Securing Hybrid Identity

Why it may be time to leave ADFS in hybrid environments: its complexity expands the attack surface, and SolarWinds showed an on-premises flaw can compromise the Azure AD tenant; Microsoft recommends migrating to Azure AD Application Proxy.

Releases Invoke-ExternalDomainBruteforce, which detects whether a Microsoft domain is managed or federated, picks the right authentication flow, and automates password guessing against O365 and ADFS.

MFA for AD is challenging: native support is smartcards only, so organizations layer Windows Hello for Business or Duo on endpoints. Covers on-prem and hybrid options including Entra Connect.

AADInternals creator Dr. Nestori Synnimaa joins the HIP Podcast: every on-prem component in a hybrid AD configuration needs Tier 0 protection, and Azure AD sync compromise can expose credentials across both environments.

HIP Podcast with IAM expert Daniel Stefaniak (Domino Data Lab), prompted by a finding that only 14% of developers prioritize app security: performance-over-security tradeoffs, MFA fatigue, and how Azure AD handles MFA.

As enterprises integrate Microsoft Entra ID (formerly Azure AD) with on-prem AD, this piece examines hybrid identity risks—above all permission sprawl—and urges a look-before-you-leap approach to cloud identity adoption.