Accenture’s identity consolidation shows how authentication scales

At a glance

What this is: This is a customer-of-the-year case study showing how Accenture centralized authentication across many acquired Active Directory environments while cutting highly privileged admin accounts.

Why it matters: It matters because acquisition-heavy organisations need identity integration patterns that preserve trust, reduce privilege sprawl, and avoid delaying business integration for months.

By the numbers:

• Accenture deployed centralized phishing-resistant MFA to 2,000 end users across multiple AD environments.
• Accenture reduced highly privileged AD admin accounts by about 50%.

Context

Acquisition-heavy identity programmes fail when each newly acquired environment keeps its own authentication model, privileged accounts, and migration timeline. In this case, the primary issue is not technology novelty but how quickly a corporate identity standard can be imposed across hundreds of Active Directory estates without breaking operations.

For IAM teams, the identity consolidation challenge sits at the intersection of federation, privileged access, and lifecycle governance. The article shows that when mergers and acquisitions compress integration windows, authentication becomes a business continuity control rather than a back-office task.

The source frames Accenture’s pace of acquisition as unusually demanding, but the underlying governance problem is common anywhere growth produces multiple directory silos. The difference is scale and speed, not category of risk.

Key questions

Q: How should security teams govern identity across acquired Active Directory environments?

A: They should standardise authentication and administrative control before expecting full technical consolidation. Mixed environments usually persist for months or years after acquisition, so the immediate priority is a consistent assurance level, clear privileged account ownership, and one governance view across all inherited directories.

Q: Why do acquired directories create more identity risk than a single clean environment?

A: Each inherited directory brings its own policies, admin accounts, exceptions, and migration delays. That combination creates authentication drift and privileged account sprawl, which makes governance harder and enlarges the set of identities an attacker could abuse. The risk is not the directory alone, but the number of local trust decisions it preserves.

Q: What breaks when privileged AD accounts are left untouched during acquisition integration?

A: The control plane stays fragmented. Privileged accounts can keep altering groups, policies, and trust relationships long after the business says the acquisition is integrated, which undermines visibility and increases the attack surface. If those accounts are not rationalized, identity consolidation becomes cosmetic instead of governing the real risk.

Q: When should organisations prioritize phishing-resistant MFA in merger integration plans?

A: Prioritize it immediately when newly acquired users must be onboarded before full directory migration is complete. That is the point where password reuse, inconsistent local controls, and weak verification create the most risk. Stronger authentication should come before comfort with temporary exceptions hardens into a permanent operating model.

Technical breakdown

Why distributed Active Directory environments create authentication drift

When an organisation absorbs many companies quickly, each inherited Active Directory environment may carry its own password policy, MFA pattern, smart card estate, and administrative model. That creates authentication drift, where the enterprise has policy intent but not uniform enforcement. Identity consolidation is difficult because directories are not just directories; they encode local trust decisions, admin delegation, and operational exceptions. If migration waits for a perfect long-term cutover, the inherited environment keeps accumulating risk. The practical challenge is to standardise verification before every directory has been remediated.

Practical implication: treat heterogeneous AD estates as an active governance risk and prioritise a common authentication standard early.

How phishing-resistant MFA changes the integration problem

Phishing-resistant MFA reduces credential replay risk because the authenticator is bound to the legitimate user session rather than to a reusable secret that can be phished and reused. In acquisition scenarios, the value is not just stronger login security. It is the ability to impose one verification pattern across multiple environments while migration work is still underway. That lowers the chance that a newly acquired population becomes the weak link during integration. It also helps security teams stop treating local directory differences as a reason to delay stronger controls.

Practical implication: use phishing-resistant authentication as the interim standard when directory migration cannot finish on day one.

Why privileged account reduction matters more than directory count

Privileged AD accounts are the real control plane inside many enterprises because they can alter policies, groups, and trust relationships. Cutting their number by about half reduces the number of high-value identities attackers can target and simplifies monitoring, certification, and incident response. The key point is that privilege sprawl often persists after authentication is improved, so a stronger login layer alone does not finish the job. Governance value comes from reducing the number of accounts that can change the identity fabric itself.

Practical implication: pair authentication consolidation with privileged account rationalisation so the control plane shrinks, not just the login surface.

Threat narrative

Attacker objective: The attacker wants durable control over inherited identity infrastructure so a single compromise can scale across multiple acquired environments.

1. Entry occurs through disparate acquired environments that retain their own authentication standards and administrative accounts until consolidation is complete.
2. Credential abuse is limited by replacing weaker login paths with centralized phishing-resistant MFA, which reduces the usefulness of stolen passwords and similar secrets.
3. Escalation pressure comes from highly privileged AD admin accounts that can alter trust relationships and expand control over additional directories.
4. Impact is reduced when the enterprise narrows privileged identity exposure across inherited estates, making lateral administrative abuse harder to sustain.

