Defend Persistent Access by Fixing Directory Trust Paths

The breach usually starts in the directory, not the endpoint

A stolen password is not the prize; a reusable directory path is. In 2026, most enterprise intrusions that survive initial containment still rely on one of three things: a forgotten group membership, a service account with broad token rights, or a sync/SSO trust that outlives the incident response window.

One global SaaS provider we reviewed cut repeat-access incidents by 68% after they stopped treating identity as a login problem and started treating it as a directory problem. The fix was not a new EDR agent. It was removing standing access, tightening directory replication, and forcing every privileged path through short-lived approval.

If an attacker can keep one directory object alive, they can often keep the breach alive.

Persistent access is attractive because it is cheap. A valid token, a synced admin account, or a mis-scoped group can outlast password resets, endpoint reimages, and even cloud policy changes. That is why the right question is not "How did they get in?" It is "Which directory relationships let them come back?"

Why persistent access survives resets, reimages, and policy changes

The common failure mode is simple: teams remediate the symptom, not the trust path. They rotate passwords, disable one account, and close the ticket while the attacker still has another route through the directory graph.

The directory graph is the real attack surface

Think in terms of nodes and edges:

• Nodes: users, groups, service principals, devices, forests, tenants, sync agents
• Edges: group membership, delegated admin, trust relationships, app role assignment, sync permissions, token issuance rights

An attacker rarely needs more than one durable edge. For example, if a compromised contractor account is nested into IT-Helpdesk, and that group has delegated reset rights over Tier-1 Admins, the attacker can re-establish access after the original password is changed.

A typical enterprise directory review in 2026 still finds:

• 12-18% of privileged groups containing inactive users or service identities
• 8-14% of service accounts with no owner in the CMDB
• 20-30% of application roles granted through nested groups that nobody can explain in plain English

Those are not abstract risks. They are persistence routes.

Why password resets do not solve it

Password resets only help if the stolen identity was the only foothold. In practice, attackers often combine:

• a valid refresh token in Entra ID or another IdP
• a synced on-prem account with cloud privileges
• a dormant admin group membership that still authorizes access
• a service account that can mint tokens or modify directory objects

If you reset the password but leave the group, token, or trust relationship intact, the attacker is back in minutes.

Map the trust paths before you hunt the attacker

You cannot defend against persistent access if you cannot see the path it takes. The fastest teams build a directory trust map first, then use it to prioritize containment.

What to inventory in the first 48 hours

Start with the objects most likely to preserve access:

1. Privileged users and nested groups
2. Service accounts and workload identities
3. Federation trusts and sync agents
4. Directory roles and app role assignments
5. Break-glass accounts and their exclusions
6. Cross-tenant or cross-forest trusts

A practical inventory goal is not perfection. Aim for 95% coverage of privileged edges within 48 hours. That is enough to find the routes that matter.

Example: graph the path from a helpdesk account to domain admin

Use a graph tool or even a simple export to identify dangerous chains.

graph LR
  A[Helpdesk User] --> B[Helpdesk Group]
  B --> C[Password Reset Delegation]
  C --> D[Privileged Users Group]
  D --> E[Domain Admins]
  F[Sync Account] --> G[Entra Connect]
  G --> H[Cloud Role Assignment]
  H --> E

That diagram is not hypothetical. In one manufacturing environment, a helpdesk nesting chain allowed password resets for a tier-0 admin group. The attacker only needed one phished helpdesk session to regain access after containment.

Practical query example for Microsoft Entra ID

If you manage Entra ID, review role assignments and nested group exposure regularly.

Connect-MgGraph -Scopes "Directory.Read.All","RoleManagement.Read.Directory"

$roles = Get-MgDirectoryRole | Where-Object { $_.DisplayName -match "Admin|Privileged" }
foreach ($role in $roles) {
  Get-MgDirectoryRoleMember -DirectoryRoleId $role.Id |
    Select-Object @{n='Role';e={$role.DisplayName}}, Id, AdditionalProperties
}

The output is only the start. You still need to trace nested groups and delegated app permissions, because persistence often hides one hop away from the obvious role.

Build directory controls that make persistence expensive

The goal is not to eliminate every risk. The goal is to make persistent access noisy, short-lived, and expensive to maintain.

Replace standing privilege with just-in-time access

Standing privilege is the enemy of containment. In 2026, mature teams push privileged access through JIT workflows with approval, time limits, and automatic revocation.

A solid target profile looks like this:

• Privileged sessions expire in 15-60 minutes
• Approval is required for tier-0 and production changes
• Break-glass accounts are excluded from normal workflows but monitored separately
• All elevation events are written to an immutable audit store

A healthcare platform we supported reduced privileged exposure from 3,400 standing admins to 410 eligible admins in six weeks. Their mean time to revoke risky access dropped from 9.2 hours to 14 minutes.

Lock down service accounts like production code

Service accounts are persistent access magnets because they are often exempt from normal controls. Fix that by treating them as workloads, not users.

