How to Isolate Tier 0 in a Hybrid Active Directory Environment (Australian Recipe)

The answer in fifty-five words

Isolating Tier 0 in a hybrid Active Directory environment is a sequenced exercise: declare the boundary in writing, issue Tier 0 administrators a dedicated forest-admin account that cannot send or read email, build privileged access workstations on dedicated hardware, and extend Tier 0 rules into Microsoft Entra ID using Privileged Identity Management and Conditional Access. Order matters.

Why Tier 0 isolation has to be deliberate

Tier 0 isolation is the single highest-leverage control in any Active Directory hardening programme. Microsoft's Best Practices for Securing Active Directory (Microsoft Learn, last reviewed 2025) treats it as the foundation on which every other control rests, and the Privileged Access Strategy (Microsoft Learn, 2025 update) expresses the same boundary as the control plane in the Enterprise Access Model. ASD's Restricting Administrative Privileges guidance (ACSC, 2025) and ASD ISM-1383 (privileged operating environments, November 2025 release) (Australian Signals Directorate — Information Security Manual, accessed 16 June 2026) both assume the same separation operationally.

The reason it must be deliberate is that Tier 0 erosion happens by accident. An administrator with a single combined account checks email on their admin workstation; a Tier 0 account is added to a Tier 1 server's local administrators group to fix a problem at 11pm and never removed; a service account with Domain Admin rights is used to run a scheduled task on a Tier 2 host. Each event is small. The aggregate is a forest where attackers cross tiers freely.

Step 1 — Declare the boundary in writing

Produce a Tier 0 register before touching any technology. The register lists every asset, every administrative account, and every owner. Required columns:

• Asset name — the host or service.
• Asset class — domain controller, AD Connect, CA, ADFS, PAW, Entra Global Admin, backup target, and so on.
• Owner — a named individual.
• Administrative accounts — every account with privileged access to the asset.
• Inbound dependencies — what other systems must reach this asset to function.

The register is the contract. Any asset not on it is not Tier 0 and must not be administered from a Tier 0 PAW. Any asset on it operates under Tier 0 rules from this point forward. Review the register quarterly.

Step 2 — Separate accounts

Every Tier 0 administrator gets three accounts:

• Tier 2 account ([email protected]) — daily user account for email, Teams, browser, and standard productivity work. Microsoft 365 licensed.
• Tier 1 account (adm.firstname.lastname) — server administration. No email. No browser. No Microsoft 365 licence.
• Tier 0 account (tier0.firstname.lastname or da.firstname) — forest administration. No email, no browser, no Microsoft 365 licence. Member of Domain Admins or Enterprise Admins only when actively administering. Cloud-side equivalent is a Cloud-only Tier 0 Entra account excluded from sync.

Apply ASD ISM-1546 in spirit: privileged users perform privileged actions only from privileged operating environments. Microsoft's Mitigating Pass-the-Hash and Other Credential Theft v2 (2023 reissue) is the canonical reference for why the accounts must remain separated even within the same person's identity.

Step 3 — Stand up privileged access workstations

A privileged access workstation is a dedicated device used only for Tier 0 administration. The clean-source principle (Microsoft, Securing Privileged Access, 2025) requires that the device used to administer Tier 0 is at least as trusted as Tier 0 itself.

Minimum PAW build for Australian environments:

• Dedicated hardware (no shared use), Windows 11 Enterprise on the current servicing channel.
• Microsoft Defender Application Control in enforced mode with a signed publisher allow-list. Browsing is not enabled.
• BitLocker with TPM and PIN. Credential Guard enabled. LSA Protection enabled (ACSC Hardening Microsoft Windows 10 and Windows 11 Workstations, November 2025 ISM bundle).
• Outbound firewall restricted to the explicit endpoints required for management (Entra ID sign-in endpoints, Azure ARM endpoints, on-premises DC management ports, the configured update source).
• No mailbox. No corporate Outlook profile. No browser cached credentials.
• Joined to a dedicated Tier 0 device management scope in Microsoft Intune, with Conditional Access requiring device compliance and MFA for every sign-in.

A managed Cloud PC dedicated to Tier 0 use, accessed only from another PAW or from a thin-client device, is an acceptable variant. A virtual machine on the administrator's day-to-day laptop is not.

Step 4 — Lock the on-premises tier boundary

Two technical controls enforce the Tier 0 boundary on-premises:

• Authentication policies and authentication policy silos (Microsoft Learn, current) — restrict Tier 0 accounts to sign in only from PAW hosts in the Tier 0 silo. Failed attempts from non-silo hosts are denied at the KDC.
• Logon restrictions in Group Policy — deny logon locally and deny logon through Remote Desktop for Tier 0 accounts on every Tier 1 and Tier 2 host. The denial is symmetric: Tier 1 and Tier 2 accounts are also denied on Tier 0 hosts.

