Active Directory is no longer just infrastructure — it is the identity control plane for patient care. This article outlines a pragmatic approach to strengthening identity resilience in NHS Trusts, particularly during mergers, while aligning with CAF compliance expectations and building long-term clinical resilience.
Active Directory Is the Identity Control Plane for Clinical Care
In most NHS Trusts, Active Directory has not been designed — it has accumulated. Clinical urgency, vendor dependencies, legacy systems and successive organisational mergers have shaped environments that are flat, over-permissioned, complex and entirely relied upon. Tiering is rarely enforced. Domain Admin group membership has grown well beyond what operational need justifies. Service accounts carry excessive rights with no documented owner. Multiple domains coexist post-merger without a convergence plan. Devices are managed through GPO and MECM, with identity sitting in a hybrid state that connects on-premises AD to NHS.net Connect in ways that were not always carefully designed.
None of this reflects poor intent. It reflects how NHS digital environments evolve under pressure. But the consequences matter — because Active Directory is not simply infrastructure. It is the identity control plane through which clinical care is accessed, managed and protected. When AD fails, pathology fails. Oncology fails. Emergency department workflows degrade. Imaging and prescribing systems stall. Every clinical application that checks group membership, every workstation that applies policy, every server that requires authentication — all of it flows through Active Directory. Identity architecture, in this context, is patient safety architecture.
The Attack Path: Why Privilege Escalation Is the True Pivot Point
Most serious cyber incidents in healthcare follow a recognisable pattern. Initial access is typically achieved through phishing, an exposed service or compromised credentials. From there, an attacker moves to credential access — password spraying, LSASS dumping, token theft — and then attempts privilege escalation through misconfigured accounts, over-permissioned groups or exposed service account credentials. Lateral movement follows, using RDP, SMB, WMI or Kerberos delegation. The endpoint of this chain, if nothing interrupts it, is domain compromise: a DCSync attack, a Golden Ticket, Domain Admin takeover, and the ability to modify Group Policy and target backup infrastructure at scale.
Privilege escalation is the pivot point in this chain. If an attacker cannot escalate beyond a workstation account, the incident is disruptive but recoverable. If they escalate into the server tier or the domain tier, the incident becomes operationally catastrophic. Active Directory is both the mechanism that enables escalation and the control framework that should prevent it. The architecture of AD — how it is tiered, how privilege is assigned, how accounts are separated — determines which outcome follows a breach.
What Tiered Compromise Actually Looks Like
The practical difference between a contained incident and an estate-wide collapse is best understood through the lens of which tier is compromised.
A workstation-tier compromise — where a clinician's device is breached via phishing and malware executes under a standard user context — is a serious event, but a manageable one. If LAPS is deployed so local admin credentials are unique per device, if no privileged credentials are cached locally, and if tiering is enforced, the incident is constrained to that device. A single rebuild, potential local data exposure, short-term disruption for one user. Clinical effect is minor. This is the kind of incident that security teams are designed to handle.
A server-tier compromise changes the picture significantly. If an attacker escalates using a shared local admin password — one of the most common ransomware techniques — they gain access to the application server layer. Pathology servers become encrypted. Oncology scheduling is disrupted. Manual fallback procedures are activated. Diagnostics are delayed. Clinical staff face increased workload under degraded conditions. The incident is serious and operationally straining, but if Tier 0 boundaries hold, recovery is possible without a full estate rebuild. The organisation survives with damage.
Domain-tier compromise is a different category entirely. A Domain Admin credential exposed, a DCSync attack performed, a Golden Ticket created — at this point the attacker has control of Group Policy, the ability to modify or disable any account in the estate, and access to the backup infrastructure that represents the last line of recovery. The result is estate-wide encryption, multi-site outage, potential abuse of trust relationships between merged organisations, and recovery from bare-metal restore. The clinical consequences reach ED diversion, cancelled procedures, delayed treatment and potentially national-level impact. This is systemic failure.
