Active Directory access reviews are still failing in hybrid estates

At a glance

What this is: This is an analysis of why manual Active Directory access reviews fail in hybrid estates and how automation changes the governance model.

Why it matters: It matters because directory access review failures affect human IAM governance, downstream NHI entitlement control, and the evidence auditors expect across identity programmes.

By the numbers:

• Only 5.7% of organisations have full visibility into their service accounts.
• 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
• 80% of identity breaches involved compromised non-human identities such as service accounts and API keys.

👉 Read SecurEnds' guide to Active Directory access reviews in hybrid estates

Context

Active Directory access review is the process of checking whether a user still needs the permissions they currently hold. In hybrid estates, the challenge is not the concept of review, but the operational reality of nested groups, stale exports, and slow approvals that make the answer hard to trust.

The article is really about governance at scale. When access recertification depends on spreadsheets and email chains, entitlement drift survives long enough to become an audit issue, a compliance issue, and in some environments a privilege-exposure issue across both human and non-human identities.

Key questions

Q: What breaks when Active Directory access reviews are run from spreadsheets?

A: Spreadsheet-based reviews break down because they capture a static snapshot of a directory that is still changing. Nested groups, delayed approvals, and manual reconciliation create state drift between the review record and the live access model, so reviewers can certify the wrong entitlement set. Live integration and executable revocation are needed to preserve control.

Q: Why do nested AD groups make access certification harder?

A: Nested groups hide transitive access, which means the visible membership list is not the same as the effective permission set. That makes it easy to miss broad downstream access in applications, shares, or administrative scopes. Reviewers need flattened entitlement resolution before they can make reliable certification decisions.

Q: How do you know if an access review programme is actually working?

A: A review programme is working when approved removals are executed quickly, unapproved access is escalated automatically, and audit evidence shows the decision changed the live entitlement state. If the process only records opinions and leaves access untouched, it is governance theatre rather than control.

Q: Who should be accountable when access remains after a failed review?

A: Accountability should be shared across the manager, the app owner, and the identity team, because each owns a different part of the decision and enforcement chain. The key test is whether the programme can prove who approved the access, who executed the revocation, and where the exception was tracked.

Technical breakdown

Nested AD groups and transitive entitlements

Nested group structures make effective access larger than what a simple top-level export shows. A user may appear to belong to one group, but inheritance and group nesting can cascade into many more permissions across applications, shares, and administrative scopes. That is why a review that stops at the visible group list underestimates real access. The technical problem is transitive entitlement resolution, not just directory listing. Practical implication: reviewers need flattened entitlement views that show inherited access before approval or revocation decisions are made.

Practical implication: Flatten nested group inheritance before access certification, or reviewers will certify the wrong privilege set.

Why spreadsheets break access certification

Spreadsheet-based review flows create a static snapshot of a dynamic directory. By the time exports are circulated, entitlements may already have changed, especially in multi-domain or hybrid environments where multiple systems feed the same identity picture. Email-based approvals also weaken evidence quality because decisions are hard to trace, time stamp, and reconcile. The underlying failure is not just labour cost, but state drift between the review record and the live directory. Practical implication: the review system must stay connected to the directory while the campaign is running.

Practical implication: Use live directory integration, not exported files, so certification evidence matches the current access state.

Revocation, audit trails, and accountability

A review only reduces risk if approved removals are executed quickly and unapproved entitlements are clearly tracked. In many manual processes, the review ends when the decision is recorded, but the entitlement remains active until someone later processes the change. That delay creates a gap between governance intent and actual access control. Clean audit trails also matter because auditors need to see who reviewed what, when they decided, and whether the decision resulted in revocation. Practical implication: revocation workflows and immutable review logs must be part of the review design.

Practical implication: Tie approvals directly to revocation workflows and preserve a complete audit trail for every entitlement decision.

Threat narrative

Attacker objective: The attacker or insider wants to inherit stale access and use it to reach systems, data, or administrative functions that governance should have removed.

1. Entry occurs through dormant or over-provisioned directory access that was never removed after a role change, contractor offboarding, or exception request.
2. Escalation happens when nested groups and delayed reviews preserve broader entitlements than the user should still hold, allowing access to sensitive resources beyond intent.
3. Impact is audit failure, privilege creep, and exposure of systems or data that should have been removed from the user's access path.

