Hiring an Active Directory and Microsoft security expert

In most companies, Active Directory holds the keys to everything: it decides who can access what, on workstations, servers and often the cloud. That is exactly why so many intrusions aim to take control of it. This guide helps you define the role of an Active Directory and Microsoft security expert, recognise the skills that matter and assess candidates on concrete cases.

Why this profile has become strategic

An Active Directory often dates back many years. It has been through migrations, mergers, successive service providers and emergencies fixed "temporarily". The result: service accounts with excessive rights, forgotten delegations, privileged groups with too many members and legacy settings nobody dares to touch.

Attackers know this. Once a first workstation is compromised, finding a path to domain admin rights is one of their priorities. ANSSI, the French national cybersecurity agency, has published dedicated recommendations on Active Directory security and on administering information systems, available on cyber.gouv.fr. They make a good basis for discussion with candidates.

With Entra ID and hybrid environments, the scope grows further: identity synchronisation, conditional access, cloud admin accounts. The expert you are looking for must understand both worlds and the boundary between them.

What an Active Directory security expert does

Responsibilities vary with the maturity of your environment, but they usually include:

Auditing what exists: mapping privileged accounts and groups, delegations, trust relationships and attack paths to the highest privileges.
Building a remediation plan that is realistic, prioritised by risk and compatible with production.
Setting up an administration model: separate admin accounts, administration tiers, dedicated admin workstations.
Hardening the configuration: group policies, legacy authentication protocols to switch off, local admin password management, protection of sensitive accounts.
Securing hybrid: synchronisation with Entra ID, cloud admin accounts, conditional access and strong authentication.
Improving visibility: domain controller logging, events to forward to the SOC, alerts on sensitive changes.
Supporting the teams: training administrators, approving changes, stepping in when an incident affects the directory.

That last point matters. An expert who knows everything but cannot convince operations teams to change their habits will not improve much.

Scoping the role before you hire

"Active Directory expert" covers different realities. Before writing the job ad, decide which of these profiles you need.

Profile	Focus	When to choose it
AD security engineer (defence)	Hardening, administration model, remediation	Your directory is old and has never really been audited
AD auditor or pentester	Attack path discovery, internal penetration tests	You want an independent, recurring assessment
Microsoft identity architect	AD, Entra ID, hybrid, identity strategy	You are moving to the cloud or redesigning access
Security-minded AD administrator	Day-to-day operations with a strong security culture	You first need everyday rigour

These profiles overlap, but their days look very different. A specialised pentester may have no wish to drive an eighteen-month remediation programme. If your main need is offensive assessment, our guide to hiring a penetration tester will serve you better. If the issue is your overall identity strategy, also see our article on hiring a security architect.

Also describe the context: size of the directory, number of domains and forests, share of cloud, whether you have a SOC, managed service providers involved. An experienced candidate will ask these questions in the first conversation.

The skills to check

Deep understanding of the directory

This is the foundation. Without a tool in front of them, the candidate should be able to explain:

how Kerberos and NTLM authentication work, and their known weaknesses;
the different types of delegation and their risks;
permissions on directory objects and how they create attack paths;
the role of group policies and what control over their modification implies;
trust relationships between domains and forests.

Offensive culture

You only defend well what you know how to attack. Without being a pentester, the expert must know the main families of attacks on the directory and recognise them in a real environment. Be wary of candidates who recite tool names without being able to explain what they exploit.

Hybrid and cloud

Depending on your environment, check their knowledge of Entra ID: synchronisation, admin roles, conditional access, break-glass accounts. Compromising a privileged cloud account can be as serious as compromising a domain admin.

Detection

The expert should know which domain controller events deserve an alert and how to pass them to the SOC. They will often work with a detection engineer to turn their knowledge of attacks into reliable rules.

Change management

Switching off a legacy protocol or removing rights from a service account can break a business application. A good candidate measures the impact before acting, tests, communicates and rolls back if needed. Ask how they go about it: the answer says a lot about their maturity.

How to assess a candidate

The practical exercise

The most reliable method remains an exercise in a lab environment, as we explain in our article on assessing skills beyond the CV. A format that works well:

Provide a small, deliberately misconfigured test domain, or an export of its configuration.
Ask the candidate to identify the paths leading to the highest privileges.
Ask them to prioritise fixes and explain, for each one, the risks to production.
End with a detection question: which events would you monitor to spot an attempt to exploit these weaknesses?

Score the approach rather than the speed. A candidate who finds fewer flaws but proposes a realistic remediation plan will often be more useful day to day.

Interview questions

"You arrive at a directory that has never been audited. What do you do in the first week?" Look for method: inventory of privileges, attack path mapping, low-risk quick wins, not a big programme launched blindly.
"How would you explain the tiered administration model to an operations manager?" Look for clarity and concrete arguments, not jargon.
"A service account has very high rights and nobody knows why. How do you proceed?" A good answer covers analysing actual usage, talking to application owners and removing rights gradually.
"What specific risks do you see in a hybrid environment?" The candidate should mention synchronisation, cloud admin accounts and the boundary between the two directories.
"Tell me about an incident or audit that stayed with you." Listen to what they learned, and how they talk about it without disclosing confidential information about former clients or employers.

To compare candidates consistently, use our guide to structuring a technical cyber interview.

Where to find these profiles

Active Directory security experts often come from:

Windows systems administration, with a gradual move into security;
internal penetration testing, for people who want to switch to defence and build over time;
incident response, where the directory sits at the heart of many investigations;
infrastructure security consulting, for people used to audits and remediation plans.

These profiles are in demand and rarely job hunting. A job ad that is precise about the technical context and the real mandate (do you have management backing to change administration practices?) makes a real difference.

Mistakes to avoid

Hiring an administrator and calling them a security expert. If the job is mostly creating accounts and handling tickets, say so, or rethink the scope.
Giving no mandate. Without backing to enforce an administration model, the expert will remain an auditor whose recommendations gather dust.
Ignoring the cloud. A candidate who excels on on-premises AD but does not know Entra ID will leave a blind spot if you run hybrid.
Assessing on certifications alone. They give a reference point, not proof. Our article on what certifications really say explains how to read them.

In short

An Active Directory and Microsoft security expert protects the core of your information system. Define precisely which profile you need (defence, audit, architecture or operations), check real understanding of the directory and of hybrid setups, and assess with a practical exercise that combines attack path discovery with a realistic remediation plan.

Looking for this profile? At Cyber Recrut, a recruiter and a security practitioner scope the role with you and run the search together. Our shortlisted candidates prove their skills on hands-on labs, and you only pay when a hire succeeds. See how we work or share your hiring need.