The difference between a server-tier outage and a domain-wide collapse is not the sophistication of the attacker — it is whether privilege escalation control was in place. That control is Active Directory tiering.
AD Tiering as the Escalation Barrier
Tiering works by creating enforced identity boundaries between administrative tiers. Tier 2 covers user workstations. Tier 1 covers the server and application layer. Tier 0 covers the identity control plane — Domain Controllers, AD Certificate Services, Azure AD Connect, backup infrastructure and hypervisor hosts. When tiering is properly implemented, Tier 0 credentials never authenticate to Tier 1 or Tier 2 systems. Tier 1 credentials never touch workstations. Administrative crossover is technically prevented, not just discouraged by policy.
This architecture directly blocks the escalation pathways that turn manageable incidents into catastrophic ones. An attacker who compromises a workstation cannot reuse credentials to pivot to application servers. An attacker who gains server-tier access cannot reuse those credentials to reach Domain Controllers. The privilege escalation chain breaks. The incident remains constrained to the tier where it began.
This is why tiering is the foundational control — not because it is the most sophisticated, but because it is the most structurally important. Everything else — PAM, session monitoring, identity governance tooling — adds value within a tiered architecture. Without tiering, those tools are governing a system that has no meaningful escalation barriers.
Identity Is the New Perimeter
For many years, NHS security architecture focused heavily on network segmentation: VLAN separation, firewall rules, DMZ boundaries. That investment had genuine value, and continues to. But modern attacks frequently bypass network controls through valid credentials, remote services and hybrid identity tokens. An attacker with stolen credentials does not need to breach a firewall — they authenticate through the front door.
Identity has become the effective perimeter. AD tiering boundaries are the identity equivalent of network segmentation — and in many modern attack scenarios, they are more important. If network segmentation fails but identity tiering holds, escalation can still be blocked at the identity layer. If network segmentation holds but identity tiering fails, escalation succeeds regardless. The two controls are complementary, but identity is now the primary containment layer in most hybrid NHS environments.
Mergers: When Collaboration Removes the Escalation Barrier
NHS mergers create significant identity risk — not because merger is inherently problematic, but because the most operationally convenient mechanism for enabling cross-organisation collaboration is also architecturally dangerous. A full two-way Active Directory trust between two flat, under-hardened domains does not simply add two attack surfaces together. It removes the boundary between them. An escalation path that exists in one Trust becomes accessible from the other.
The merger risk equation is straightforward: Risk = Likelihood × Impact × Exposure Time. During a merger, all three factors increase simultaneously. Likelihood rises because organisational disruption, configuration change and temporary access grants create more opportunity for error and exploitation. Impact increases because two previously separate identity boundaries are now connected — a compromise in one organisation can propagate to the other. Exposure time expands because trust relationships established for operational convenience tend to remain in place long after the immediate need has passed.
Secure collaboration during and after mergers requires architectural discipline. Where trust relationships are necessary, one-way trust is preferable to two-way. Selective authentication should be configured to restrict which accounts can authenticate across the boundary and to which specific systems. Administrative group nesting across domains — a pattern that silently collapses tier boundaries — should be explicitly prohibited. Integration at the application layer, where that is feasible, is safer than domain-level trust for service-specific collaboration. And critically, identity integration should follow clinical sequencing: which services are collaborating first, on what timeline, with what access model, and for how long. Architecture should reflect clinical priorities, not administrative convenience.
Compliance: CAF, DSPT and Architecting for Where the Bar Is Heading
Identity architecture in NHS environments is increasingly a compliance question as well as a security one. The NHS Cyber Assessment Framework is outcome-based and evolving. Its profiles represent minimum expectations, not best practice — and those expectations continue to move upward. NCSC guidance already identifies Active Directory tiering as a specific protective control for AD environments. In that framing, tiering is not aspirational. It is the baseline.
