How to Secure Hybrid Azure AD Integrations

TL;DR

Protect the on-premises environment to protect cloud identities, because hybrid authentication connects both security boundaries. Azure AD Connect and related components hold powerful permissions and credentials, making them valuable attack targets. Treat every hybrid identity component as a Tier 0 server and protect it as carefully as a domain controller.

Transcript

So welcome everybody. How are we doing? So nice to be here. I can see, again, real people. Because watching that small screen and talking, and nobody's asking anything, or I can't see that, did they get it? Uh, okay, so without further ado, uh, disclaimer. RS disclaimer and mine is that everything I'm talking to you here is, are my opinions. So don... Read More

Key Insights

• Hybrid identity security depends on on-premises security because shared identities connect the local directory to Azure AD. An attacker who compromises relevant on-premises systems may gain control of an identity that provides access to the organization’s cloud services and resources.
• Azure AD adoption covered 88 percent of the Fortune 500 organizations and 95 percent of the top 2,000 universities examined in the presenter’s open-source research. The findings show that Azure AD was broadly used across both major companies and higher-education institutions.
• Identity federation is based on trust between Azure AD and an identity provider, commonly an organization’s AD FS deployment. It supports single sign-on but may require at least two AD FS servers and two proxy servers, creating a substantial on-premises infrastructure that must be secured.
• Password hash synchronization stores derived credentials in Azure AD rather than directly using the original NT hashes. The synchronized material is salted and rehashed with SHA-256 one thousand times, allowing Azure AD to verify cloud login attempts without sending each authentication request back on premises.
• Pass-through Authentication validates cloud login attempts through an agent installed in the on-premises environment. Azure AD sends the presented credentials to that agent, which attempts authentication as the user and returns the result, avoiding the need to synchronize password hashes into Azure AD.
• Seamless Single Sign-On provides automatic Azure AD access when a user is already signed into a domain computer. It can be combined with password hash synchronization or Pass-through Authentication, compensating for the lack of built-in single sign-on in those two authentication approaches.
• Azure AD Connect is a high-value attack target because its service has powerful permissions in both on-premises AD and Azure AD. When password hash synchronization is enabled, its service account can perform DC sync and obtain password hashes through domain replication capabilities.
• Hybrid identity components should be treated as Tier 0 systems because their compromise can affect the organization’s most important identities. Azure AD Connect, federation infrastructure, and other involved components require protection comparable to the safeguards applied to domain controllers.

Questions & Answers

Q: Why does cloud security depend on on-premises security?

Cloud security depends on on-premises security when an organization uses hybrid identities. The integration lets users employ the same credentials locally and in Azure AD, but it also connects the two environments. If an attacker compromises an on-premises server involved in identity services, the attacker may compromise a trusted identity and use it to access the organization’s cloud services and resources.

Q: What hybrid authentication options are available in Azure AD?

The presentation identifies three hybrid authentication options: identity federation, password hash synchronization, and Pass-through Authentication. Federation relies on trust with an identity provider, password hash synchronization places derived password hashes in Azure AD, and Pass-through Authentication uses an on-premises agent to validate login attempts. Seamless Single Sign-On can be added to password hash synchronization or Pass-through Authentication for automatic cloud access.

Q: How does identity federation work with Azure AD?

Identity federation establishes trust between Azure AD and an identity provider operated by the organization, commonly through AD FS. It enables users to access cloud resources with their existing identity and supports single sign-on. The infrastructure can be substantial because the described minimum deployment used two AD FS servers and two proxy servers, with proxies limiting direct internet exposure of domain-joined servers.

Q: How does Azure AD password hash synchronization work?

Password hash synchronization transfers derived password information from on-premises AD to Azure AD so that Azure AD can check login credentials directly. The synchronized values are described as NT hashes that are salted and rehashed with SHA-256 one thousand times, preventing them from being reversed according to the presentation. This option does not provide single sign-on by itself, but Seamless Single Sign-On can be added.

Q: How does Pass-through Authentication validate Azure AD logins?

Pass-through Authentication uses an agent installed in the organization’s on-premises environment. When a user attempts to sign in, the credentials are sent to that agent. The agent tries to authenticate as the user against the local environment and returns the result to Azure AD. Passwords therefore do not need to be synchronized into Azure AD, although this option does not independently provide single sign-on.

Q: What is Seamless Single Sign-On in a hybrid identity setup?

Seamless Single Sign-On automatically signs a user into Azure AD when that user is already logged into a domain computer. The presentation describes it as an additional capability for password hash synchronization and Pass-through Authentication, since neither option supplies single sign-on on its own. It improves the user experience by reducing repeated authentication while preserving the chosen underlying hybrid authentication method.

Q: Why is Azure AD Connect a valuable target for attackers?

Azure AD Connect is valuable because its synchronization service holds highly privileged access to both on-premises AD and Azure AD. With password hash synchronization, the service account can perform DC sync, meaning it can replicate the domain and obtain password hashes. The demonstration showed that compromising the Azure AD Connect server allowed its on-premises service credentials to be dumped with a single toolkit command.

Q: How should organizations harden Azure AD Connect and related systems?

Organizations should classify Azure AD Connect and every component involved in hybrid identity as Tier 0 infrastructure. These systems should receive protection comparable to domain controllers because their accounts, permissions, and synchronization functions can affect both local and cloud identities. Azure AD Connect should also run on a separate protected computer rather than on a domain controller, as the presenter noted during the demonstration.

Summary & Key Takeaways

• Hybrid identities let users access on-premises and Azure AD resources with the same credentials, simplifying administration and improving the user experience. The available authentication approaches are identity federation, password hash synchronization, and Pass-through Authentication. Seamless Single Sign-On can supplement password hash synchronization or Pass-through Authentication when automatic cloud sign-in is required.

• Identity federation relies on trust with an identity provider, commonly implemented through AD FS, and supports single sign-on. Password hash synchronization sends salted hashes that have been rehashed with SHA-256 one thousand times to Azure AD. Pass-through Authentication instead sends login requests to an on-premises agent that validates the user and returns the result.

• Azure AD Connect is central to many hybrid deployments because it synchronizes identities between on-premises AD and Azure AD. Its service has highly privileged access to both environments, and password hash synchronization can grant its account DC sync capabilities. A compromised Azure AD Connect server can therefore expose credentials and threaten connected cloud identities.