CIS Controls for Identity Infrastructure: Active Directory and Entra ID

Why Identity Infrastructure Demands Dedicated CIS Controls

Identity infrastructure differs fundamentally from network or endpoint security because it operates as the authoritative source of trust. Every authentication request, every permission check, and every delegation of authority flows through Active Directory or Entra ID. An attacker who compromises a domain controller or steals a Global Administrator token can authenticate as any user, to any resource, within minutes. This is not theoretical—CISA, Mandiant, and Microsoft's own Digital Defense Report consistently identify compromised identity infrastructure as the entry point for 80–90% of ransomware and data breach incidents.

CIS Controls v8 addresses this threat surface through a dedicated identity-focused safeguard family (Safeguard 6: Access Control Management) and cross-cutting controls that touch authentication, privilege management, audit logging, and recovery. The controls are designed to be implemented sequentially: organizations must first establish basic identity hygiene (IG1), then layer on advanced protections (IG2), and finally operationalize continuous monitoring and automated response (IG3).

Mapping CIS Controls to Active Directory and Entra ID Architectures

CIS Safeguard 6: Access Control Management

Safeguard 6 is the most directly relevant control family for identity infrastructure. It covers the creation, maintenance, and revocation of user accounts, groups, roles, and permissions. For Active Directory, this translates to enforcing tiered administrative models, restricting Domain Admin membership, implementing Group Managed Service Accounts (gMSAs), and removing stale or dormant accounts. For Entra ID, it means configuring Privileged Identity Management (PIM), enforcing role-based access control (RBAC), and governing external identities through Entra ID Entitlement Management.

The key IG1 safeguards under this family include:

\n
• 6.1: Establish and maintain an inventory of all user accounts, including service accounts and privileged accounts.
\n
• 6.2: Establish and maintain a process to review and revoke unused accounts within 30 days.
\n
• 6.3: Require MFA for all administrative access.
\n
• 6.7: Require MFA for all access to enterprise assets, whether on-premises or cloud-hosted.
\n

For Active Directory specifically, Safeguard 6 requires domain administrators to maintain a formal separation between Tier 0 (identity and domain controllers), Tier 1 (server infrastructure), and Tier 2 (workstations and user devices). Microsoft's Active Directory administrative tier model directly maps to this CIS requirement. Organizations that have not implemented tiering must prioritize it before any other identity hardening measure.

For Entra ID, Safeguard 6 maps to enforcing Conditional Access policies that require MFA for all privileged roles, blocking legacy authentication protocols (POP3, IMAP4, SMTP AUTH), and implementing continuous access evaluation (CAE) to revoke tokens in real time when user risk changes.

CIS Safeguard 4: Security Configuration of Enterprise Assets and Software

Safeguard 4 addresses configuration hardening for all assets, including identity infrastructure components. For Active Directory, this means applying the CIS Benchmarking Tool to domain controllers, configuring audit policies, disabling weak cryptographic protocols (NTLMv1, DES, RC4), and enforcing SMB signing. For Entra ID, it means configuring device registration settings, password hash sync policies, and authentication methods with appropriate strength (passwordless, FIDO2, or certificate-based).

The CIS Benchmarks for Microsoft Windows Server (which covers domain controllers) and for Microsoft 365 (which covers Entra ID) provide the specific configuration checks that map to Safeguard 4. Organizations should run automated assessments against these benchmarks on a recurring basis—at minimum quarterly, and ideally weekly or event-driven through configuration drift detection.

CIS Safeguard 7: Continuous Vulnerability Management

Identity infrastructure is highly susceptible to privilege escalation vulnerabilities. Zerologon (CVE-2020-1472), noPac (CVE-2021-42278/CVE-2021-42287), and Kerberos delegation abuse all represent classes of vulnerabilities that CIS Safeguard 7 directly addresses. In Entra ID, vulnerabilities often manifest as misconfigured app registrations, overprivileged service principals, or excessive consent grants—all of which are discoverable through Microsoft's Identity Secure Score and third-party security tools.

