Assumed Breach methodology

MS functionalities change slowly esp. for on prem AD

They prioritize azure ad (entra id) more