{"id":3185,"date":"2026-08-07T23:38:11","date_gmt":"2026-08-07T20:38:11","guid":{"rendered":"https:\/\/www.jussimetso.com\/?p=3185"},"modified":"2026-08-07T23:38:13","modified_gmt":"2026-08-07T20:38:13","slug":"red-forest-the-predecessor-of-eam","status":"publish","type":"post","link":"https:\/\/www.jussimetso.com\/index.php\/2026\/08\/07\/red-forest-the-predecessor-of-eam\/","title":{"rendered":"Red Forest: The predecessor of EAM"},"content":{"rendered":"
<\/div>\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The second part of my red tenant study comes now.\u00a0<\/p>

In my first part<\/span><\/a>, kind of mockup intro to the Red Tenant concept introduced some core ideas in title level what are included in the model.<\/p>

In practice, a \u201cRed Tenant\u201d usually means an isolated admin control plane<\/strong>. The common components are: a dedicated Entra tenant for admin identities, separate admin accounts from normal user accounts, hardened admin devices\/PAWs, strict Conditional Access, just-in-time role activation through Microsoft Entra PIM, monitoring\/auditing for privileged actions, and controlled ways to manage production tenants or on-prem AD without letting compromise in the normal estate spread into the admin estate. That matches both the public vendor (which is glueckkanja ) descriptions and Microsoft\u2019s privileged-access guidance.<\/p>

Before going in the modern way to do it let’s look at the history where it began.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

The predecessor of them all - the ESAE<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
ESAE,\u00a0 the Enhanced Security Administrative Environment<\/b><\/span><\/a>, universally nicknamed the “Red Forest<\/strong>”\u00a0 was Microsoft’s reference architecture from roughly the mid-2010s for protecting the most powerful credentials in an Active Directory environment.<\/div>
\u00a0<\/div>
It’s the direct ancestor of the tiering and isolated-admin ideas from the earlier background, so it’s worth understanding what it actually did.\u00a0 The core insight behind it is that in Active Directory, the\u00a0forest<\/i> <\/strong>not the domain is the real security boundary.<\/div>
\u00a0<\/div>
A compromised domain can be used to pivot to other domains in the same forest, but crossing a forest boundary is much harder. ESAE exploited this by standing up a dedicated administrative forest<\/b>, separate from the production forest where users, servers, and workloads lived. That admin forest was where the Tier 0<\/strong> privileged accounts and the workstations used to administer production actually resided. It was deliberately tiny and hardened: very few accounts, no email, no internet browsing, strict baselines, minimal attack surface.<\/div>
\u00a0<\/div>
The two forests were connected by a\u00a0one-way trust<\/b>: production trusted the admin forest, but the admin forest did\u00a0not<\/i>\u00a0<\/strong>trust production. This is the whole point. Even if an attacker fully owned the production forest, they still couldn’t reach into the red forest to steal the admin credentials that governed everything, the trust simply didn’t flow that direction. The admin forest was often paired with Microsoft Identity Manager’s PAM feature to provide time-bound, just-in-time membership in privileged groups, so even within the red forest, standing privilege was limited. It sat alongside the tier model and Privileged Access Workstations as a package.<\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

The reasons for the retirement<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\"The\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t
Copyright Jussi Metso - a two forest environment<\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Microsoft\u00a0retired the ESAE guidance around 2020\u20132021, and the reasons are instructive because they explain why the modern models look the way they do.<\/div>
\u00a0<\/div>
First, it was expensive and complex. Standing up and maintaining an entire second forest, the trust, MIM (Microsoft Identity Manager), and the operational discipline around it was a heavy lift, and many organizations deployed it partially or misconfigured it,\u00a0 which produced a false sense of security rather than real protection. It had a tendency to become a checkbox that let teams neglect broader hygiene like patching, attack-surface reduction, and privileged access management everywhere else.<\/div>
\u00a0<\/div>
Second, and more fundamentally, the world moved to hybrid and cloud. ESAE was intensely AD-centric, built for a time when on-prem Active Directory was the center of gravity. Once Entra ID, SaaS, and cloud workloads became business-critical, isolating just the on-prem AD admin forest was solving yesterday’s problem while leaving the cloud identity attack surface unaddressed. A hardened red forest does nothing for a compromised cloud admin.<\/div>
\u00a0<\/div>
Microsoft replaced it with the modern\u00a0Enterprise Access Model<\/b> (EAM<\/strong>) and a rapid modernization plan for privileged access, built on Zero Trust principles: just-in-time privilege through Entra PIM, hardened PAWs, and Conditional Access gating everything on device and risk signals,\u00a0 securing identity holistically across cloud and on-prem rather than walling off one forest.<\/div>
\u00a0<\/div>
ESAE wasn’t declared wrong, exactly; it was narrowed to a very small set of genuinely isolated on-prem scenarios (think air-gapped OT environments) and dropped as general guidance for everyone else.<\/div>
\u00a0<\/div>
So the through-line is: the red forest’s containment instinct was correct and survives in EAM and isolated admin tenants, but the mechanism, a separate on-prem forest with a one-way trust, was too costly, too easily botched, and too on-prem bound for a cloud world. The newer models keep the principle and swap the machinery.<\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