The CIS recommendation is clear: vulnerability scanning must cover domain controllers, Active Directory certificate services (AD CS), Active Directory federation services (AD FS), and Entra ID tenant configurations. Automated scanning and prioritization (using a Common Vulnerability Scoring System or exploit prediction scoring system) ensures that the most dangerous identity vulnerabilities are remediated within the CIS-recommended SLAs: 15 days for IG1, 30 days for IG2, and 45 days for IG3.

Applying CIS Implementation Groups to Active Directory

IG1: Baseline Active Directory Hygiene

All organizations, regardless of size or risk profile, must implement IG1 controls. For Active Directory, this represents the minimum security baseline that every domain-joined environment must maintain. The CIS IG1 expectations for AD include:

\n
• Stale account remediation: Disable accounts inactive for 45 days or more. Delete accounts inactive for 90 days. This includes disabled user accounts, terminated employee accounts, and unused service accounts.
\n
• Domain Admin reduction: Limit Domain Administrators, Enterprise Administrators, and Schema Administrators groups to fewer than 10 members. Implement just-in-time (JIT) elevation for any administrative activity through tools like Microsoft LAPS or third-party PAM solutions.
\n
• Default password policy: Enable and enforce a domain-level password policy that requires complexity, minimum length of 12 characters, and 90-day maximum age. Disable reversible encryption.
\n
• Account lockout policy: Configure account lockout after 10 failed attempts with a lockout duration of 30 minutes or manual unlock by an administrator.
\n
• Basic audit logging: Enable audit for account logon events (4624, 4625), account management events (4720–4739), and directory service access events (4662, 5136). Forward logs to a centralized SIEM platform for correlation and alerting.
\n

IG1 also requires enabling Protected Users security group membership for all Domain Administrators and Enterprise Administrators. The Protected Users group enforces Kerberos-only authentication, prevents NTLM fallback, and blocks RC4 encryption, which significantly reduces the attack surface for credential theft attacks.

IG2: Foundational Active Directory Hardening

IG2 builds on IG1 with controls that require planning, configuration automation, and monitoring. Organizations must demonstrate continuous compliance rather than point-in-time checks.

\n
• Tiered administrative model: Implement the Microsoft active directory administrative tier model with explicit restrictions between Tier 0 (domain controllers, identity management servers), Tier 1 (file servers, SQL servers), and Tier 2 (workstations). Use Group Policy to restrict interactive logon across tiers.
\n
• AS-REP roasting protection: Identify and disable accounts that do not require Kerberos pre-authentication (since these are vulnerable to AS-REP roasting attacks). Use PowerShell or automated assessment tools to scan for and remediate these accounts.
\n
• Kerberoasting mitigation: Enforce strong (120+ character) passwords for all service principal name (SPN)-registered accounts. Manage service account passwords with Group Managed Service Accounts (gMSAs) wherever possible.
\n
• Read-Only Domain Controllers (RODCs) at remote sites: Deploy RODCs at branch offices and remote locations to reduce the risk of physical compromise and credential theft. Configure password replication policy to restrict which accounts' credentials are cached.
\n
• Active Directory Certificate Services (AD CS) hardening: Review and restrict certificate template permissions, remove unnecessary EKU extensions, and disable weak cryptographic algorithms. AD CS is one of the most overlooked attack surfaces in enterprise AD environments.
\n
• Privileged Access Workstations (PAWs): Deploy dedicated PAWs for administrative access to domain controllers and identity management consoles. PAWs should run a clean operating system image that is hardened, monitored, and isolated from standard enterprise user activity.
\n

IG2 also requires automated configuration drift detection. Organizations should schedule weekly assessments against the CIS Benchmark for Windows Server and compare current domain controller configuration against the hardened baseline. Tools like top 10 CIS benchmarking tools provide automated scoring and remediation tracking for these checks.

IG3: Advanced Active Directory Operationalization

IG3 represents the upper tier of CIS maturity, applicable to organizations with high risk tolerance thresholds, regulatory compliance obligations (PCI DSS, HIPAA, FedRAMP), or advanced threat landscapes. For Active Directory, IG3 adds continuous monitoring, automated incident response, and adversarial resilience.

