Managed Red Tenant
Where Architecture Draws the Line
PAWlyzer shows you how exposed your Tier 0 admins are in 60 minutes
It finds the accounts with control plane roles in your Entra tenant, evaluates their privileged activities and devices, and distills both into an Exposure Score. We run the check together with you, it costs nothing, and the findings are yours.
Go to PAWlyzer
This is how it almost always starts
Tuesday afternoon, 4:40 pm. The admin center is open in the left tab, the Global Admin role has been active for twelve minutes because a Conditional Access policy was acting up. In the right tab an invoice arrives from a supplier whose name the admin knows. He clicks, the PDF turns out to be a program, and the attacker now sits on the same device as the most powerful role in the company. He needed no vulnerability and no particular talent for that, only a device that serves two worlds at once.
We know this scene from almost every incident response engagement, in mid-sized companies as much as in large groups, and it has taught us one thing: another alert does not help once the attacker already sits next to the admin. What helps is a boundary that stands before detection and that a click cannot cross.
is what an attacker needs on average from first access to the next system. The record stands at 27 seconds.
of attacks work without malware. The attacker signs in like a colleague, with valid credentials.
of all confirmed breaches ended in ransomware.
devices were wiped at Stryker by a single hijacked admin account in three hours. One account, three hours.
Managed Red Tenant in three parts
Three episodes, none of them two minutes long, in which Jan Geisbauer and Thomas Naunheim explain why separate admin accounts alone are not enough, why a PAW without a tenant of its own is only half the job, and how the Red Tenant combines both into an architecture that survives everyday work.
697 documented ways in. Attackers need one.
MITRE ATT&CK lists 222 techniques and 475 sub-techniques attackers use to escalate privileges and work their way through an environment. That sounds like variety but is routine: first the click, then a foothold, then more rights, then the next system. The Managed Red Tenant cuts this chain at the one place where it becomes dangerous, the boundary to the Tier 0 admin.
Kill chain stages according to MITRE ATT&CK Enterprise. Illustration glueckkanja.
What you get out of it
A Red Tenant is not another product your team has to operate. It is a decision about architecture, and it changes four things at once.
One signal,
no noise
Every legitimate admin access comes from the Red Tenant. Anything else is by definition an attack, and your SOC knows it in the very same second. Nobody sorts false positives anymore, and nobody has to guess at three in the morning whether the Global Admin is really a colleague.
A wall, not a speed bump
If a laptop in the office world falls, the attacker stays there. The PAW on the desk next to it lives in a different tenant as far as he is concerned, and no path leads there. The jump to the admin level is no longer a matter of time but a matter of architecture.
Evidence, not a screenshot
Every change sits versioned, reviewed and approved by you in the repository. When NIS2, ISO 27001 or the auditor ask for evidence, you open the repository instead of collecting screenshots. Compliance happens here on the side, as a by-product of clean work.
Admins who like working with it
Security that annoys people in daily work gets worked around, and by the smartest people in the building. That is why your admins get tools that are faster than any detour. In the end the secure option is the convenient one, and that is the only reason it holds.
Partial separation is no separation.
There are five common answers to a compromised admin workstation, and each solves one piece of the problem. None of them truly isolates administration, because all five run inside the risk zone they are supposed to protect.
What the boundary looks like
The Managed Red Tenant is a dedicated Microsoft Entra tenant, built greenfield, with no dependency on your production tenant and none on ours. Only the privileged identities, their devices and the resources that broker access live there. Your permissions stay with you and are granted through cross-tenant policies, entitlement management and Privileged Identity Management, always just in time and never in advance.
A red identity signs in with FIDO2 only and only from a device the Red Tenant manages, because Conditional Access in your tenant lets nothing else through. Global Secure Access handles the path to on-premises systems without a single public endpoint, and if something is off, Continuous Access Evaluation revokes access within seconds rather than at the next login.
Tenant boundary
- 1Red identity, FIDO2 only
- 2Device from the Red Tenant
- 3Conditional Access checks both
- 4PIM activates the role just in time
- 5Access to your tenant, fully logged
Cross-tenant relationship established once during onboarding. Illustration glueckkanja.
Two device classes, so the separation holds up in daily work
The tier is not defined by the IP address but by the keyboard someone sits at. That is why every plane gets the device that fits it, and none that can do more than necessary.
PAW: dedicated hardware for Tier 0
For Global Admins and everyone who touches the control plane: one device, one person, one job. Whatever has no business on this machine never gets onto it, because application control does not allow it.
- Application control, no local admin
- TPM, Secure Boot, Defender monitoring
- FIDO2 only, web only to admin endpoints
VAW: virtual workstation for Tier 1
For the broad administration of Azure, Microsoft 365 and on-premises: a virtual workstation, reachable from the office device but never part of it. It scales to hundreds of admins without anyone ordering hardware.
- Azure Virtual Desktop in the Red Tenant
- Entra Private Access, no public endpoint
- Identity switch, compliant device, FIDO2
Your way into the Red Tenant
- Parameterization workshopParameterization workshopWe sit down with you and define roles, tiering, personas and processes. Along the way it becomes clear which of your admins need a PAW and for whom a VAW is enough, and usually that means fewer PAWs than everyone expected.