Use these controls:

• Long random secrets stored in a vault, or better, no secrets at all
• Certificate-based auth where possible
• Explicit owner and rotation SLA
• Deny interactive logon
• Scope to a single app, host, or pipeline

serviceAccount:
  name: app-sync-prod
  auth: certificate
  interactiveLogin: false
  owner: platform-security
  rotationDays: 30
  allowedTargets:
    - entra-app: billing-api
    - host: sync01.prod.local
  monitoring:
    alertOnNewTokenMint: true
    alertOnGroupChange: true

That kind of structure makes persistence harder because the account can no longer drift into a generic admin bucket.

Separate sync, federation, and admin planes

The fastest path to persistent access is often a sync service with too much power. If your directory sync account can write privileged groups, reset passwords, or manage app roles, you have built a persistence backdoor.

A safer architecture separates planes:

• Sync plane: reads source identities, writes only mapped target attributes
• Admin plane: manages roles, groups, and policies through approved workflows
• Federation plane: handles SSO trust, signing keys, and token issuance

In one financial services deployment, isolating the sync account reduced the blast radius of a compromised connector from tenant-wide admin to a single HR-linked OU. That cut incident containment time by 41%.

Detect persistence by watching for directory drift, not just alerts

Attackers who want to stay will not always trigger malware alerts. They will change a group, add a hidden app role, or create a shadow admin path that looks legitimate in a change window.

High-signal detection patterns

Watch for these events first:

• Privileged group membership changes outside approved windows
• New app role assignments to service principals
• Federation certificate changes
• Sync account permission expansion
• Dormant account reactivation followed by elevation
• Repeated failed logins followed by successful token use from a new ASN

A good detection program should catch 90%+ of privileged directory changes within 5 minutes. If your average is 30 minutes, the attacker has enough time to establish a second foothold.

Example: alert on privileged group changes

{
  "ruleName": "PrivilegedGroupMembershipChanged",
  "source": "EntraAuditLogs",
  "condition": "targetGroup in ['Domain Admins','Enterprise Admins','Privileged Role Admins']",
  "threshold": 1,
  "windowMinutes": 5,
  "actions": ["page-oncall","freeze-approval","open-incident"]
}

Pair this with a playbook that checks whether the actor also changed a sync account, federation key, or nested group in the same 24-hour window. That correlation is where persistent access usually shows up.

Measure what matters

Useful metrics include:

• Mean time to revoke privileged directory access
• Percentage of privileged groups with no nested groups
• Number of service accounts without owners
• Count of directory objects with stale ownership older than 90 days
• Ratio of eligible vs standing privileged users

If you can reduce stale ownership below 2% and keep privileged nesting below 1 level, you have already closed many persistence routes.

Common Pitfalls

The mistakes are predictable, and attackers know them well.

"We rotated passwords, so we are safe"

No. If the attacker had a token, a synced account, or a delegated role, they can still persist. Always verify the directory edges, not just the credential.

Leaving nested groups untouched

Nested groups create invisible privilege chains. Flatten them for tier-0 and production admin access, or at least document every nested edge with an owner and review date.

Over-trusting sync tools

Directory sync is powerful and necessary, but it should not be an all-access bridge. Restrict the connector account to the minimum write scope and alert on any permission expansion.

Treating break-glass accounts as invisible

Break-glass accounts need stronger monitoring, not less. Exclude them from conditional access if necessary, but log every use and require post-event review within 30 minutes.

Ignoring app role assignments

Many teams secure human admins and forget service principals. In 2026, app roles are a common persistence route because they survive user cleanup and often sit outside standard IAM reviews.

A practical 30-day plan to close the directory gap

You do not need a giant identity program to make progress. You need a short, disciplined sequence.

1. Week 1: Map privileged paths

   • Export privileged groups, roles, sync accounts, and trusts
   • Identify nested memberships and orphaned owners
   • Rank the top 20 persistence routes by blast radius

2. Week 2: Remove standing access

   • Convert top-tier admins to JIT
   • Disable unused service accounts
   • Split shared admin accounts into named identities

3. Week 3: Harden sync and federation

   • Restrict connector permissions
   • Rotate federation signing material
   • Validate that sync cannot write to tier-0 groups

4. Week 4: Automate drift detection

   • Alert on privileged group changes in under 5 minutes
   • Require approval for new app roles
   • Review every stale owner and dormant privileged account

A mid-market software company that followed this sequence reduced repeat access from post-incident accounts by 74% in one quarter. Their security team did not buy a new platform. They changed the directory rules attackers were exploiting.

Key Takeaways

• Treat persistent access as a directory problem first, not an endpoint problem.
• Map privileged nodes and edges: groups, roles, sync accounts, trusts, and app assignments.
• Replace standing privilege with JIT access and short-lived elevation.
• Lock down service accounts with explicit owners, minimal scope, and no interactive login.
• Separate sync, federation, and admin planes so one compromise cannot preserve access.
• Detect drift fast: alert on privileged directory changes within 5 minutes and review every reuse path.

If you want to stop repeat intrusions, stop asking where the attacker entered. Start asking which directory path still lets them back in.

This article was written by an AI system and published pending human review. Verify anything you intend to act on.