September 1, 2026September 1, 2026 Descriptions (& some instructions) for the Red Tenant I started this journey on March 30, 2026 with post called Red Tenant intro. It was really short post but I had to do it because of it I started actually studying everything around it.Anyway there was this crappy image and I will now open those layers and descriptions (& instructions).I will also list some license requirements for the setup. Reference architecture Dictionary PAW = Privileged Access Workstation MFA = Multifactor Authentication JIT = Just-in-Time PIM = Privileged Identity Management SIEM = Security Information and Event Management 1. Core design Think of it as two planes: Production / user plane: normal workforce tenant(s), user devices, M365 workloads, Azure subscriptions, Intune-managed end-user fleet. Privileged / red plane: a separate Entra tenant containing privileged identities, admin groups, hardened admin devices, stricter access policies, and monitoring for privileged operations. This follows Microsoft’s enterprise access model and privileged access deployment guidance, even though Microsoft usually describes it as a privileged-access strategy rather than Red Tenant. https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-strategy A simple logical flow: for Admin user-> dedicated admin account in Red Tenant-> hardened PAW -> phishing-resistant MFA-> Conditional Access checks-> JIT elevation via PIM-> access to production tenant admin interfaces / Azure / Intune / on-prem admin paths-> all privileged actions logged to SIEM. Microsoft’s guidance is explicit that meaningful privileged-access protection needs secure accounts, secure devices, and secure interfaces together, not just one of them. https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-deployment 2. Identity layer Inside the red tenant, create: Dedicated cloud-only admin identities for privileged work only. Role-specific admin groups rather than broad Global Admin use. PIM-eligible assignments for admin roles instead of permanent standing access. Emergency access / break-glass accounts with tightly controlled storage and monitoring. Microsoft recommends maintaining emergency access accounts and separately documents how to manage them. Recommended role tiers: Tier 0 / control plane: Global Admin, Privileged Role Admin, Conditional Access Admin, Security Admin, Intune Admin, key Azure root management roles. Tier 1 / platform admin: workload or service-specific roles. Tier 2 / support: helpdesk, device ops, app ops with least privilege. That tiered approach aligns to Microsoft’s privileged access security levels and best-practice guidance for Entra roles. https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-getting-started https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/best-practices https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access 3. Device layer Use dedicated privileged access devices for red-tenant admins: Enrolled into Intune Separate device policy baseline from user laptops No email / general collaboration apps on highest-security admin devices Application allowlisting / restricted browser use Aggressive patching and compliance checks Defender for Endpoint onboarded Microsoft states that privileged access workstations/devices should reduce attack surface and that the highest security level should avoid normal productivity usage and general browsing. https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-devices 4. Access policy layer For red-tenant sign-in and privileged interfaces: Require phishing-resistant MFA where possible Require compliant & managed devices Block legacy authentication Restrict access to admin portals and admin actions through Conditional Access Use authentication strength / interface targeting where appropriate Create dedicated admin access policies separate from end-user policies Microsoft describes Conditional Access as the Zero Trust policy engine and specifically recommends protecting privileged interfaces and blocking legacy auth, while accounting for emergency access scenarios. https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview 5. Elevation and governance layer Use: PIM for Entra roles, Azure roles, and groups Approval and justification for high-risk elevations Time-bound activation windows Access reviews for privileged role eligibility and privileged groups Entitlement management for controlled admin package assignment where useful Microsoft documents PIM as the control for time-based and approval-based admin activation, and access reviews / entitlement management as identity-governance building blocks. https://learn.microsoft.com/en-us/entra/id-governance/entitlement-management-overview https://learn.microsoft.com/en-us/entra/id-governance/access-reviews-overview 6. Monitoring and response layer Send all of the following into SIEM / SOC workflows: Privileged sign-ins Role assignment changes PIM activations Conditional Access failures Break-glass usage Device risk / endpoint detections on admin devices Microsoft’s privileged account operations guidance stresses monitoring privileged accounts and activity as a separate discipline. https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-success-criteria 7. Hybrid / multi-tenant considerations If you also manage: multiple production tenants, Azure subscriptions, Intune environments, on-prem Active Directory then define the admin path explicitly from which red-tenant identity, from which admin device, using which JIT role, to which production scope. This is where many implementations fail, too much trust is left implicit. Microsoft’s enterprise access model and hybrid privileged-access guidance are built around making those trust paths explicit and minimizing broad standing privilege. https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-access-model License / components list Minimum viable license stack Identity and governance Microsoft Entra ID P2 or Microsoft Entra ID Governance Needed for PIM Also supports governance capabilities such as access reviews and entitlement management, depending on SKU Conditional Access capability in Entra Emergency access accounts Microsoft documents that using PIM requires Microsoft Entra ID P2 or Microsoft Entra ID Governance. The current licensing docs also show that Entra Suite includes ID Governance capabilities. Device and endpoint Microsoft Intune Plan 1 Device enrollment Compliance Configuration policies Microsoft Defender for Endpoint Plan 2 Strongly recommended for privileged admin devices Microsoft documents Intune Plan 1 license availability across Microsoft 365 E3/E5, EMS E3/E5 and Business Premium. Defender for Endpoint P2 is available standalone and in several E5-level bundles. Practical bundle options Common bundle patterns: Option A: Lean / focused Entra ID P2 Intune Plan 1 Defender for Endpoint P2 Option B: Enterprise standard Microsoft 365 E5 for admin users/devices Add separate red-tenant licensing only where needed for isolated identities/devices Option C: Governance-heavy Microsoft Entra ID Governance or Entra Suite Intune Plan 1 or Intune Suite Defender for Endpoint P2 Because licensing terms change and bundling differs by agreement, validate your exact entitlement set against your tenant’s commercial agreement before procurement. Microsoft’s current docs are the source of truth for included capabilities. https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-deployment Component list by function Function Microsoft component Privileged identity isolation Separate Microsoft Entra tenant JIT admin elevation Microsoft Entra PIM Admin policy enforcement Conditional Access Admin device management Microsoft Intune Admin device threat protection Microsoft Defender for Endpoint Privileged group / access recertification Access Reviews Controlled assignment / packaging Entitlement Management Emergency access Break-glass accounts Restricted elevation on endpoints Intune Endpoint Privilege Management Remote support for managed endpoints Intune Remote Help Jussi Metso Author is a lifelong IT enthusiast, Microsoft Security MVP and interested in Cloud Security, XDR, SIEM and AI. Motto: Learning is the key for your future. Share on Social Mediaxfacebooklinkedinwhatsapp Discover more from Jussi Metso Subscribe to get the latest posts sent to your email. Type your email… Subscribe IDENTITY_ACCESS #identityaccess#redtenant
IDENTITY_ACCESS Enterprise Access Model (EAM) – part of Red tenant story August 30, 2026August 30, 2026 Privileged access strategy is part of an overall enterprise access control strategy. This enterprise access model shows how privileged access fits into an overall enterprise access model. Read More