Purple Knight Introduces Entra ID (formerly Azure AD) Security Indicators

Syncing Domain Admins into Entra ID lets attackers pivot from compromised on-prem AD to the cloud, and back via password writeback. CIS and Microsoft advise keeping privileged admin accounts cloud-only.

Semperis introduces Lightning Intelligence, a SaaS tool that continuously scans AD and Entra ID, replacing Purple Knight's manual runs, with multi-forest dashboards and no agent required.

Purple Knight v4.2 revamps scoring to count only failed indicators, closer to real exposure severity. Category scores become independent metrics for tracking remediation progress.

Semperis offers a PowerShell script that automates Entra ID app registration for free Purple Knight assessments, requiring Microsoft.Graph.Applications, Az.Accounts, and Global Admin rights.

Compares the free editions of Purple Knight and PingCastle: both assess Active Directory security and guide improvements, and the post outlines each tool's strengths to help organizations choose.

Webinar recap on applying MITRE ATT&CK to Active Directory: how attackers exploit AD, how techniques map to the framework, plus tooling for defense—and data belying attendees' confidence, with average Purple Knight scores at just 64%.