Accenture’s identity standard shows how acquisition scale reshapes IAM

At a glance

What this is: This is a vendor case study showing how Accenture used centralized phishing-resistant authentication to govern identity across hundreds of acquired Active Directory environments while reducing privileged account sprawl.

Why it matters: It matters because acquisition-heavy IAM programmes fail when authentication, privilege, and governance remain fragmented across inherited environments.

Context

Acquisition-heavy enterprises inherit identity sprawl as a structural problem, not a temporary nuisance. Each newly acquired Active Directory environment can carry its own authentication model, admin model, and migration timeline, which means the security team is governing multiple identity estates at once.

The governance gap is simple: business integration moves faster than identity standardisation. If phishing-resistant authentication and privileged account reduction only happen after long migration projects finish, the enterprise spends months or years with inconsistent controls across the combined estate.

In this case, the article frames Accenture's identity standard as a way to keep trust aligned with growth. The underlying issue is not PKI alone, but whether centralized identity governance can scale across inherited environments without slowing the business.

Key questions

Q: How should security teams govern identity across acquired Active Directory environments?

A: They should standardise authentication and administrative control before expecting full technical consolidation. Mixed environments usually persist for months or years after acquisition, so the immediate priority is a consistent assurance level, clear privileged account ownership, and one governance view across all inherited directories.

Q: Why do acquisition-heavy enterprises struggle to standardize authentication quickly?

A: Because migration timelines are usually slower than business integration timelines. Each acquired directory can have different admin practices, user trust assumptions, and local exceptions, which makes passwords and privileged access hard to govern consistently. Phishing-resistant authentication helps because it creates a common trust layer that can be enforced before the full directory estate is merged.

Q: What are the signs that identity governance is not keeping pace during post-merger integration?

A: Common warning signs include orphaned accounts, unmanaged shadow IT access, incomplete visibility into local and machine identities, and legacy identities whose ownership or purpose is unknown. If teams cannot explain why an account exists, who owns it, or whether it still needs access, identity controls are already lagging the integration.

Q: What should teams do when they cannot finish directory migration before business integration?

A: Use a portable trust control that works across multiple environments, then remove standing privilege as part of the integration plan. That approach keeps authentication consistent while the broader migration is still underway and reduces the number of elevated identities that an attacker could target during the transition.

Technical breakdown

Centralized phishing-resistant authentication across inherited Active Directory estates

Phishing-resistant authentication replaces reusable password-based trust with stronger credential binding, often through smart cards, certificates, or other cryptographic factors. In a post-acquisition environment, the challenge is not whether the method works in one domain, but whether it can be applied consistently across many inherited domains without forcing a long cutover. The article describes exactly that problem: hundreds of AD environments, each needing alignment to a corporate identity standard. The technical issue is federation and enforcement at scale, where consistency matters more than local convenience.

Practical implication: Standardize strong authentication at the enterprise layer before migration completes, or inherited domains will remain unevenly protected.

Certificate-based identity as a migration bridge

PKI-based authentication can act as a bridge when enterprises need to remove passwords before a full directory consolidation is complete. The important detail is that certificate trust can be deployed independently of the eventual directory target, which lets security teams enforce a common authentication standard across separate environments. That matters in acquisition programmes because the identity programme cannot assume a single destination platform on day one. Instead, the control has to be portable enough to work across different AD estates while preserving central oversight and user continuity.

Practical implication: Use certificate-backed authentication as an interim control when the business cannot wait for directory consolidation.

Privileged account reduction and identity attack-surface control

The article's most concrete security outcome is the roughly 50% reduction in highly privileged AD admin accounts. That is not just a hygiene metric. It is an attack-surface reduction signal, because fewer privileged identities means fewer accounts to target, fewer standing credentials to manage, and less room for inconsistent delegation. In a large acquisition environment, privilege sprawl often persists because every inherited domain brings its own admin patterns. Central governance only changes the risk profile when it also changes who holds elevated access and how many such accounts remain.

Practical implication: Track privileged account counts as a security outcome, not just an operational inventory metric.

