{"id":1008112,"date":"2026-11-01T22:50:51","date_gmt":"2026-11-01T21:50:51","guid":{"rendered":"https:\/\/www.teal-consulting.de\/2026\/11\/01\/mfa-aktiviert-tier-0-sicher-warum-das-zu-kurz-gedacht-ist-und-scama-hilft\/"},"modified":"2026-11-02T21:29:02","modified_gmt":"2026-11-02T20:29:02","slug":"mfa-enabled-tier-0-secure-why-thats-short-sighted-and-how-scama-helps","status":"publish","type":"post","link":"https:\/\/www.teal-consulting.de\/en\/2026\/11\/01\/mfa-enabled-tier-0-secure-why-thats-short-sighted-and-how-scama-helps\/","title":{"rendered":"MFA enabled, Tier 0 secure? Why that\u2019s short-sighted and how SCAMA helps"},"content":{"rendered":"
[vc_row css_animation=”” row_type=”row” use_row_as_full_screen_section=”no” type=”full_width” angled_section=”no” text_align=”left” background_image_as_pattern=”without_pattern”][vc_column][vc_empty_space height=”30″][vc_row_inner row_type=”row” type=”full_width” text_align=”left” css_animation=””][vc_column_inner][vc_column_text][\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row css_animation=”” row_type=”row” use_row_as_full_screen_section=”no” type=”full_width” angled_section=”no” text_align=”left” background_image_as_pattern=”without_pattern”][vc_column][vc_empty_space height=”50″][vc_row_inner row_type=”row” type=”full_width” text_align=”left” css_animation=””][vc_column_inner][vc_column_text]Multi-factor authentication is a standard today, especially for privileged accounts. While long established in the cloud, on-premises administrators face a much greater challenge. But even strong authentication does not solve every problem<\/u>: What happens when a successfully authenticated administrator subsequently retains far-reaching permissions permanently?<\/p>\n

Especially in Tier 0, securing the login alone is not enough. The assignment of administrative rights must also be part of the security concept. Why the consistent separation of privileged systems and accounts is so critical is explained in detail in our article Data Security Through Tiering: Protection at Every Level<\/a>. In that article, we categorize Tier 0, Tier 1, and Tier 2 and show you why identity systems, domain controllers, and certification authorities in particular require special protection.<\/p>\n

For MFA in the T0 area, we rely on SCAMA<\/strong>, short for Smart Card Authentication Mechanism Assurance<\/strong>. This approach combines certificate-based authentication with dynamic, role-based permission assignment.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row css_animation=”” row_type=”row” use_row_as_full_screen_section=”no” type=”full_width” angled_section=”no” text_align=”left” background_image_as_pattern=”without_pattern”][vc_column][vc_empty_space height=”50″][vc_row_inner row_type=”row” type=”full_width” text_align=”left” css_animation=””][vc_column_inner][vc_column_text]\n

The Actual Risk: Permanent Permissions<\/h2>\n[\/vc_column_text][vc_empty_space height=”20″][vc_column_text]A stolen admin password is dangerous. It becomes even more critical when permanent privileged group memberships are linked to the affected account.<\/p>\n

Traditional MFA initially protects the login process. However, the subsequent authorization often remains untouched: After successful authentication, the account possesses all permanently assigned permissions.<\/p>\n

SCAMA therefore pursues a different approach:<\/p>\n

It is not the account alone that determines admin rights, but the combination of account and successful certificate-based authentication.<\/strong><\/p>\n

The privileged account does not hold the corresponding role permanently. The required permissions are only generated upon logging in with a matching smart card certificate. This decouples administrative permissions from the password.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row css_animation=”” row_type=”row” use_row_as_full_screen_section=”no” type=”full_width” angled_section=”no” text_align=”left” background_image_as_pattern=”without_pattern”][vc_column][vc_empty_space height=”50″][vc_row_inner row_type=”row” type=”full_width” text_align=”left” css_animation=””][vc_column_inner][vc_column_text]\n

How Does SCAMA Work?<\/h3>\n[\/vc_column_text][vc_empty_space height=”20″][vc_column_text]SCAMA is based on standard features of Active Directory Domain Services (AD DS) and Active Directory Certificate Services (AD CS).<\/strong> An issuance policy stored in the certificate is linked to a universal Active Directory group.<\/p>\n

