Enterprise Identity Dominance

Adversaries may obtain and abuse credentials of highly privileged Active Directory Domain Services domain accounts, such as Domain Admin or Enterprise Admin, to gain access to systems and maintain persistence within the domain. This describes domain-account credential abuse; Microsoft Entra cloud-account role or credential changes, directory ACL modifications, and certificate or federation persistence are separate procedure types.