First Harbor Bank: cloud sign-in that survives the datacenter going dark

Password hash synchronization plus seamless SSO.

• Federation (AD FS) requires inbound connectivity from clients to on-premises STS and dies when the datacenter is offline. It violates both the resilience and the no-inbound constraints. Eliminated.
• Pass-through authentication uses outbound-only agents, so it satisfies the no-inbound rule, but authentication is validated on-premises. Datacenter offline means no sign-in unless PHS is also enabled as a fallback. It does not meet the resilience requirement on its own.
• PHS validates credentials in the cloud. The datacenter can be dark and Microsoft 365 sign-in continues. Microsoft syncs a hash of the hash, not plaintext, which is acceptable to most regulators.
• Kerberos nuance: the legacy intranet app needs a Kerberos ticket from a domain controller, so it depends on-premises regardless of the sync method. Seamless SSO gives domain-joined PCs single sign-on to Entra ID resources without re-prompting, and it is what makes the hybrid experience tolerable - but be precise with the auditors: cloud sign-in survives a datacenter outage; the on-premises intranet application does not, and no identity configuration changes that.
• Keep PTA agents deployed as a standby only if policy demands it; PHS remains the primary.

Eligibility over assignment, separation over convenience, and a break-glass path outside the system.

• PIM. Convert all 40 permanent Global Administrator assignments to eligible assignments: approval required, justification, MFA or a phishing-resistant authentication strength at activation, maximum activation of 4 hours, and notification to the security team.
• Reduce standing access. Global Administrator should be a handful of people; move the rest to narrower roles (User Administrator, Application Administrator, Exchange Administrator). Use access reviews quarterly - 40 permanent GAs is an audit finding on its own.
• Separate admin identities. Cloud-only accounts with no mailbox and no synchronization path, used only from privileged access workstations. A compromised synced account should never be an admin account.
• Conditional Access on directory roles: compliant or PAW device, authentication strength requiring FIDO2, block legacy authentication, restrict session lifetime.
• Break-glass. Two cloud-only Global Administrator accounts excluded from all Conditional Access policies, with long random passwords stored offline in a physical safe, alerting on any sign-in. Critically, they must not be PIM-eligible: an activation workflow that depends on the platform working is exactly what fails in the scenario you are defending against.

Export immediately - native retention is far shorter than a year.

• Retention reality. Entra ID sign-in logs are retained natively for 7 days on free tier and 30 days with P1/P2; audit logs are similarly short. A one-year requirement means diagnostic settings shipping SignInLogs, AuditLogs, and PIM activation events to a Log Analytics workspace, with interactive retention of 90 days plus long-term retention or archive for the balance. Do not assume the portal's date picker proves retention.
• Azure activity logs for the subscription, plus resource diagnostic logs, to the same workspace.
• Detections. Alert on: PIM activation outside business hours or by an unexpected account; any permanent role assignment created outside PIM; break-glass account sign-in; changes to Conditional Access or PIM settings; consent grants to new applications. These are the moves an attacker makes after taking an admin account.
• Protect the evidence. Put the workspace in a dedicated subscription with a resource lock and restricted Contributor; an attacker with Contributor on the logging subscription can silence the alerts that would detect them.
• Evidence quality: capture the activation justification and approval trail, not just the sign-in, because the auditors are asking who approved privileged use, not merely that someone authenticated.