A few years ago I wrote proudly about an ESAE implementation, the red forest, where a pentester gave up after 45 minutes. Well. Microsoft has since retired ESAE as the recommended approach and the classic tier model has a successor: the enterprise access model.
I´ll admit it stung a little. You spend years explaining Tier 0, Tier 1 and Tier 2 to every customer you meet, and then they change the slides.
But honestly, it makes sense. The old tier model was built for a world where everything lived in Active Directory on-premises. Today the crown jewels are just as likely to be in Azure, in Microsoft 365 or in a SaaS application. The enterprise access model splits things into the control plane, the management plane and the data and workload plane, and it covers the cloud as well as the datacenter. It also puts much more focus on user and application access paths, not only on the admins.
What hasn´t changed is the core idea. Whoever controls the identity system controls everything, so the control plane must be protected harder than anything else. And you never let a less trusted system control a more trusted one.
So if you have a tier model in place, don´t throw it away. It is a very good foundation. Just extend it to the cloud.
The names change. The principle stays.