Enterprise access model: control plane vs management plane vs data/workload plane
Verdict: Lower planes must never control higher planes. Identity systems, including on-premises AD DS, sit in the control plane. Former Tier 1 splits into management plane (enterprise-wide IT) and data/workload plane (per-workload, sometimes business-unit owned).
| Criterion | Control plane | Management plane | Data/workload plane |
|---|---|---|---|
| What it governs | Identity and access control for the whole estate | Enterprise-wide IT infrastructure management | Per-workload administration, sometimes owned by business units |
| Where AD DS sits | AD DS provides centralized authentication, so it belongs here | Not AD DS - AD DS is not general IT infrastructure management | Not AD DS - storing objects does not make it a workload asset |
| Escalation rule | Must never be reachable from management or data/workload planes | Cannot gain standing control over control plane resources | Cannot gain standing control over control plane resources |
Rules
- Enforce strict separation so management and data/workload plane accounts cannot gain standing control over control plane resources like identity systems.
- Split former Tier 1 into a management plane for enterprise-wide IT and a data/workload plane for per-workload administration.
- Treat AD DS as part of the control plane and apply the same protection, monitoring, and privilege hierarchy enforcement as cloud identity systems.
Traps
- Privileged access workstations alone, or network segmentation alone, do not enforce the plane hierarchy against identity-based escalation.
- Consolidating all administrative roles into one broad group violates least privilege and increases blast radius instead of enforcing hierarchy.
- Merging former Tier 1 into the control plane conflates enterprise-wide identity control with per-workload administration, which the model deliberately separates.
- Classifying AD DS as data/workload plane (because it stores objects) or management plane (because domain controllers are managed like IT infrastructure) understates its role as an identity control plane component; deferring AD DS hardening until Entra migration completes leaves it exposed for years.