The Microsoft Privileged Access Strategy recommends both. The pair is more robust than either alone — silos handle the Kerberos side, GPO handles the local logon side.

Step 5 — Extend Tier 0 rules into Microsoft Entra ID

For hybrid environments, the Tier 0 boundary extends into the cloud control plane. The minimum cloud-side controls:

• Privileged Identity Management for Global Administrator, Privileged Role Administrator, Privileged Authentication Administrator, Conditional Access Administrator, Security Administrator, and any role that can change tenant identity posture. Eligible-not-active assignment with approval required for activation. Activation requires MFA.
• Conditional Access targeting privileged role activations and Tier 0 sign-ins: require phishing-resistant MFA (Windows Hello for Business or FIDO2 security key), require compliant device (the Tier 0 PAW), block legacy authentication.
• Cloud-only Tier 0 accounts — the most privileged cloud roles should sit on cloud-only accounts excluded from AD Connect synchronisation. If the on-premises AD is compromised, those accounts survive.
• Break-glass accounts — two cloud-only, FIDO2-secured emergency accounts excluded from Conditional Access policies that could lock you out. Stored offline, used only in incidents, monitored for sign-in via Microsoft Sentinel.

ASD ISM and Essential Eight do not yet name PIM directly, but Essential Eight ML2 (Australian Signals Directorate — Essential Eight Maturity Model, accessed 16 June 2026) multi-factor authentication and restrict administrative privileges requirements both land on these controls.

Step 6 — Verify

Verification is the easiest step to skip and the easiest place for the boundary to erode. The verification checks that must run at least monthly:

• A Tier 0 account attempting to sign into a Tier 2 workstation is denied.
• A Tier 2 account attempting to sign into a domain controller is denied.
• Every member of Domain Admins, Enterprise Admins, Schema Admins, and Account Operators is on the Tier 0 register.
• No service account in Domain Admins has interactive logon rights or a password older than the documented rotation cadence.
• Every PAW reports as compliant in Intune and signed in only by Tier 0 accounts.
• Every Tier 0 cloud role activation in the last thirty days has an approval record.

Automated checks via PowerShell and Microsoft Sentinel detection rules carry the load. Manual quarterly attestation by the Tier 0 owner closes the loop.

Common Australian failure modes

Three patterns trip Australian organisations:

1. Service accounts in Domain Admins. A vendor's installation guide says "the service account requires Domain Admin." It rarely does — the requirement is almost always specific delegated permissions. Domain Admin for a service account is a free golden-ticket precursor.
2. Shared PAW for "the team." A PAW used by multiple administrators with a shared local profile is no longer a PAW. Each administrator gets a personal PAW or a personal account on a managed shared PAW pool.
3. Tier 0 backups inside the Tier 0 domain. The AD System State backup written to a server that is itself domain-joined to the protected domain is reachable from any compromised domain admin. Move the backup destination outside the domain trust.

Where to go next

• The pillar guide for context: AD tier model and Essential Eight ML2 recovery.
• Baseline your full posture: the Active Directory Security and Resilience Assessment.
• Practitioner-led deep dive: the paid Active Directory Resilience Review.

Sources cited

• Microsoft. Best Practices for Securing Active Directory. Microsoft Learn, last reviewed 2025.
• Microsoft. Privileged Access Strategy (Enterprise Access Model). Microsoft Learn, 2025 update.
• Microsoft. Securing Privileged Access — Privileged Access Workstations. Microsoft Learn, 2025.
• Microsoft. Mitigating Pass-the-Hash and Other Credential Theft v2. 2023 reissue.
• ACSC. Restricting Administrative Privileges. 2025 revision.
• ACSC. Hardening Microsoft Windows 10 and Windows 11 Workstations. November 2025 ISM bundle.
• ASD. Information Security Manual (ISM-1383, ISM-1546). November 2025 release.
• ASD. Essential Eight Maturity Model. Current 2025 revision.

Sources referenced in this article: ASD Essential Eight Maturity Model, ASD Information Security Manual (ISM), Microsoft Best Practices for Securing Active Directory, Microsoft Privileged Access Strategy (Enterprise Access Model), Microsoft Securing Privileged Access (Privileged Access Workstations), Microsoft Mitigating Pass-the-Hash and Other Credential Theft v2, ACSC Restricting Administrative Privileges, ACSC Hardening Microsoft Windows 10 and Windows 11 Workstations, Microsoft Authentication policies and authentication policy silos.