What is the logic behind Microsoft recommending that creation of "god group" / Tier -0 in their Red Forest model for AD?

Question

Creating a Tier-0, which is basically a "God Group" in Red Forest AD model seems a bit off to me, so I was wondering about its logic.

Answer 1

Tier 0 is where the crown jewels are kept. Specifically, forest and domain administration privileges. If you isolate those activities and accounts that have that level of access to Tier 0, you can isolate use of DA privileged accounts to that forest. Thus, an attacker who compromises a Tier 1 (server) or Tier 2 (workstation) can never harvest DA creds from one of those machines and elevate to that level.

It's a way to limit an attacker's ability to move laterally within the network to some degree, but more importantly to limit their ability to elevate to an account that would allow them to own the entire network.

A more comprehensive overview can be found here: Active Directory administrative tier model if you would like more in-depth information.