Start with health and dependencies
Domain controllers, replication, DNS, trusts, service accounts, applications, certificates and Group Policy dependencies should be known.
Reduce privilege progressively
Administrative tiering, separate admin accounts, stronger authentication and removal of obsolete protocols can be phased.
Use cloud identity deliberately
Entra ID integration works best when the on-premises directory remains understandable and supportable.
Need help applying this?
AL Group can assess, design, implement and operate the underlying technology rather than stopping at advice.
Talk to an engineer