\n
• Kerberos Golden Ticket detection: Deploy detection rules for abnormal Kerberos TGT issuance (event ID 4768) that triggered without corresponding pre-authentication, or TGTs with anomalous lifetime duration. Correlate with SIEM and configure automated account suspension on detection.
\n
• DCSync attack detection: Monitor event ID 4662 (directory service access) for replication requests from non-domain-controller accounts. DCSync is one of the most common post-exploitation techniques used to extract all domain credentials in a single operation.
\n
• Automated privileged account lifecycle: Integrate Entra ID PIM or a third-party PAM solution with AD automation workflows. When an administrator's elevated session expires, the solution must automatically remove AD group membership that was granted for that session.
\n
• Advanced audit forensics: Forward all Windows Event Logs from domain controllers to a top 10 SIEM tools solution with UEBA (user and entity behavior analytics) capabilities. Configure baselines for normal administrative behavior and alert on deviations such as unusual logon hours, logon locations, or elevation patterns.
\n
• Backup and disaster recovery: Maintain immutable, offline backups of Active Directory that can be used for authoritative restore within 24 hours. Test AD restore procedures quarterly, including domain controller rebuild from backup, SYSVOL recovery, and schema extension rollback.
\n

IG3 also requires scheduled red-team exercises targeting identity infrastructure. Organizations must validate that detection rules fire on DCSync, Golden Ticket, Silver Ticket, Kerberos delegation abuse, and AD CS attack techniques. If detection coverage is incomplete, the missing controls must be treated as high-priority findings in the risk register.

Applying CIS Implementation Groups to Entra ID

IG1: Baseline Entra ID Hardening

Entra ID IG1 controls mirror Active Directory IG1 but focus on cloud-native identity risks. Organizations that have not deployed any Entra ID security defaults must implement these immediately:

\n
• Security defaults enabled: For tenants without Conditional Access licenses, enable Entra ID Security Defaults. This enforces MFA registration for all users, blocks legacy authentication protocols, and enables basic risk detection.
\n
• Global Administrator reduction: Limit permanent Global Administrator assignments to fewer than 5 accounts. Move to Just-In-Time (JIT) access where possible through Entra ID Privileged Identity Management (PIM).
\n
• Legacy authentication disabled: Block all legacy authentication protocols at the tenant level. Create a Conditional Access policy that blocks Exchange ActiveSync, POP3, IMAP4, SMTP AUTH, and older Microsoft Office client versions that do not support modern authentication.
\n
• Passwordless or MFA enforcement: Require MFA for all administrative roles and all external-facing application access. Prioritize passwordless authentication methods (FIDO2 security keys, Microsoft Authenticator, Windows Hello for Business) over SMS or voice-based MFA.
\n
• External identity governance: Review and remove guest accounts that have not authenticated within 30 days. Configure Entra ID entitlement management to require approval for guest access to Microsoft 365 groups, Teams, and SharePoint sites.
\n

IG2: Foundational Entra ID Advanced Configuration

IG2 assumes the organization has an Entra ID Premium P1 or P2 license and can implement advanced identity protection and governance controls:

\n
• Conditional Access with device compliance: Require hybrid-joined or Entra ID-joined devices with compliant status (as determined by Microsoft Intune or Microsoft Defender for Endpoint) for access to corporate applications. Block access from unmanaged devices.
\n
• Privileged Identity Management (PIM) for all admin roles: Activate PIM for all Entra ID admin roles, including Global Administrator, Application Administrator, Exchange Administrator, and SharePoint Administrator. Configure activation approval workflows and time-bound justifications.
\n
• Continuous Access Evaluation (CAE): Enable CAE for tenants with Exchange Online and SharePoint Online. CAE enables real-time token revocation when user risk changes, device status changes, or administrators revoke sessions.
\n
• Identity Protection policies: Enable Entra ID Identity Protection for both user risk and sign-in risk. Configure user risk policies to require password change when risk is medium or high. Configure sign-in risk policies to require MFA or block access when risk is medium or high.
\n
• App registration governance: Review and restrict app registration permissions. Remove apps with consent granted to high-impact permissions (Mail.ReadWrite, User.ReadWrite.All, Directory.ReadWrite.All). Implement admin consent workflows to prevent users from granting broad permissions.
\n
• Service principal management: Inventory all service principals (SPNs) with high-privilege Entra ID roles. Remove unused SPNs and enforce certificate-based authentication with short-lived certificates (max 12 months) for those that remain.
\n

IG2 also requires monthly entitlement reviews. Organizations must manually or automatically certify that group memberships, role assignments, and application permissions remain appropriate. Entra ID Access Reviews provides native automation for this, but organizations must ensure that at least one reviewer (preferably the resource owner or data owner) completes the review within the CIS-specified timeline.