Organisations that are not meeting that baseline face a predictable compliance cycle: each DSPT assessment identifies gaps, remediation effort is applied, and because the underlying architecture has not been properly addressed, equivalent gaps emerge at the next assessment. This is a significantly more expensive way to manage compliance than building to the right standard in the first place. Architecting correctly now reduces future remediation burden — and as CAF profiles develop, the organisations that have invested in proper identity architecture will find that headroom, while those who have not will face increasing pressure to close gaps that compound over time.
The Target State: Entra-Centric Hybrid Identity
On-premises Active Directory will remain present in NHS estates for years. Legacy clinical systems, GPO-dependent devices and deeply embedded integrations mean that a rapid departure from on-prem AD is neither realistic nor necessary. But on-prem AD should not remain the dominant identity control plane indefinitely. The direction of travel is clear, and planning toward it now makes the journey considerably less disruptive.
The target state for most NHS Trusts is a single, hardened, tiered on-premises AD domain — minimised in scope and privilege — synchronised with NHS.net Connect and feeding into Microsoft Entra as the primary identity governance engine. In this model, Conditional Access policies govern authentication across all services. Privileged Identity Management (PIM) is used for all privileged roles, eliminating standing privilege. Devices migrate progressively toward Intune management, reducing dependency on GPO and MECM. Over time, on-premises AD becomes a legacy anchor for systems that genuinely require it, while Entra provides the governance, visibility and control layer that modern hybrid environments demand.
Organisations that begin consolidating toward this target now — removing redundant domains, reducing privilege, implementing tiering — are building toward a manageable destination. Those that continue to operate fragmented, over-permissioned multi-domain estates are making that destination harder and more expensive to reach.
A 90-Day Stabilisation Plan
For Trusts looking to make meaningful progress without large capital outlay, the following sequence is a pragmatic starting point. Most of this is governance and architectural discipline rather than product investment.
- Audit all privileged group memberships — Domain Admins, Enterprise Admins, Schema Admins, Backup Operators — and document the current state
- Set the target membership of Domain Admins to zero and treat any occupant of that group as a formal, documented exception. In legacy Active Directory environments, true zero Domain Admin membership is rarely achievable without breaking things — but setting the policy target to zero is precisely the point. It reframes the question: rather than asking why an account should be removed, it requires a positive justification for why it should exist at all. Break-glass accounts for emergency access should be defined, secured in a sealed process, and audited on use — not left as standing members of the group. The goal is to make Domain Admin membership an exception that requires deliberate action, not a convenience that accumulates quietly
- Define Tier 0 assets and implement administrative account separation with enforced logon restrictions
- Deploy LAPS across all managed endpoints to randomise and isolate local admin credentials
- Deploy Microsoft Entra Password Protection to strengthen on-premises password policy in line with cloud standards
- Harden Azure AD Connect and protect the backup infrastructure that represents the last line of recovery
- Audit and remediate service accounts — remove Domain Admin rights, migrate to gMSA where supported, rotate credentials, assign clear ownership
- Map essential and critical clinical services to their identity dependencies to understand what is at stake tier by tier
- Ensure merger-related identity integration is sequenced against clinical priorities rather than administrative convenience
- Define a long-term domain convergence roadmap if operating in a multi-domain post-merger state
In Summary
Identity architecture in NHS environments underpins clinical capability, operational efficiency, regulatory compliance and national resilience. The question is not whether Active Directory matters — it is whether it has been built to contain the incidents that will inevitably come.
Privilege escalation is the pivot between a workstation rebuild and a domain-wide operational collapse. Tiering is the escalation barrier. In environments where identity has become the effective perimeter — where valid credentials routinely bypass network controls — identity boundaries are at least as critical as network segmentation, and in many attack scenarios, more so.
If Tier 0 holds, the organisation survives an incident and recovers. If Tier 0 falls, the organisation faces bare-metal restoration, multi-site outage and consequences that reach directly into patient care. The architecture of Active Directory determines which of those outcomes follows a breach.
Design it deliberately. Harden it properly. Align it with clinical priorities. Treat identity boundaries as the patient safety controls they are.
