Recent attacks, including the SolarWinds exploit, have shown that a compromise of on-premises Active Directory can have harsh security consequences in cloud-based Azure Active Directory (Azure AD). Rarely are Active Directory teams equipped to detect and remediate indicators of exposure (IOEs) or indicators of compromise (IOCs) on Azure AD, and often Azure AD practitioners do not have the Active Directory visibility or expertise necessary to thwart attacks that start there.

As much as enterprises desire to move to the cloud, the reality is that most will be operating in a hybrid identity scenario for the foreseeable future. Abandoning on-premises assets for a wholesale shift to the cloud simply isn’t feasible. Consequently, the move to the cloud is more of an evolution than a revolution. Unfortunately, key aspects of securing a hybrid identity system are often overlooked.

Operating in a hybrid identity scenario usually involves disparate teams securing Active Directory and Azure AD with separate tools and processes. Hybrid environments also have extremely complex threat landscapes, with hidden interrelations and a glaring lack of visibility into the security implications on-premises Active Directory has on Azure AD, and vice versa.