IG3: Advanced Entra ID Monitoring and Response

IG3 for Entra ID focuses on continuous operational monitoring, automated response, and adversarial resilience in cloud identity:

\n
• Sign-in and audit log streaming: Forward all Entra ID sign-in logs, audit logs, and Identity Protection risk detection events to a ThreatHawk SIEM solution for long-term retention and advanced correlation. Configure real-time alerts for high-severity detections (impossible travel, anonymous IP sign-in, malware-linked IP, suspicious browser fingerprint).
\n
• Automated incident response playbooks: Create automated playbooks that trigger on specific identity risk events. For example: if a Global Administrator's account is detected as compromised, automatically revoke all active sessions, disable the account, reset the password, and notify the security operations center.
\n
• Custom detection rules for persistence: Monitor for Entra ID-specific post-compromise persistence techniques: attackers adding rogue service principals, registering malicious apps with elevated permissions, or modifying federation trust certificates. Create Sentinel or SIEM analytics rules that trigger on these events.
\n
• Privileged account monitoring in hybrid environments: When a user is synchronized from on-premises AD and has a high-value Entra ID role, monitor both the on-premises and cloud authentication patterns. Tactical attackers often compromise on-premises AD first and then pivot to cloud via synchronization accounts.
\n
• Third-party identity provider (IdP) monitoring: If the organization uses third-party IdPs (Okta, Ping, etc.) federated with Entra ID, extend IG3 monitoring to include IdP health, token signing certificate expiration, and federation trust misconfiguration.
\n

IG3 also requires tabletop exercises specific to identity compromise scenarios. Test the organization's ability to detect and respond to a Global Administrator token theft, a service principal backdoor, or a passwordless MFA device theft. Document response times, escalation paths, and lessons learned.

CIS Controls Cross-Reference Matrix for Identity Infrastructure

The following table maps the most critical CIS Safeguards to specific configuration areas within Active Directory and Entra ID, along with recommended Implementation Group priority.

This cross-reference matrix should be used as a quick-start for developing your organization's identity security roadmap. Begin with IG1 controls across both Active Directory and Entra ID, then progress through IG2 and IG3 based on your regulatory obligations, risk appetite, and available resources.

Automating CIS Compliance for Identity Infrastructure

Manual assessment and tracking of CIS Controls across a large Active Directory forest and Entra ID tenant is not operationally feasible. Enterprise environments typically have thousands of user accounts, hundreds of groups, dozens of domain controllers, and dozens of administrative roles. The CIS Benchmarks for identity infrastructure include hundreds of individual configuration checks, and compliance must be verified on a recurring basis.

Automation is therefore a requirement for IG2 and IG3 compliance. The following process flow outlines how to implement automated CIS assessment for identity infrastructure:

Automation transforms CIS compliance from a manual, time-intensive burden into a measurable, governable security metric. Organizations using automated assessment tools consistently achieve higher hardening scores and maintain them for longer periods compared to organizations relying on manual checklists and point-in-time audits.

Common Pitfalls in CIS Identity Hardening

Even organizations that commit resources to CIS compliance often make avoidable mistakes in identity infrastructure hardening. Awareness of these pitfalls can save significant rework and prevent security gaps:

Pitfall 1: Treating Active Directory and Entra ID as separate compliance domains. In practice, most enterprises operate hybrid identity configurations where users, groups, and permissions synchronize bi-directionally between on-premises AD and Entra ID (via Microsoft Entra Connect or Cloud Sync). A security control applied only in one environment leaves the other exposed. For example, blocking legacy authentication in Entra ID does nothing if an attacker can authenticate directly against an on-premises directory or federation service. CIS Controls must be evaluated across the entire identity estate, including synchronization accounts, federation trusts, and password hash sync settings.

