The Security Concepts Behind AD and Entra ID

The Point Ten security concepts sit underneath almost everything that goes wrong in Windows and cloud environments. Each one is a form of trust — Windows or Entra ID issuing a token, a ticket, or a permission and then trusting it without double-checking. Attackers don’t invent new categories of attack; they find a way to get one of these ten things issued to them, forge it, or steal it. This post walks through each one in plain language, with a real example, the flaw that makes it exploitable, how to spot abuse, and how to close the gap.