before commissioning an AD or Entra ID assessment

How much does an Active Directory or Entra ID assessment cost?

The price depends on the written scope, and DeployOpen does not publish a price list, so a quote follows from the agreed scope. The main cost drivers are the number of domains, forests and tenants in scope, whether Entra ID is reviewed alongside on-premises Active Directory, how many synchronization paths and federation components exist, and whether the work includes only a configuration review or also an attack path test that tries to escalate from a standard user. Ask the provider to separate one-time assessment work from any recurring retainer for re-testing or continuous review, and to state which systems, accounts and access levels the quote assumes. Compare quotes on the same scope definition, not on the headline number.

How long does an AD or Entra ID assessment take?

Duration depends on scope, and no fixed timeline applies to every environment. The main variables are the size and age of the directory, the number of domains and tenants, how many hybrid components must be reviewed, how quickly the team can provide access and documentation, and whether a retest is included. Most engagements are fixed-scope, so the written agreement should state the phases, deliverables and dates before work starts. Ask the provider to show which activities depend on your change windows or on staff availability, since those are the most common causes of delay.

What access and staff time does an AD assessment require?

Assessors usually need read-level visibility into directory configuration, group structures, delegation settings, Group Policy and, for hybrid environments, the synchronization and federation configuration. An attack path test may also need a standard domain user account and, in some scopes, a workstation on the internal network. Confirm with the provider which accounts, credentials and network segments are required, how credentials are handled and removed afterwards, and which tests touch production domain controllers. On your side, expect time from directory administrators, the team that owns Entra Connect or federation services, and someone who can approve the rules of engagement.

Can our internal team run an AD or Entra ID assessment itself?

An internal team can run configuration checks and review privileged group membership, but an independent assessment carries value that self-review does not always provide, particularly for attack path analysis and for proof that the findings were tested. Most organizations weigh staff skills, the separation of duties between the people who administer the directory and the people who assess it, and the time available during the period of testing. NIST SP 800-115 notes that organizations often combine techniques to reach an in-depth assessment at an acceptable level of risk, which is a useful test for whether internal work alone meets your need. Ask any provider to document the method and tooling so your team can repeat the checks later.

Does a hybrid tenant need both an AD and an Entra ID review?

Yes, in most hybrid environments both should be reviewed together. Synchronization from on-premises Active Directory to Microsoft Entra ID, using password hash synchronization, pass-through authentication or federation with AD FS, can move privilege and trust from one control plane to the other. Microsoft's enterprise access model calls for a hierarchy that stops control of higher planes from lower planes, which cannot be checked on one side alone. A review of only the on-premises directory can miss cloud administrator roles that grant control over synchronized identities, and a review of only the tenant can miss on-premises paths that reach it. Confirm with the provider that the scope names each synchronization method in use and each privileged role on both sides.

What happens if we still run Azure AD Connect V1?

Azure AD Connect V1 was retired on 31 August 2022 and is no longer supported, according to Microsoft Learn. Microsoft warns that V1 installations may stop working unexpectedly, so an installation that is still in place is an operational risk as well as a security concern. Microsoft also states that Entra Cloud Sync is the future of synchronization and replaces Entra Connect. An assessment should identify which synchronization tool is in use, which version is installed, and which service account and permissions it holds. Plan the migration with the synchronization owners and confirm the target design in writing before the assessment closes, since the findings will depend on that design.

Which AD or Entra ID findings should we expect to see?

Findings usually cluster around privileged groups that are larger than intended, administrative accounts that sign in to lower-trust systems, delegated permissions that allow control of higher-tier objects, and synchronization accounts with more rights than their function requires. The tier model helps frame them: Microsoft's enterprise access model extends Tier 0 into the control plane and splits Tier 1 and Tier 2 into separate planes. Findings are only useful when they are validated, so ask whether each claim is tested for exploitability and how the report separates confirmed paths from configuration observations. Your team should confirm that each finding maps to an owner and a remediation route before the report is accepted.

How DeployOpen scopes, delivers and supports directory security testing

DeployOpen plans, tests, documents and supports directory security work inside the client's own environment, including hybrid estates where on-premises Active Directory and Microsoft Entra ID must be reviewed together. Engagements are fixed-scope, with the scope, deliverables and timelines agreed in writing before work starts.

How we scope

The written scope names which AD forests, domains and Entra ID tenants are in review.
It states whether the work is a configuration review, an internal attack path test, or both.
Sync components such as Entra Connect or Entra Cloud Sync are listed as in-scope systems.

How we build

Test accounts and access levels are agreed in advance, from standard user to privileged roles.
Tier 0 control plane and tiering boundaries are mapped against the enterprise access model.
Testing follows written rules of engagement covering timing, production impact and escalation contacts.

How we hand over

Findings are documented with reproduction steps, affected objects and recommended remediation order.
Evidence is organized so your team and auditors can trace each control to its test result.
Detection gaps are listed so your monitoring team can confirm that the tested techniques are logged.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after the initial engagement.
Retesting after remediation is scoped in writing, so fixes are verified against the original findings.
Your team keeps the documentation and configuration baseline to run future reviews independently.