Breaches seen in the wild

• Co-op cyber attack 2025: Attackers linked to Scattered Spider tricked their way into a Co-op employee account and stole personal data of all 6.5 million members.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Acquisition-driven identity governance is now a scale problem, not a directory problem. The article shows that hundreds of inherited AD environments cannot be treated as separate exceptions waiting for eventual cleanup. When acquisition pace outstrips migration pace, the identity programme becomes the only control plane that can impose consistency across the combined estate. Practitioners should read this as a governance warning: if the standard cannot travel with the acquisition, the risk travels instead.

Centralized authentication becomes the only viable bridge between business speed and control consistency. Strong authentication is often discussed as a user security measure, but in acquisition-heavy enterprises it is also a governance stabilizer. It reduces dependence on local directory practices and creates a uniform trust layer before full consolidation is complete. The practical takeaway is that identity teams need controls that can span mixed estates without waiting for ideal architecture conditions.

Privilege reduction is the real security signal, not the authentication brand. The article's reported drop in highly privileged AD admin accounts is the more important governance result because it narrows the attack surface created by inherited administrative models. That aligns with NIST CSF access authorization and least-privilege principles, but the core point is operational: acquisition programmes reveal how much standing privilege an enterprise has been carrying all along. Identity teams should measure whether integration work is shrinking privilege, not just standardizing login methods.

Identity standardisation has become a merger-era control requirement for enterprise IAM. When an organisation is absorbing dozens or hundreds of environments, the old assumption that each domain can be cleaned up later no longer holds. The field implication is that lifecycle governance, authentication policy, and privileged access control now have to function as acquisition infrastructure. That is the standard practitioners should expect from modern IAM programmes.

Acquisition-scale identity governance is now a named operational pattern. This article illustrates a repeatable condition where business growth creates identity fragmentation faster than traditional IAM projects can remove it. The value is not in the vendor label, but in the pattern: enforce a common trust standard early, reduce privileged sprawl, and keep central governance intact while integration is still underway. Practitioners should treat that as a programme design pattern for post-merger identity control.

What this signals

Acquisition-scale identity governance is becoming a programme design requirement: identity teams cannot assume that consolidation will happen before risk appears. When acquisitions arrive faster than migrations, the control plane has to operate across mixed estates from day one.

The practical shift is toward controls that can be applied before full directory rationalisation, especially where privileged access and authentication standards vary widely. That is why acquisition programmes increasingly expose whether an IAM architecture is truly portable or only works in a stable internal environment.

For practitioners

• Map inherited Active Directory estates Inventory every acquired AD environment, identify where authentication policy still differs, and classify which estates can accept a common trust standard before full migration.
• Enforce phishing-resistant authentication early Use certificate-backed or equivalent phishing-resistant authentication as a bridge control while migration work is still in progress, rather than waiting for consolidation to finish.
• Measure privileged account reduction Track how many highly privileged admin accounts remain after each integration wave and require every acquisition plan to show a downward trend in standing privilege.
• Keep central governance intact across acquisitions Define a corporate identity standard that can be applied across inherited environments without local exceptions becoming permanent, and review exceptions on a fixed governance cadence.

Key takeaways

• The article shows that acquisition growth creates identity fragmentation unless the enterprise can impose one authentication and governance standard across inherited environments.
• The most important security result is the reported reduction in highly privileged admin accounts, because fewer standing elevated identities narrow the attack surface.
• Enterprises should treat cross-estate authentication and privilege reduction as acquisition controls, not as cleanup tasks that can wait for later migration phases.

Key terms

• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Identity standardization: The process of applying one common identity policy, authentication model, and governance baseline across multiple environments. In a merger or acquisition context, it reduces variation between legacy directories so the enterprise can enforce control consistently instead of inheriting a patchwork of local exceptions.
• Privileged account sprawl: The condition where administrative identities multiply across systems, environments, or acquired organisations faster than governance can rationalise them. It increases exposure because every extra privileged account is another high-value target, another review item, and another potential source of policy inconsistency.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.