The answer in sixty seconds
Close the gap between attacker tradecraft and Essential Eight Maturity Level 2 by combining two recipes in a defined order. First, declare Tier 0 boundaries using the Microsoft tier model (or its successor, the Enterprise Access Model). Then layer ASD Essential Eight ML2 controls onto that boundary: restrict administrative privileges, require multi-factor authentication on privileged accounts, and run resilient daily backups with immutable copies. Tier 0 without ML2 is a paper boundary. ML2 without Tier 0 protects the wrong assets first.
Why the two recipes belong together
The Microsoft tier model has existed since the Best Practices for Securing Active Directory guidance was first published. The company's Privileged Access Strategy (Microsoft Learn, last reviewed 2025) now expresses the same idea as the Enterprise Access Model, with control, management, and data planes. Both frameworks separate the accounts that can compromise the entire forest from the accounts that handle day-to-day work.
The ASD Essential Eight Maturity Model (current revision 2025) is the Australian government's prescriptive control set. (cyber.gov.au — Essential Eight Maturity Model, accessed 16 June 2026). Maturity Level 2 represents the threshold where an organisation is meaningfully resistant to a competent adversary using publicly available tradecraft. ML2 raises the bar on backups, on multi-factor authentication for privileged users, and on restricting administrative privileges — all of which target the same assets the tier model calls Tier 0.
Practitioners get into trouble when they treat the two as alternatives. Consider a common pattern. An organisation declares it has reached ML2 on privileged access because every administrator has MFA enabled in Entra ID, and the audit shows MFA coverage at 100%. The forest is still one phishing click away from a destructive incident. The privileged accounts log in from the same workstation they use for email, and the Tier 0 boundary was never enforced. The tier model is what makes the ML2 control meaningful in practice.
The IBM X-Force Threat Intelligence Index 2025 reports that valid account abuse and credential theft remain the most common initial access vectors globally. ASD's ACSC Annual Cyber Threat Report 2024–25 reports ransomware as the highest impact cybercrime category against Australian organisations. (cyber.gov.au — ACSC Annual Cyber Threat Report, accessed 16 June 2026). Both data sets converge on the same conclusion: the path from initial access to forest-level compromise runs through privileged accounts on insufficiently isolated hosts.
The tier model in 2026 — what changed and what did not
The original tier model defined three administrative tiers. Tier 0 is the control plane: forest, domain controllers, ADFS, AD Connect, certificate authorities, and the accounts and workstations used to administer them. Tier 1 covers server and application administrators. Tier 2 covers workstation administrators and helpdesk. The rules were straightforward. Credentials never flow downward, sessions never flow upward, and a Tier 0 admin signing into a Tier 1 server is a violation regardless of intent.
The Enterprise Access Model published by Microsoft (Microsoft Learn, 2025) recasts the same boundaries as three planes: the control plane (formerly Tier 0), the management plane (Tier 1 and 2 administration), and the data and workload planes (the systems being administered). The model adds explicit categories for cloud-only privileged access, user access, and application identity. For most Australian on-premises and hybrid organisations the practical effect is unchanged. Control plane equals Tier 0, and the same separation rules apply.
What did change in 2026 is the population of Tier 0 assets. The control plane now includes:
- On-premises domain controllers and the Active Directory schema
- Certificate authorities issuing certificates that AD or Entra trust
- AD Connect (formerly Azure AD Connect) servers and the AD Connect service account
- ADFS servers if still present
- Microsoft Entra ID Global Administrators, Privileged Authentication Administrators, and any role that can change Conditional Access policies
- Privileged access workstations used to administer any of the above
- Backup servers and immutable backup storage for AD System State
Australian organisations holding a tier-0 declaration without these additions are operating against the 2024 model on a 2026 attack surface.
Essential Eight ML2 controls that land on Tier 0
Five Essential Eight controls touch Tier 0 directly. The ASD Essential Eight Maturity Model (2025) and ASD Restricting Administrative Privileges guidance set the prescriptive bar (cyber.gov.au — Restricting Administrative Privileges, accessed 16 June 2026); the ASD ISM provides the underlying control IDs (cyber.gov.au — Information Security Manual, accessed 16 June 2026).
Restrict Administrative Privileges (Essential Eight Control 5)
At ML2, privileged accounts must be dedicated (no internet, no email), validated when first issued and annually thereafter, used only from privileged operating environments, and revoked promptly when no longer needed. The tier model defines the privileged operating environment, and ML2 enforces what an administrator can do with it. ASD ISM-1383 makes this explicit at the control-environment level.
Multi-Factor Authentication (Essential Eight Control 7)
At ML2, phishing-resistant MFA is required for privileged users in addition to internet-facing services. Microsoft's Privileged Access Strategy recommends Windows Hello for Business or FIDO2 security keys for Tier 0 administration; SMS and voice-call MFA do not satisfy ML2 for privileged accounts. In hybrid environments, the MFA enforcement point is typically Conditional Access in Entra ID, which means Tier 0 protection of the Entra Conditional Access surface is also in scope.
