Microsoft upends traditional password recommendations with significant new guidance

HIP Podcast with IAM expert Daniel Stefaniak (Domino Data Lab), prompted by a finding that only 14% of developers prioritize app security: performance-over-security tradeoffs, MFA fatigue, and how Azure AD handles MFA.

Syncing Domain Admins into Entra ID lets attackers pivot from compromised on-prem AD to the cloud, and back via password writeback. CIS and Microsoft advise keeping privileged admin accounts cloud-only.

Covers hybrid identity risks—SolarWinds-style attacks pivot from on-prem AD into Azure AD—and recommends MFA plus AD Pass-through Authentication over legacy ADFS to shrink the attack surface.

Semperis adds Azure AD threat indicators to Directory Services Protector, complementing on-prem AD monitoring; explains how cloud credential compromise escalates into on-prem privileges and details indicators like unused administrative units.

Zero-trust and cloud IAM adoption (Azure AD, Okta) surged with remote work, but Semperis' Sean Deuby argues these strategies still depend on the integrity of on-premises Active Directory.

Azure AD Connect syncs 151 attributes by default and they can't be fully removed later; Semperis' Darren Mar-Elia recommends app, attribute, domain and OU filtering to limit exposure in Azure AD.