The network boundary used to be the main line of defence. With cloud apps, remote work and personal devices, the account has become the perimeter. Attackers rarely break in; they log in.
Active Directory and Entra ID
Both manage identities, but they are not the same product.
| Concept | Active Directory | Entra ID |
|---|---|---|
| Primary protocol | Kerberos, LDAP | OAuth 2.0, SAML, OpenID Connect |
| Typical location | On-premises domain controllers | Cloud identity provider |
| Device management | Group Policy | Intune / conditional access |
| Admin model | Domain/Enterprise Admins | Roles and privileged identity management |
Hybrid organisations connect them, which creates both convenience and new paths. A compromised on-premises account can sometimes be used to reach cloud resources, and vice versa.
MFA is necessary, not magical
MFA raises the cost of password attacks, but not all MFA is equal:
- SMS can be defeated by SIM swapping.
- Push notifications can be fatigued or relayed.
- TOTP codes resist SIM attacks but can be phished by a proxy.
- Passkeys and FIDO2 keys are bound to the origin and resist phishing best.
If an attacker already has the password, repeated push prompts become a social engineering attack. Number matching and phishing-resistant methods reduce it.
Continue this lesson in the player
A free account unlocks the full lesson, the five-question knowledge check, progress tracking, notes and the completion certificate.