Regular Backups (Essential Eight Control 8)
ML2 requires daily, coordinated, resilient backups of important data, software, and configuration. Keep at least three months retention, hold offline or immutable copies, and restrict access from non-backup administrators. For Active Directory, important data includes the System State on at least one domain controller per domain and the SYSVOL share. Backups stored on infrastructure that is itself domain-joined fail the resilience requirement, because a compromised domain administrator can delete them.
Application Control (Essential Eight Control 1)
ML2 requires application control enforced on workstations and on internet-facing servers. For Tier 0, application control on the privileged access workstation prevents the most common credential-theft tooling from running even if delivered. Microsoft Defender Application Control with a signed publisher allow-list is the most common Australian implementation.
Patch Operating Systems and Applications (Controls 2 and 6)
Patching domain controllers and ADFS within the ML2 timeframes (forty-eight hours for extreme-risk, fourteen days for high-risk) is non-negotiable. Tier 0 hosts cannot be left on extended patch cycles because they are the highest-value target in the forest.
The recipe — phase by phase
The recipe below assumes a typical Australian mid-market or government-adjacent organisation. It runs on-premises AD, AD Connect to Entra ID, and between two and ten domain controllers. It also has an Essential Eight uplift programme that has not yet reached ML2 on privileged access or backups.
Phase 1 — Declare Tier 0 (week one)
The first phase is paperwork, not technology. Produce a Tier 0 register that lists every asset in the control plane: domain controllers, AD Connect, certificate authorities, ADFS if present, PAW devices, Entra ID Global Administrators and Privileged Role Administrators, and the backup destinations for AD System State. Each entry needs an owner, a host name, and a current administrative account list.
The register is the contract. Everything in it operates under tier-0 rules from this point forward. Everything not in it is not Tier 0 and must not be administered from a tier-0 PAW.
Phase 2 — Separate accounts (weeks two to three)
Every administrator with Tier 0 access gets three accounts: a Tier 2 account for daily work, a Tier 1 account for server administration, and a Tier 0 account for forest administration. The Tier 0 account is not licensed for Microsoft 365, so it cannot send or read email. Enable Privileged Identity Management in Entra ID for the cloud-resident roles, with eligible-rather-than-active assignment and approval required for activation.
ASD ISM-1546 and the ASD Restricting Administrative Privileges guidance both reinforce this separation. The MITRE ATT&CK technique T1078.002 (Valid Accounts — Domain Accounts) is the catalogue of what happens when this separation fails.
Phase 3 — Stand up PAWs (weeks three to five)
Privileged access workstations are dedicated devices used only for Tier 0 administration. Microsoft's PAW guidance recommends a clean-source build using Microsoft Defender Application Control, BitLocker, Credential Guard, and a strict outbound firewall that allows only the required management endpoints. The Australian Government's Information Security Manual (November 2025 release) recognises privileged operating environments at ISM-1383.
A PAW is not a virtual machine on the administrator's laptop. The clean-source principle requires that the device used to administer Tier 0 is at least as trusted as Tier 0 itself.
Phase 4 — Harden the directory (weeks four to six)
In parallel with the PAW build, address the highest-impact directory hardening items. The ACSC Hardening Microsoft Windows 10 and Windows 11 Workstations guidance (current revision, November 2025 ISM bundle) covers the workstation side. Mitigating Pass-the-Hash and Other Credential Theft v2 (Microsoft, 2023 reissue) covers the directory side. The four items that pay back fastest:
- Remove unconstrained Kerberos delegation from every non-domain-controller account. MITRE ATT&CK T1558.001 catalogues the attack tradecraft enabled by unconstrained delegation.
- Deploy Windows LAPS (Microsoft Learn, GA 2023) to rotate local administrator passwords on every domain-joined Windows device. LAPS removes the most common pivot path between Tier 2 hosts.
- Enforce SMB signing on domain controllers and member servers. ASD ISM-1175 makes this a baseline.
- Plan NTLM removal — audit first, block second. ASD ISM-1546 names NTLM as a target for removal.
Phase 5 — Backup resilience (weeks five to seven)
Now that Tier 0 has a coherent boundary, ML2-grade backups are achievable. This pattern satisfies Essential Eight ML2 in 2026 Australian environments:
- Daily System State backup on at least one domain controller per domain.
- Backups written to immutable object storage with retention locks (the typical Australian implementations use Azure Blob immutability policies or AWS S3 Object Lock in compliance mode).
- The backup destination is not joined to the production domain. The backup service account is not a member of any domain group with delete rights on the backup store.
- A documented forest recovery runbook based on the Microsoft AD Forest Recovery Guide (Microsoft Learn, 2025 reviewed).
Phase 6 — Rehearse (weeks eight to ten)
A backup that has not been restored is a hope, not a control. ML2 Control 8 requires restoration testing. For AD, restoration testing means a real forest recovery in a lab environment that mirrors production domain controller count, FSMO placement, DNS topology, and a representative sample of objects and SYSVOL data.
