Cloud and Hybrid Sign-In

Many organisations now keep accounts in both Active Directory on-premises and Microsoft Entra ID, Microsoft's cloud directory. Microsoft Entra Connect provisions and synchronises the accounts between the two, so one identity works in both places, which Microsoft calls hybrid identity. A user then signs in to the domain and to cloud services such as Microsoft 365 with the same account.

When a sign-in reaches Microsoft Entra ID, the password is checked in one of three ways. Password hash synchronisation sends a hash of the on-premises password to the cloud, where Microsoft Entra ID checks it, while pass-through authentication keeps the check on-premises, where a lightweight agent validates the password against Active Directory. Federation hands the check to a separate trusted system, such as Active Directory Federation Services.

Windows Hello for Business replaces a password with a key pair held on the device. A gesture, a PIN or a fingerprint, unlocks the private key, which stays in the device's Trusted Platform Module and never leaves it, so there is no shared secret to steal or phish. Its public key is registered with Microsoft Entra ID or Active Directory, and the account reaches on-premises resources through a trust type Microsoft calls cloud Kerberos, key or certificate.

The Primary Refresh Token is the cloud equivalent of a ticket-granting ticket. A joined device is issued one when the user signs in, and it carries the device and user claims that let the device obtain tokens for cloud apps without the user entering a password again. Microsoft binds it to the device through a key in the Trusted Platform Module and renews it every four hours, and it stays valid for ninety days while the device is in use.

The attacks on these cloud credentials, such as stealing a token to sign in as its owner, belong to the Privilege Escalation topic, where token theft is covered. This page stays with what the credentials are and where their use is logged. In ATT&CK terms the tampering with hybrid sign-in is T1556.007, Modify Authentication Process: Hybrid Identity.