- Built as codeBuilt as codeYour Red Tenant is created from our blueprint, entirely as code: Entra ID, Intune, Conditional Access, device profiles and the cross-tenant relationship to your production tenant, all versioned, all traceable.
- Handover and operationsHandover and operationsYour first Tier 0 admins move in, the rest follow in waves. From then on we run the environment around the clock at a fixed monthly price, and you have one worry less.
Managed as code, with your veto
The Red Tenant is never touched in a portal. Every change, whether a new policy, a new device or a new Microsoft feature, runs through the same five stations, every single time, and it only takes effect once you have approved it.
- 1Change as codeConfiguration, policies and device profiles live versioned in the repository. Every change starts there as a pull request, nowhere else.
- 2Four-eyes reviewA second person on our side reviews the change before it runs anywhere.
- 3Test in stagingThe change first runs in our staging environment before it is even presented to you.
- 4Customer approvalYour approver signs off or rejects. Without this approval nothing happens, not even on our side.
- 5DeploymentThe pipeline rolls the change out to your Red Tenant, logged, traceable, repeatable at any time.
Every change starts from the top, including our own.
That also answers the question every buyer should ask, namely what happens if the provider itself gets compromised. The answer is nothing. No change takes effect without your approval, and we operate your environment from our own Red Tenant under the same rules that apply to yours.
What you bring, what we take care of
A Red Tenant is not something you order on Friday and use on Monday. It is a project with a clear end and, after that, an operation you do not have to carry yourselves. So that nobody gets surprised, here is the honest split.
You bring
- A production tenant you want to protect, several if you like, hybrid with Active Directory if you like
- The PAW hardware for your Tier 0 roles, and we tell you beforehand exactly which devices qualify
- Two or three people on your side who grant approvals and request accounts
- The will to really separate administration from daily work, even if the first weeks feel unfamiliar
We take care of
- Building the Red Tenant from our blueprint, entirely as code
- Hardening, device provisioning and the entire lifecycle of the privileged identities
- Operations around the clock, connected to our CSOC
- Every improvement Microsoft ships, through the same pipeline and with the same approval
Because the entire Red Tenant exists as code, deployment takes very little time, and your first Tier 0 admins work in the Red Tenant long before the rest follow. Operations run at a fixed monthly price, with no surprises on the invoice.
Attack on the control plane
Around 20 pages, three real incidents taken apart step by step, and a clear answer to what an isolated administration environment operated as code looks like in practice. Written for CISOs and IT leadership, and for everyone who has to carry the topic upwards and needs arguments that hold up in front of a board.
- Storm-0501, Storm-2949 and Stryker: three attack chains, three lessons
- Why MFA, EDR and a SOC do not protect the management plane
- From Red Forest to Red Tenant: seven characteristics of the target architecture
- Mapping to NIS2 Article 21, ISO 27001 Annex A and DORA
Who operates the Red Tenant
We operate Red Tenants for DAX-listed enterprises and operators of critical infrastructure, and we manage these environments from our own Red Tenant. The standard we run for you applies to ourselves first.
As a BSI-qualified APT response provider we regularly stand on the other side when a company is already on fire. What we see there flows straight back into the architecture, and that is the reason the Red Tenant looks the way it does.
Managed Dark Tenant
The Red Tenant makes sure a compromised client never becomes a compromised domain. The Managed Dark Tenant answers the second question, namely how you stay operational if it happens anyway: a prepared Microsoft environment that rests during normal operations, is woken by one call to our 24/7 hotline, and gives your crisis team secure communication, workstations and a recovery pipeline for Active Directory within a few hours. One is the wall, the other is the safety net.
Managed Dark TenantThree ways to start. None of them commits you.
Questions we hear in the first conversation
Answered short and honest, and if yours is missing, ask us in the form below.
What is a Red Tenant, and why don't you administer inside the production tenant?
A Red Tenant is a dedicated Microsoft Entra tenant that exists solely for privileged identities and their devices, and the production tenant is administered from there, never from within itself.
The reason is simple: whoever compromises a tenant automatically controls the accounts you would use to repair it. If those accounts live in a different tenant, the path from a compromised user to full control is cut. The name refers to the Red Forest, Microsoft's earlier model of a separate admin forest for Active Directory.
What is the Microsoft Enterprise Access Model, and what belongs in Tier 0, Tier 1 and Tier 2?
The Enterprise Access Model divides your environment into planes: the control plane (Tier 0) holds everything that manages identities and permissions, the management plane (Tier 1) covers servers, applications and workloads, and the user access plane (Tier 2) consists of endpoints and users.
The rule behind it is that a higher plane must never be controllable from a lower one. In Entra ID, Tier 0 therefore includes roles such as Global Administrator, Privileged Role Administrator, Conditional Access Administrator and Intune Administrator, plus Entra Connect and everything that patches, backs up or monitors these systems.
How do you implement a tiering concept in practice, and where do you start?
Ideally with an honest inventory of the control plane, meaning the question of which accounts, groups, service accounts and applications can change identities or permissions today. In most environments that turns out to be far more than anyone expected.