If you still have ESAE - Guidance for existing deployments<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The next chapters are quotes from Microsoft Learn<\/span><\/a>:<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t

\n\t\t\t\tthere's no urgency to retire or replace an ESAE implementation if it's being operated as designed and intended. As with any enterprise systems, you should maintain the software in it by applying security updates and ensuring software is within support lifecycle.\t\t\t<\/p>\n\t\t\t\t\t<\/blockquote>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t

\n\t\t\t\tadopt the modern privileged access strategy using the rapid modernization plan (RAMP) guidance. This guidance complements an existing ESAE implementation and provides appropriate security for roles not already protected by ESAE including Microsoft Entra administrators, sensitive business users, and standard enterprise users.\t\t\t<\/p>\n\t\t\t\t\t<\/blockquote>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

Links to consider<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Guidance for Existing Deployments<\/span><\/a><\/p>

Best Practice for Securing on-premises AD<\/span><\/a><\/p>

Privileged Access Strategy<\/span><\/a><\/p>

Rapid modernization plan (RAMP)<\/span><\/a><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

This was the history part. The next one is the modern part. At least part number one. The EAM model, some explanations of MIM PAM (Privileged Access Management) vs Entra ID PIM (Privileged Identity Management). Also where I started the “Red tenant” reference architecture at least in short.<\/p>

There’s so much stuff around these so I’ll try to be strict and not spread the idea too much. Let’s see how I can manage this.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\"Picture\n\t\t\t\t<\/div>\n\t\t\t\n\t\t\t
\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\tJussi Metso\t\t\t\t\t\t<\/h6>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t

Author is a lifelong IT enthusiast, Microsoft Security MVP and interested in Cloud Security, XDR, SIEM and AI. Motto: Learning is the key for your future. <\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

In the on-premises Active Directory world, Microsoft used to recommend the Enhanced Security Administrative Environment \u2014 a dedicated, hardened AD forest used only for administering your production forest<\/p>\n","protected":false},"author":1,"featured_media":3201,"comment_status":"open","ping_status":"open","sticky":false,"template":"elementor_theme","format":"standard","meta":{"advanced_seo_description":"ESAE - The Enhanced Security Administrative Environment","jetpack_seo_html_title":"A concept of Red Forest","jetpack_seo_noindex":false,"jetpack_seo_schema_type":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[71],"tags":[68,69,70],"class_list":["post-3185","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-red","tag-activedirectory","tag-redforest","tag-redtenant"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/www.jussimetso.com\/wp-content\/uploads\/2026\/08\/redt_redforest_blogtitle.png?fit=736%2C444&ssl=1","jetpack_shortlink":"https:\/\/wp.me\/pes24X-Pn","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.jussimetso.com\/index.php\/wp-json\/wp\/v2\/posts\/3185","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.jussimetso.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.jussimetso.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.jussimetso.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.jussimetso.com\/index.php\/wp-json\/wp\/v2\/comments?post=3185"}],"version-history":[{"count":14,"href":"https:\/\/www.jussimetso.com\/index.php\/wp-json\/wp\/v2\/posts\/3185\/revisions"}],"predecessor-version":[{"id":3202,"href":"https:\/\/www.jussimetso.com\/index.php\/wp-json\/wp\/v2\/posts\/3185\/revisions\/3202"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.jussimetso.com\/index.php\/wp-json\/wp\/v2\/media\/3201"}],"wp:attachment":[{"href":"https:\/\/www.jussimetso.com\/index.php\/wp-json\/wp\/v2\/media?parent=3185"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.jussimetso.com\/index.php\/wp-json\/wp\/v2\/categories?post=3185"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.jussimetso.com\/index.php\/wp-json\/wp\/v2\/tags?post=3185"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}