Identity resilience glossary
Tier 0 identity infrastructure
Tier 0 identity infrastructure refers to systems, administrative identities, and dependencies that can control the identity foundation on which other access decisions rely. In Microsoft's Active Directory Domain Services tier model, examples include domain controllers and the accounts and supporting systems able to control them. The classification follows effective control, not simply an asset's name or business importance. Microsoft's AD DS tier guidance.
How the models relate
The term needs context. Microsoft's broader Enterprise Access Model expands the older Tier 0 concept into a control plane spanning modern access-control systems. Current guidance also retains the AD DS tier model as a component for protecting Active Directory and closely related dependencies. These are related models with different scopes, not interchangeable labels for every cloud service. Microsoft's Enterprise Access Model.
Illustrative identity example
A server-management account can change software running on a domain controller. That administrative path belongs in the Tier 0 assessment even if the account is not named “Domain Admin.” Reviewing only familiar group names would miss the control the account actually has.
Why it matters
This matters when assigning privileges, protecting administrative workstations, and planning recovery access. A critical business application is not automatically Tier 0 because an outage would be costly. The question is whether it can control the root of trust or the systems that enforce access. Organizations should document that boundary and assess supporting management and recovery dependencies. The UK NCSC's administration-tier guidance explains this impact-based approach.