The Semperis Purple Knight 2025 community report observed that under 30% of organisations that hold an AD recovery plan have rehearsed it in the last twelve months. Those that do rehearse recover roughly five times faster under live conditions. The lab rehearsal is the highest-value single activity in the entire programme.
Phase 7 — Krbtgt cadence and golden ticket detection (week eleven onward)
Once Tier 0 is isolated, accounts are separated, PAWs are in production, the directory is hardened, and backups are rehearsed, the residual risk is a golden ticket attack against a compromised krbtgt hash. The krbtgt account requires a double reset at the start of the programme: two resets twenty-four hours apart, which evicts any latent attacker. Run a recurring cadence (every six to twelve months) thereafter.
Detection comes from baseline Kerberos event log review — Event ID 4769 with anomalous lifetime, unexpected service tickets for accounts that should not request them, and unusual encryption types are the classic indicators. MITRE ATT&CK T1558.001 (Golden Ticket) describes the technique; ASD's Restricting Administrative Privileges guidance reinforces krbtgt cadence as a privileged hygiene practice.
What ASD does and does not say about the tier model
The ASD ISM (November 2025) does not adopt Microsoft's Tier 0 terminology, but the controls it mandates assume the same separation. ISM-1383 (privileged operating environments), ISM-1175 (SMB signing), ISM-1546 (NTLM removal and privileged account hygiene), ISM-1511 (regular backups, restored periodically), and the broader privileged access guidance under Restricting Administrative Privileges all map cleanly onto the Microsoft model. Australian government and government-adjacent organisations should plan for both. Cite ISM controls in your audit pack and cite the tier model in your operational runbooks.
The ACSC's Restricting Administrative Privileges guidance (current 2025 revision) is the closest the Australian government publishes to a public AD tier-model recipe. Read it alongside the Microsoft Privileged Access Strategy — the two documents agree on substance and complement each other on terminology.
Where Entra ID fits
For Australian hybrid identity environments, the Tier 0 boundary extends into Entra ID. Several roles can change tenant identity posture: Global Administrator, Privileged Role Administrator, Conditional Access Administrator, Privileged Authentication Administrator, and Security Administrator. These are Tier 0 equivalents and must be administered under tier-0 rules. Privileged Identity Management makes those roles eligible-rather-than-active, and Conditional Access enforces the rules at sign-in. The Entra-side controls do not replace the AD-side tier model. They extend it.
Entra ID is not a backup of Active Directory. Object deletes propagate through AD Connect into Entra (the soft-delete window for Entra users is thirty days). Group policy, the AD schema, ADFS configuration, and certificate authority data live only on-premises. The Essential Eight Control 8 backup requirement applies to the on-premises System State irrespective of how mature the Entra-side resilience is.
A note on tooling — and what to ignore
Three tools surface in almost every Australian AD assessment conversation: Microsoft Defender for Identity, Semperis Directory Services Protector / Purple Knight, and BloodHound (the community edition or its commercial fork). The choice of tool matters less than the discipline of running it. Microsoft Defender for Identity ships with Microsoft 365 E5 and the standalone licence. Semperis sells subscription tooling that some Australian government departments standardise on. BloodHound is the open-source standard for attack-path analysis.
What to ignore: any product or service marketing that promises AD security as a single SKU. The tier model and Essential Eight ML2 controls are organisational practices first and product purchases second. Tooling accelerates the work — it does not substitute for the discipline.
Where to go next
Start with the free Active Directory Security and Resilience Assessment to baseline your fifteen questions across Tier 0, recovery, and hardening. Then work through the four sibling how-to guides:
- Tier 0 isolation in hybrid AD environments — the practical separation walk-through.
- AD backup verification and forest-recovery rehearsal — the lab rehearsal recipe.
- Hybrid AD to Entra cutover walkthrough — the order to retire AD Connect, ADFS, and the last on-premises domain controller.
- Detecting and responding to golden ticket attacks — krbtgt cadence and Kerberos event log baselines.
- Hybrid AD to Entra cutover risk register — the named risks Australian programmes most often miss.
- Active Directory forest recovery runbook — the printable, step-by-step procedure and Essential Eight ML2 evidence template.
Organisations that want a practitioner-led deep dive can book the paid Active Directory Resilience Review — a live-environment review using Microsoft-approved tooling with a 30/60/90-day remediation roadmap.
Sources referenced in this article: ACSC Essential Eight Maturity Model, Restricting Administrative Privileges, Annual Cyber Threat Report 2024-25, and the ASD Information Security Manual (all cyber.gov.au, accessed 16 June 2026). Microsoft Best Practices for Securing Active Directory, Privileged Access Strategy (Enterprise Access Model), Active Directory Forest Recovery Guide, Windows LAPS overview, and Mitigating Pass-the-Hash and Other Credential Theft v2 (Microsoft Learn). MITRE ATT&CK T1003, T1558.001, and T1078.002. Semperis Purple Knight Community Report 2025. IBM X-Force Threat Intelligence Index 2025.
