Active Directory and hybrid identity testing
Understand who can change the accounts, groups and services that control access to your estate. Where on-premises Active Directory connects to Microsoft Entra ID, test the agreed links between them.
Who can grant rights to a critical server?
A support group can change membership of another group that administers an important server.
Illustrative test report
- Starting identity
- Use the agreed help-desk identity and trace the nested group or delegated membership right.
- Decision
- The directory owner decides which delegated permission to change and which administrator still needs access.
- Verification
- Repeat the membership check from the same identity. Confirm the authorised administrator can still perform the task.
When to choose this service
- You are joining domains after an acquisition or changing how identities synchronise to the cloud.
- You have delegated administration to a service desk, supplier or new team.
- You want to check whether a standard account can acquire permissions that affect many systems.
Choose the domains, trusts, delegated roles and starting identities to assess. Name the Entra tenant and synchronisation components where hybrid identity is in scope. Include certificate services only where deployed and agreed.
What we examine
- Whether group membership, delegated rights or service-account access gives an ordinary user control over a more privileged identity.
- How trust between domains and separation between administrative roles affect access to agreed targets.
- Where relevant, which identities administer the synchronisation service, what their permissions allow and which directory holds authority for the account being assessed.
What to prepare
Active Directory
Name the domains, trusts and delegated groups to include. Bring a diagram of the permitted trust boundaries, the roles the test identities should have and any certificate services in scope. Identify the directory owner who can authorise and stop testing.
If your identities synchronise to Microsoft Entra ID
Ask the synchronisation owner to identify the tenant, connector, direction of synchronisation and both administrators responsible for the boundary. Agree which cloud identities may be tested. An on-premises engagement can stay within the named Active Directory domains.
Agreed boundaries
Use dedicated test identities. Agree where proof must stop and which evidence may be collected before making any changes to a directory or tenant.
What you receive
Findings show the account, group or trust relationship that creates each route to privilege. Directory and cloud owners can see the access affected, the evidence and the permission or configuration to change.
Follow-up
Repeat the original permission check from the same starting identity and confirm approved administrators retain the access they need. Vambrace offers free retests of vulnerabilities found for 12 months.
Tell us the business question, the systems or sites involved and the decision that depends on the result.
Scope an identity test