After that you separate accounts per plane, replace permanent assignments with PIM and restrict sign-in to dedicated devices. Our free tiering check shows you graphically where tier boundaries are crossed today, which makes it the fastest way in that we know.
Why aren't PIM and Conditional Access alone enough for privileged access?
Both verify the identity and the circumstances of the sign-in, but neither of them verifies the device the keyboard is attached to.
A successful, strong authentication ends in a token on the endpoint, and if that device is compromised, the token is stolen or the session hijacked even though PIM and Conditional Access have done their job correctly up to that point. The Red Tenant uses both and additionally requires the device itself to come from the isolated environment.
What is a Privileged Access Workstation, and when does it need dedicated hardware?
A Privileged Access Workstation (PAW) is a hardened workstation used exclusively for administrative tasks, meaning no mail and no general browsing, with application control, no local admin and a root of trust through TPM and Secure Boot.
It needs dedicated hardware for all roles with access to the control plane, because the clean keyboard principle applies there: a credential must never touch a device whose trust level is lower than that of the target. For Tier 1 the virtual variant is enough.
PAW or virtual admin workstation: when is the virtual variant enough?
For everything below the control plane. The virtual access workstation (VAW) runs as Azure Virtual Desktop inside the Red Tenant, and you reach it from a compliant office device through Entra Private Access, with identity switch and FIDO2.
It scales without hardware and covers Azure, Microsoft 365 and on-premises, although a residual risk remains because access runs through a Tier 2 device. That is exactly why the control plane stays reserved for the hardware PAW.
Does every admin need a separate workstation?
No, but every admin needs a separate identity and a separate access path, and whether that is a physical PAW or a virtual VAW depends on the plane the person works on.
In practice only a few people hold Tier 0 rights and get a hardware PAW, while the broad majority works through VAWs. That is exactly why the model scales from 5 to 5,000 admins.
What distinguishes a Red Tenant from a PAW in your own tenant?
The difference lies in the trust anchor. A PAW whose account, policies and device management live in the same tenant as the production systems shares their fate, because whoever controls the tenant also controls the Intune policy that hardens the PAW.
The Red Tenant moves account, device and management into a separate tenant that cannot be reached from the production tenant. The PAW stays the same building block, it just stands on a different foundation.
What distinguishes the Red Tenant from Privileged Access Management?
PAM solutions vault credentials and broker sessions, so they secure the credential but not the device it is used from. If the endpoint is compromised, the attacker simply rides along in the brokered session, and Microsoft itself writes that PAM solutions alone do not reliably cover device risk.
The Red Tenant does not replace PAM but complements it: PIM and existing vaults remain usable, only now the access comes from a device outside the risk zone.
What happens if glueckkanja itself gets compromised?
Nothing that would take effect without your approval. Every change to the Red Tenant runs as code through a pipeline and needs sign-off from a customer approver on your side, and emergency access is split so that neither side can act alone.
On top of that, we manage your environment from our own Red Tenant, under the same rules that apply to yours. The veto always stays with the customer.
What does NIS2 require for admin accounts and privileged access?
Article 21(2) names, among other things, access control policies, multi-factor authentication and security in the acquisition, development and maintenance of systems, and Article 20 makes management responsible for overseeing and proving implementation.
In Germany this applies since December 2025 through the BSI Act, in Austria from October 1, 2026 through the NISG 2026. The German BSI IT baseline protection treats the separation of administrative activities as a basic requirement and moving administration into a separate structure as an elevated one. The Red Tenant is the cloud implementation of exactly that, and the versioned repository is your evidence.
Is a tiering concept too complex or too expensive for mid-sized companies?
Too complex to operate yourself it often is, because the expensive part is not the technology but the continuous hardening, maintenance, monitoring and evidence that nobody takes care of on the side.
That is exactly the reason for the managed service: the effort sits with us, where automation and repetition make it manageable, and a Red Tenant for 20 admins is the same code as one for 2,000.
Microsoft retired the Red Forest model. Why a separate admin tenant then?
Microsoft retired ESAE because the model only covered on-premises administrators and was too complex to operate, not because the separation had been ineffective.
The same documentation notes that Microsoft still operates a comparable architecture internally, recommends PAWs for all administrative activities and explicitly names isolation across multiple tenants for resources that need a highly defensive approach. The Red Tenant is the cloud version of that principle, and the operational effort that ESAE failed on sits with the managed service.
We have tiering, PIM and Conditional Access. What does a Red Tenant change?
Tiering defines who may do what, PIM defines when, and Conditional Access defines under which conditions. All three, however, live in the same environment they are meant to protect and are managed by roles an attacker with Global Admin rights also holds.
The Red Tenant takes administration out of that environment, your existing controls stay in place and get a trust anchor that can no longer be reached from inside.
content.security.managedRedTenant.blog.headline
No Malware Needed. Just One Admin Account.
On March 11, 2026, Handala wiped devices across 79 countries using nothing but a compromised Intune admin account. No malware, ...
Global Secure Access Unlocked
This blog explores how Microsoft Global Secure Access enhances security and control in our Managed Red Tenant. With Entra Internet ...
