Identity is now the primary vector for compromise, and yet few organizations know just how many paths actually lead to their most sensitive accounts. Forgotten delegations, nested groups, overprivileged service accounts, misconfigured certificate templates, and synchronization between Active Directory and Entra ID. Drawing on real-world cases encountered with our clients, this session demonstrates how an account with no special privileges—such as an intern’s account—can, in just a few steps, become a domain or cloud tenant administrator. It also explains why these paths elude traditional security tools. We’ll conclude with a demonstration: mapping these attack paths, identifying critical points, and implementing concrete remediation measures. Open to everyone, from CISOs to system administrators.