Simplified, the authentication process works as follows:<\/p>\n

    \n
  1. \n
      \n
    1. \n
        \n
      1. The administrator initially has no permanent SCAMA role membership.<\/li>\n
      2. They authenticate using a matching smart card certificate.<\/li>\n
      3. The certificate contains an ID for the required administrative role.<\/li>\n
      4. This ID is assigned to a universal AD group.<\/li>\n
      5. The dynamic group membership is included in the Kerberos ticket or its Privilege Attribute Certificate (PAC).<\/li>\n
      6. The resulting permissions apply within the lifetime of this ticket.<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n

         <\/p>\n

        The underlying mechanism is known as Authentication Mechanism Assurance<\/strong> (AMA). Through this, membership in a security group can be made dependent on a user provably authenticating with a strong authentication method, such as a smart card. A detailed technical breakdown is provided in the article Authentication Mechanism Assurance for Securing Administrative Accounts<\/a>.<\/p>\n

        Authorization therefore depends not only on the identity of the account, but also on the authentication mechanism actually used.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row css_animation=”” row_type=”row” use_row_as_full_screen_section=”no” type=”full_width” angled_section=”no” text_align=”left” background_image_as_pattern=”without_pattern”][vc_column][vc_empty_space height=”50″][vc_row_inner row_type=”row” type=”full_width” text_align=”left” css_animation=””][vc_column_inner][vc_column_text]\n

        SCAMA Combines JIT, JEA, and MFA<\/h2>\n[\/vc_column_text][vc_empty_space height=”20″][vc_column_text]From a security perspective, SCAMA combines two key principles of modern administration.<\/p>\n

        Just-in-Time Administration<\/strong><\/p>\n

        Privileged permissions are not assigned permanently. They are created in the context of certificate-based login and are valid only temporarily within the Kerberos ticket.<\/p>\n

        After the ticket expires, the permissions provided via SCAMA are no longer available. The ticket lifetime should be deliberately adapted to the company’s security and operational concept.<\/p>\n

         <\/p>\n

        Just Enough Administration<\/strong><\/p>\n

        Different administrative roles can be mapped via specific certificates. As a result, administrators do not receive blanket permissions for everything, but only the permissions they require for their respective tasks.<\/p>\n

        \u201cStrong authentication and MFA are indispensable for Tier 0. But it gets really interesting where the method of authentication simultaneously determines whether and for how long administrative permissions are created. Precisely this connection between authentication and authorization makes SCAMA an effective building block for protecting privileged identities.\u201d – <\/em>Fabian B\u00f6hm, Managing Director and Security Architect at TEAL<\/strong>[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row css_animation=”” row_type=”row” use_row_as_full_screen_section=”no” type=”full_width” angled_section=”no” text_align=”left” background_image_as_pattern=”without_pattern”][vc_column][vc_empty_space height=”50″][vc_row_inner row_type=”row” type=”full_width” text_align=”left” css_animation=””][vc_column_inner][vc_column_text]\n

        More Than Traditional Smart Card MFA<\/h2>\n[\/vc_column_text][vc_empty_space height=”20″][vc_column_text]In a traditional smart card login, the focus is usually on securing the login:<\/p>\n

        Smart Card and PIN \u2192 Stronger Authentication<\/strong><\/p>\n

        SCAMA expands this principle:<\/p>\n

        Authentication Mechanism \u2192 Role Information \u2192 Temporary Authorization<\/strong><\/p>\n

        The certificate thus not only verifies the administrator’s identity. Via the ID contained within it, it simultaneously provides the information regarding which administrative role may become active in the current context.<\/p>\n

        The corresponding universal AD groups intentionally remain empty. Their membership is generated exclusively dynamically via SCAMA. Permanent members would bypass this security mechanism.<\/p>\n

        SCAMA goes beyond simply securing the login process. It additionally connects certificate-based authentication with the dynamic assignment of a role.<\/p>\n

         <\/p>\n

        The PKI is Part of the Tier-0 Security Concept<\/h3>\n

        SCAMA is not an isolated configuration within Active Directory. Certificates, issuance policies, and unique Object Identifiers (OIDs) become central components of permission assignment.<\/p>\n

        For a resilient implementation, the following components in particular are required:<\/p>\n