Breaches seen in the wild

• Co-op cyber attack 2025: Attackers linked to Scattered Spider tricked their way into a Co-op employee account and stole personal data of all 6.5 million members.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity consolidation is now an M&A control plane problem, not an IT migration project. When nearly 100 acquisitions happen in two years, the question is not whether identity should be standardised, but how quickly the enterprise can impose one trust model across inherited environments. The governance burden sits with authentication, privilege, and directory control at the point of integration. The practitioner conclusion is simple: acquisition velocity should be measured against identity convergence speed, not just legal close dates.

Phishing-resistant authentication is becoming the minimum viable trust layer for acquisition integration. Password-based onboarding across multiple acquired directories leaves too much room for replay, reuse, and inconsistent enforcement. This article shows that a common verification pattern can be used before every environment is fully migrated. The practitioner conclusion is that merger integration teams should stop treating stronger authentication as a later-stage optimisation.

Privilege reduction is the more important signal than authentication rollout volume. Centralized login matters, but the real governance gain comes when highly privileged AD accounts are reduced and easier to monitor. That is where the identity blast radius shrinks. The practitioner conclusion is that consolidation success should be judged by the size and reach of the privileged control plane, not by the number of users moved.

Acquisition-driven identity sprawl exposes the limits of manual lifecycle governance. The inherited environment problem is not just access provisioning, but the persistence of local administrative authority across hundreds of directories. That creates a lifecycle failure pattern where accounts outlive the governance model that created them. The practitioner conclusion is that offboarding and admin rationalisation must be planned as part of every acquisition integration, not after it.

Identity governance scales when business growth and security architecture are aligned. The article’s core signal is that identity can accelerate integration only when the enterprise standardises the trust layer early and removes unnecessary privileged surfaces. That is the discipline: build for repeatable convergence, not one-off remediation. The practitioner conclusion is to treat identity standardisation as a repeatable merger capability.

What this signals

Identity standardisation should be planned as an M&A capability. Acquisition programmes that treat authentication as a later migration task tend to accumulate local exceptions and administrative sprawl. The better model is to define one trust pattern, then use it repeatedly as each environment joins the corporate estate.

Control convergence matters more than user migration counts. Moving users is not the same as reducing risk. The real question is whether the acquired environments now share the same authentication, privilege, and administrative governance model.

Privilege reduction is the clearest sign that consolidation is working. When the highly privileged account pool shrinks, the identity control plane becomes easier to monitor and less attractive to attackers. That is the signal practitioners should track.

For practitioners

• Standardize acquisition onboarding on one authentication pattern Define a corporate authentication standard that newly acquired environments must converge to immediately, even if directory migration is still in progress. Use it to avoid letting every acquisition inherit a different login control model.
• Deploy phishing-resistant MFA as the interim control Use phishing-resistant MFA to close the highest-risk login gap before the full directory transition is finished. That keeps the acquired environment usable while reducing dependence on passwords and local trust exceptions.
• Rationalize highly privileged AD accounts Inventory administrative accounts across inherited directories and remove roles that duplicate corporate control functions. The goal is fewer accounts that can modify the identity fabric itself.
• Measure integration success by control convergence Track how many environments use the same authentication and admin model, not just how many users have been moved. That tells you whether identity consolidation is actually reducing governance complexity.
• Embed identity work into M&A runbooks Make identity standardisation a named workstream in acquisition planning so authentication, privileged access, and directory cleanup happen alongside legal and operational integration.

Key takeaways

• Accenture’s acquisition pace shows that identity governance becomes a live integration discipline when organisations absorb many environments in a short period.
• Centralized phishing-resistant authentication can reduce dependence on local trust exceptions while the broader directory migration is still underway.
• The most meaningful improvement is not login standardization alone, but the reduction of highly privileged accounts that control the identity fabric.

Key terms

• Authorization Standardization: Authorization standardization is the practice of making access rules, policy language, and enforcement behaviour consistent across applications, APIs, cloud services, and integrations. It reduces drift, improves auditability, and gives security teams a single control plane for managing entitlement decisions.
• Identity consolidation: The technical process of bringing separate identity stores, directories, or user populations into a shared structure. It is not the same as governance, because consolidation can merge records while leaving authentication strength, entitlements, and lifecycle controls inconsistent.
• Phishing-Resistant MFA: Phishing-resistant MFA uses authentication factors that cannot be easily replayed, intercepted, or socially engineered. In regulated environments, this usually means device-bound or cryptographic methods rather than push prompts or SMS codes, because the control must hold up under realistic attack conditions.
• Privileged Account Rationalisation: The removal of duplicate, unnecessary, or overly powerful administrative accounts so the control plane is smaller and easier to supervise. In merged environments, it lowers exposure by shrinking the set of identities that can change policy, trust, or directory behaviour.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.