Zero Trust Gaps in a Hybrid Identity Environment
A manufacturer runs Active Directory Domain Services on-premises and syncs to Microsoft Entra ID using Microsoft Entra Connect. Password hash synchronization is enabled. There are 3,100 users; 400 are in a shared workstation environment on the factory floor where users sign in to a single kiosk PC with a shared local account. Administrators use privileged on-premises accounts that are also synced to the cloud and hold the Global Administrator role. The company has Microsoft Entra ID P1. A recent incident involved an attacker who obtained a password from a phishing email, signed in to the cloud portal, and created a new administrator account. The security team is asked to apply Zero Trust principles and to justify each control against a specific assumption.
1. Apply the Zero Trust principle of least privilege to the administrator accounts, and explain why the shared kiosk accounts are a separate problem.
Read the worked answer
Least privilege: the synced privileged accounts holding Global Administrator violate the principle because day-to-day administration does not require tenant-wide control. The fix is to separate accounts: keep ordinary user accounts for email and productivity, create dedicated cloud-only privileged accounts, and assign the Global Administrator role as eligible through Privileged Identity Management rather than permanent. Microsoft Entra ID P2 is required for PIM; the organization has P1, so this is a licensing decision to surface. At minimum, reduce standing role assignments to the smallest set and require MFA for those accounts.
Shared kiosk accounts: a shared local account cannot be attributed to a person, which breaks the 'verify explicitly' principle. Every action from that account is anonymous. The remedy is per-user sign-in on the kiosk with a shared-device mode, or at least individual credentials with a kiosk browser profile. Shared credentials also cannot be revoked for one person without disrupting everyone.
2. The attacker used a phished password and no MFA prompt appeared. Identify the control gaps in order of impact and explain how each maps to a Zero Trust assumption.
Read the worked answer
Order by what would have stopped the attack earliest.
MFA: no prompt appeared, so a stolen password was sufficient. Requiring MFA for all users, with Conditional Access enforcing it, assumes the network is hostile and a password alone proves nothing. This is the highest-impact gap.
Privileged access control: the attacker created an administrator account. Restricting who can create privileged accounts, requiring approval through PIM, and alerting on role assignment changes assumes breach and limits blast radius. This is the second gap.
Sign-in risk detection and conditional access: a sign-in from an unusual location or device should be challenged. Risk-based policies assume not all sign-ins are equal.
Password hash synchronization means the phished password also matters on-premises; the team should confirm whether the compromised account had on-premises rights and rotate credentials accordingly.
Each control maps to an explicit assumption: no implicit trust from network location, no implicit trust from a correct password, and no standing privilege.