IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Privileged access management (PAM)
Priya has just joined the infrastructure team. On day one she gets domain admin rights, on the same laptop she uses for email and the web. One phishing link, and an attacker is close to owning every account in the company. Privileged access management stops one click from becoming total control. Your goal: sort a company into admin tiers and explain how to guard admin access.
- A privileged account can change other identities or reach many systems.
- Tier 0 controls identity for everyone. Never sign in to a lower tier with it.
- Admins use a separate account on a hardened workstation (PAW).
- The best end state: nobody holds admin rights by default.
What counts as "privileged"?
A privileged account can change what other identities may do, or reach many systems or much data at once. Directory admins, cloud admins and root are the obvious ones. Easy to forget: local admins, service accounts, pipelines and backup agents. Break-glass accounts are privileged too (break-glass lesson).
What a PAM program does
PAM (privileged access management) is a set of abilities, not one product. A good program keeps admin passwords in a vault and records admin sessions. It gives admin rights only when needed. This is JIT elevation: rights for one task, held for minutes, then lost automatically.
The strong-room key at a bank branch. A cashier does not carry it in their pocket. The manager signs it out in a register for one job, and it goes back after. A PAM vault does the same for admin passwords.
Admin tiering
Attackers land on an ordinary laptop and climb. A sign-in to a Windows machine leaves reusable credentials in its memory. Anyone with admin rights there can take and replay them (pass-the-hash, from the Kerberos lesson). So if a domain admin signs in to a help-desk laptop, whoever owns that laptop can become a domain admin.
Admin tiering is the answer. Microsoft's tier model sorts every account, machine and tool into three tiers:
- Tier 0 is whatever controls identity for everyone, plus anything that controls that. Examples: domain controllers, the directory-sync server, the PAM vault, and the hypervisor under the domain controllers.
- Tier 1 is business servers and apps, such as a finance database. Its data may be valuable, but it does not control identity.
- Tier 2 is laptops, phones and help-desk accounts.
Two rules give the tiers meaning. Control flows only downward. Nothing in a lower tier may control anything in a higher tier. Credentials never go downward. A Tier 0 account never signs in to a Tier 1 or Tier 2 machine. That is where it would be stolen.
Privileged access workstations
A PAW is a device used only for admin work. It is hardened, and blocked from email and general web browsing. A Tier 0 session starts from a Tier 0 PAW, never from the laptop where you read email.
Admins also use separate accounts. Priya uses her everyday account for email and the web. She uses another account, with phishing-resistant sign-in, only for admin work. An SMS code is not phishing-resistant. A hardware security key is.
The goal: zero standing privilege
Zero standing privilege is the end state. Nobody, human or machine, holds admin rights by default. Every elevation is requested for a task, limited in time and removed automatically. A separate admin account that keeps its rights all the time is good hygiene, but it is not this. It is a direction, not a switch. One planned exception is the sealed break-glass account. It must keep working when everything else is down.
The PAM system is itself Tier 0. A vault with every admin password is what an attacker wants most. Run it on Tier 0 systems. Administer it only from PAWs with phishing-resistant sign-in. And make sure break-glass access does not depend on it.
Zara moves Priya's admin work to a separate account. It signs in with a hardware key, from a Tier 0 PAW. A month later, Priya clicks a phishing email. The attacker gets her inbox, and nothing that can touch a domain controller. PAM and tiering do not prevent the first click. They decide how far it can travel.
Go deeper: The PAM abilities in detail
🔎 Discover
Find every privileged account. Look for forgotten local admins, old service accounts, deployment pipelines, backup agents and old admin-group members.
🔐 Vault & rotate
Shared and machine admin passwords live in a vault and change by themselves, ideally after each use. In the AD and Entra world, Windows LAPS gives each computer its own rotating local admin password. OpenBao can create short-lived database credentials.
📝 Check out
An admin asks for a credential, an approver says yes, and the admin gets it for a fixed time. When the time ends, it is changed.
🎥 Broker & record
With session brokering, the admin connects through a gateway that adds the credential and records the session.
⏱️ Elevate just in time
No admin rights by default. Ask for them for one task, hold them for minutes, then lose them automatically.
🧹 Remove local admin
Everyday users run without admin rights, so malware they start gets less power.
Go deeper: The three tiers, with examples
Two results surprise people. A jump server used to reach domain controllers is Tier 0, whatever network it sits in. And a backup agent with domain-admin rights on every laptop makes every laptop a Tier 0 weak point.
| Tier | What lives there | Examples |
|---|---|---|
| Tier 0 — identity control plane | Whatever controls identity for everyone, plus anything that controls that | Domain controllers, federation servers, the certificate authority, directory-sync servers, and the backup, patching, hypervisor and security agents that manage them |
| Tier 1 — servers & applications | Business servers and the people who run them | Member servers, databases, business apps, server admin accounts |
| Tier 2 — workstations & devices | End-user devices and the people who support them | Laptops, phones, help-desk and device-support accounts |
Microsoft puts it plainly: the keyboard, not the destination, sets the trust level of a session. Behind both rules is the clean source principle. Every security dependency of a system must be at least as trustworthy as the system itself. Keep Tier 0 as small as you can.
Go deeper: Tiering beyond on-site Windows
Tiering is not only for on-site Windows. Microsoft's newer enterprise access model extends it to cloud and mixed estates. Tier 0 grows into the control plane: everything that decides access, cloud identity admins included. Tier 1 splits into a management plane and a data and workload plane. Tier 2 splits into user access and app access. The rule does not change: nothing lower may control anything higher. It also holds for open directories such as FreeIPA or Samba AD. Whoever can administer the directory is Tier 0.
Go deeper: Everyday habits that break tiering
| Everyday habit | Why it breaks tiering | The fix |
|---|---|---|
| A domain admin signs in to a user's laptop to fix a printer | Tier 0 credentials are left on a Tier 2 machine | A Tier 2 help-desk account fixes printers |
| The backup agent runs as a domain admin on every server and laptop | Every machine holds Tier 0 credentials | Separate, least-privileged backup identities for each tier |
| Every laptop shares one local admin password | Owning one laptop means owning them all | A unique, rotating password per machine (for example, Windows LAPS) |
| A server admin browses the web with the admin account | Phishing hits an account that can run servers | A separate admin account, used only from a PAW |
🧪 Interactive lab — enable JavaScript to play with this one.
List ten systems and accounts from your work. Mark each Tier 0, 1 or 2. Whatever controls an item must sit in the same tier or higher. Then read Microsoft's AD DS tier model guidance.