{"id":99067,"date":"2023-10-04T11:30:00","date_gmt":"2023-10-04T15:30:00","guid":{"rendered":"https:\/\/jumpcloud.com\/?p=99067"},"modified":"2024-12-20T13:45:44","modified_gmt":"2024-12-20T18:45:44","slug":"rethinking-active-directory-domain-trust-for-the-cloud","status":"publish","type":"post","link":"https:\/\/jumpcloud.com\/blog\/rethinking-active-directory-domain-trust-for-the-cloud","title":{"rendered":"Rethinking Active Directory Domain Trust for the Cloud"},"content":{"rendered":"\n

Active Directory\u2019s (AD) trust relationship flows are a familiar concept to many IT admins who are charged with mapping out which authenticated users can access which network resources across domains. Configurations can be complex and trust extends beyond AD to the entire IT infrastructure, your counterparts at the other organizations, and ultimately all<\/em> of its users.<\/p>\n\n\n\n

Modernizing AD means adopting cloud services that have more of a flat organizational structure. Users from other organizations are segmented into groups where external users are granted the appropriate entitlements, their devices are managed by unified endpoint management (UEM), and identity and access management (IAM) enforce memberships. Continuous evaluation takes the place of AD domain and forest trust relationships.<\/p>\n\n\n\n

This article provides an overview of how legacy trust relationships are managed through lifecycle automation and IAM security controls in cloud directories, modernizing AD while reducing risks and infrastructure costs. In turn, identities and devices of all kinds can be challenged before access, aka \u201ctrust,\u201d is granted. It also compares Entra with 探花大神\u2019s open directory and how they\u2019re used to modernize AD.<\/p>\n\n\n\n

Cross-Domain Trusts<\/h2>\n\n\n\n

Active Directory Domain Services (AD DS) interdomain forest trust relationships provide a way for authentications to be trusted across domains. A login on one domain is trusted by another because there are \u201cbonds\u201d between the domains in a forest or tree. This configuration simplifies user and service access to global resources and centralizes administration and security.<\/p>\n\n\n\n

There are many benefits to this hierarchical approach, and it\u2019s understandable that admins who are well acquainted with AD would expect the same from a cloud directory. However, this approach, like AD itself, was intended for a different era in computing<\/a> where networks were the only perimeter versus a cloud directory, which explicitly validates trust for all access requests. <\/p>\n\n\n\n

AD doesn\u2019t take a modern Zero Trust<\/a> approach to security where you \u201cassume breach\u201d and \u201ctrust nothing.\u201d Trust is generally inherent in AD domain trusts. Consider that you not only place trust in a domain, you also trust an entire infrastructure, all of the endpoints, people, and its processes. Let\u2019s explore what AD domain \u201ctrust\u201d actually means from a cybersecurity perspective.<\/p>\n\n\n\n

Trust in IT Infrastructures<\/h3>\n\n\n\n

With AD, you trust a domain\u2019s encryption, network segmentation, and threat protection at the highest level. The full scope of a domain’s network infrastructure includes numerous considerations ranging from endpoints to network configurations to physical security.<\/p>\n\n\n\n

Ask yourself what you\u2019re trusting: <\/p>\n\n\n\n