Breaches seen in the wild

• Cisco Active Directory credentials breach — Kraken ransomware group leaked Cisco Active Directory credentials.
• DeepSeek breach — DeepSeek breach exposed 1M+ log lines and sensitive secret keys.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Manual access review was built for a slower identity model. The article shows that spreadsheet-driven certification assumes access state is easy to capture, stable while reviewers decide, and simple to prove later. That assumption fails in hybrid AD estates because entitlements move faster than email workflows and nested groups hide the real privilege set. The implication is that certification quality is now limited by state drift, not reviewer intent.

Privilege creep is the failure mode, not the side effect. The strongest signal in the source is the repeated example of former employees, contractors, and role changers retaining access long after the business need ended. That is the governance problem access reviews are supposed to catch, but manual processes allow it to persist. Practitioners should treat entitlement drift as a standing control gap, not an occasional clean-up issue.

Access review without executable revocation is incomplete governance. A decision record that does not drive removal, escalation, or exception handling leaves the risky entitlement in place. That is especially dangerous in hybrid environments where one stale group membership can map to many downstream permissions. The practical conclusion is simple: if a review cannot enforce the decision path, it is documentation, not control.

Active Directory review quality now depends on cross-domain visibility. The article points to hybrid and multi-forest environments where the same user can hold overlapping access across systems. That makes this an identity governance problem across human accounts and machine-linked entitlements alike, not a single-directory reporting task. Practitioners should evaluate whether their review programme can resolve access across domains before they trust any certification result.

Identity lifecycle and recertification are converging around continuous evidence. Quarterly reviews may still satisfy policy language, but they do not solve the operational problem if access changes daily and deprovisioning lags. This is where the NHI governance mindset is useful even for human directories: lifecycle discipline matters when the entitlement itself is the risk surface. The implication is that programmes need evidence that is live, not retrospective.

From our research:

• Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
• 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
• A stronger lifecycle view starts with NHI Lifecycle Management Guide, which is the right follow-on resource when teams need provisioning, rotation, and offboarding discipline.

What this signals

Access review programmes are increasingly judged by whether they can prove current state, not just whether they can issue findings. In hybrid identity estates, that makes live entitlement resolution and revocation traceability more valuable than periodic export reports. Teams should expect auditors to ask for evidence that decisions changed access, not only that someone clicked approve.

Identity governance is converging across human and non-human accounts. The same lifecycle weakness that leaves contractor access lingering in Active Directory also appears in service accounts and API keys, which is why directory review maturity now overlaps with NHI discipline. For practitioners, the lesson is to build one governance model that can handle both people and machine identities without relying on spreadsheet exceptions.

Manual review fatigue creates a visibility debt. Our research shows only 5.7% of organisations have full visibility into their service accounts, and the same low-visibility pattern is exactly what manual access certification tends to preserve rather than remove. Teams should treat visibility, certification, and revocation as one control chain, not separate projects.

For practitioners

• Flatten nested group inheritance before certification Resolve transitive permissions into a single review view so managers see the full effective entitlement set, not just the top-level group membership.
• Bind approvals to revocation workflows Make every unapproved entitlement flow directly into removal, exception handling, or escalation so decisions change access state immediately.
• Replace exported spreadsheets with live review campaigns Keep the review connected to Active Directory and Azure AD during the campaign so the evidence set stays aligned to current access.
• Require reviewer accountability and audit-ready logs Track who approved or rejected each entitlement, when the decision was made, and whether the action was executed, then retain those logs for audit.

Key takeaways

• Manual AD access reviews fail when entitlement state drifts faster than reviewers can certify it.
• Nested groups, stale exports, and delayed revocation are the main reasons privilege creep survives review cycles.
• Effective access governance requires live visibility, executable removals, and audit evidence that ties decisions to state change.

Key terms

• Active Directory access review: A periodic check of directory permissions to confirm that users still need the access they hold. In practice, the quality of the review depends on whether the process reflects current entitlements, includes inherited permissions, and produces evidence that can be acted on immediately.
• Transitive access: Access that a user receives indirectly through nested groups or role inheritance rather than direct assignment. It often makes entitlement scope larger than it first appears, so review tools must resolve the full effective permission set before reviewers can make reliable decisions.
• Privilege creep: The gradual accumulation of access that no longer matches job need, project need, or business context. It usually develops after role changes, exceptions, or weak offboarding, and it remains one of the most common ways dormant entitlements stay active inside identity programmes.
• Access certification: The governance process of having managers or control owners confirm whether existing access should remain in place. Strong certification is not only a record of approval or denial. It also drives removal, escalation, and traceable evidence that the decision changed the live state.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.

This post draws on content published by SecurEnds: Active Directory access reviews in hybrid estates. Read the original.