Pitfall 2: Focusing on password policy alone. While password policy is an IG1 control, organizations often treat it as the entirety of identity security. Modern identity attacks bypass passwords entirely—they steal tokens, abuse Kerberos, or exploit misconfigured delegation. A strong password policy combined with weak MFA enforcement, no Kerberos hardening, and unmonitored privilege escalation is not CIS-compliant. The controls are designed as a layered set; each layer assumes the previous layer is already in place.

Pitfall 3: Overlooking service accounts. Service accounts consistently represent the largest and most vulnerable category of privileged identities in Active Directory. These accounts rarely enforce regular password changes, often have excessive privileges (Local System or Network Service), and are seldom monitored for anomalous behavior. CIS Safeguard 6.1 explicitly requires service account inventory, and IG2 requires gMSA adoption wherever possible. Organizations should prioritize service account assessment immediately after user account remediation.

Pitfall 4: Implementing controls without audit logging. CIS IG2 requires audit logging (Safeguard 8) enabled and centralized before advanced detection (Safeguard 12) can function. Organizations that jump to advanced detection without first fixing their log pipeline create false confidence. DCSync detection rules are useless if the domain controller audit policy does not log directory service access events (4662). Verify audit configuration as a prerequisite to any IG3 implementation.

Pitfall 5: Treating CIS as a one-time project, not a continuous process. CIS Controls are designed for continuous compliance. Identity infrastructure changes constantly—new accounts are created, group memberships change, software patches alter configuration states, and temporary exclusions are introduced for emergencies. Without continuous drift detection, compliance erodes within weeks. Organizations that achieve IG2 or IG3 compliance but do not sustain it through automated monitoring will fail their next audit and, more importantly, remain exposed to evolving identity threats.

Complementary Frameworks and Standards

CIS Controls v8 does not stand alone as a security framework. Organizations subject to regulatory compliance requirements must map CIS controls to their governing standards. The following are the most common crosswalks for identity infrastructure:

NIST 800-53 Rev. 5: CIS Safeguard 6 (Access Control Management) maps to AC-1 through AC-25 in NIST 800-53, particularly AC-2 (Account Management), AC-6 (Least Privilege), and AC-7 (Unsuccessful Logon Attempts). Organizations pursuing FedRAMP authorization can use CIS controls as a baseline control overlay to satisfy their NIST 800-53 requirements more efficiently. Compliance Standards Automation tools can generate the mapping automatically and identify gaps.

ISO 27001:2022: Control A.8 (Access Control) aligns with CIS Safeguard 6. Control A.9 (Authentication) aligns with CIS Safeguard 3 (Password Management) and Safeguard 6. Control A.10 (Cryptography) aligns with CIS Safeguard 4 (Secure Configuration) for encryption and key management. Organizations with ISO 27001 certification should map their identity controls to both frameworks to avoid redundant documentation.

PCI DSS v4.0: Requirement 7 (Restrict Access to Cardholder Data) maps to CIS Safeguard 6. Requirement 8 (Identify Users and Authenticate) maps to CIS Safeguards 3 and 6. Requirement 10 (Log and Monitor Access) maps to CIS Safeguard 8. For organizations handling payment card data, CIS IG2 is the minimum effective tier for identity infrastructure; IG3 is strongly recommended for high-volume merchants or acquirers.

HIPAA Security Rule: The Administrative Safeguards (45 CFR § 164.308) include identity management requirements that map to CIS Safeguards 3, 6, and 8. Technical Safeguards (45 CFR § 164.312) for authentication and access control map to CIS Safeguard 6 and 4. Healthcare organizations should use the CIS Implementation Group framework to prioritize spend: IG1 controls represent the minimum ceiling for HIPAA compliance, while IG3 controls represent best practice for protecting electronic protected health information (ePHI).

Organizations that need to demonstrate compliance across multiple frameworks should adopt a unified approach: implement CIS Controls v8 as the common security baseline, then overlay each regulatory framework's specific requirements on top. This \"compliance by consolidation\" approach reduces overhead, eliminates duplication, and ensures that identity security posture is assessed consistently across all obligations.

The Role of SIEM and SOAR in Identity Control Operationalization