TL;DR: Hybrid identity has shifted from a transitional phase to a long-term operating model, and Active Directory still anchors authentication across many environments even as cloud services expand, according to IS Decisions. That reality makes legacy directory security gaps, not migration timelines, the practical issue IAM teams must confront.
At a glance
What this is: This article argues that hybrid identity is now a durable operating model, not a short transition, and that Active Directory remains central to authentication in many estates.
Why it matters: IAM teams need to treat Active Directory as an ongoing security and governance surface across both on-premises and cloud-connected identity flows, not as a system on the way out.
Context
Hybrid identity means organisations run on-premises directories and cloud identity platforms side by side, with authentication and administration spanning both. In that model, the security question is no longer whether the directory will disappear, but how to govern the identity fabric that continues to rely on it.
The article frames Active Directory as a persistent control plane for many estates, even as cloud services expand around it. That makes legacy directory security, session control, and identity integration the practical issues IAM teams have to solve rather than the timing of a full migration.
Key questions
Q: Why does hybrid identity keep Active Directory in scope for IAM teams?
A: Because many organisations still depend on Active Directory to anchor authentication, group membership, and legacy application access even after adopting cloud services. Hybrid identity is therefore an operating model, not a temporary bridge, so IAM teams must govern AD as part of the live estate rather than waiting for a retirement date that may never arrive.
Q: What are the main security gaps when Active Directory sits beside cloud identity platforms?
A: The main gaps are inconsistent controls across authentication, monitoring, and session governance. Cloud services may assume modern policy enforcement, while Active Directory often lacks native MFA, conditional access, and account monitoring, so the boundary between the two becomes the weak point unless it is explicitly compensated for.
Q: What do security teams get wrong about hybrid Active Directory governance?
A: They often treat on-premises AD and cloud identity as separate problems, even when the same account is synchronised across both. That split view causes ownership gaps, inconsistent lifecycle decisions, and missed privilege drift. Governance has to follow the identity across both environments.
Q: When should organisations keep Active Directory instead of moving fully to Entra ID?
A: Organisations should keep Active Directory when they still rely on legacy protocols, on-premises operational control, data residency constraints, or resilience requirements that cloud identity cannot replace. The decision is driven by workload fit and governance needs, not by cloud migration pressure. If identity supports critical local systems, on-premises control can remain the safer operating model.
Technical breakdown
Why hybrid identity keeps Active Directory in scope
Hybrid identity is not just a coexistence model. It creates an identity estate where on-premises directories, cloud services, and federation links all have to work as one operational system. Active Directory remains central because it still anchors authentication, group membership, and legacy application access for many organisations. The article also points to directory growth: modern user objects carry more attributes, more keys, and more cloud-linked context than they once did. That expansion makes the directory harder to ignore, but also more sensitive to misconfiguration and drift.
Practical implication: treat Active Directory as a living production identity service that needs active governance, not a deprecated holdover.
What Windows Server 2025 says about directory evolution
The article uses Windows Server 2025 functional level changes to show that Microsoft is still extending Active Directory rather than retiring it. The move from functional level 7 to 10 matters because functional level affects domain controller interoperability and the structure of directory objects. The increase in optional database page size from 8KB to 32KB is another signal that directory objects now need to hold more identity data, such as certificates and authentication keys. That is a technical acknowledgement that hybrid identity has outgrown older assumptions about object size and lifecycle.
Practical implication: review directory capacity and compatibility assumptions before object growth becomes a hidden operational constraint.
Where hybrid identity creates the security gap
The main weakness is that cloud integration and legacy directory design were not built from the same security baseline. The article notes that Active Directory does not ship with controls such as MFA, conditional access, account monitoring, or secure SSO by default, while cloud systems were designed around different trust assumptions. Federation can connect the two worlds, but it does not erase the gaps between them. That is why hybrid identity often becomes a control stitching problem: the environment works operationally, yet remains unevenly protected across session, privilege, and authentication paths.
Practical implication: close the control gaps at the directory boundary instead of assuming cloud adoption automatically hardens the identity stack.
Breaches seen in the wild
- Storm-0501 hybrid cloud attacks 2024: Ransomware affiliate Storm-0501 stole Entra Connect Sync credentials to move from on-prem AD to Entra ID, then forged tokens via a rogue federated domain.
- Co-op cyber attack 2025: Attackers linked to Scattered Spider tricked their way into a Co-op employee account and stole personal data of all 6.5 million members.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Hybrid identity governance now has to assume permanence, not transition. The article makes clear that many organisations are no longer moving through hybrid on the way to something else. That matters because governance models built around eventual simplification tend to underinvest in the controls needed to operate two identity planes at once. Practitioner conclusion: treat hybrid identity as the steady state and govern it accordingly.
Active Directory remains the control point that attackers can still turn into an enterprise-wide issue. The article explicitly links AD compromise to privilege elevation, admin targeting, and movement into cloud services. That is the governance lesson: the directory is not just a legacy dependency, it is still a high-value identity junction. Practitioner conclusion: risk management has to follow the identity path, not the deployment philosophy.
Legacy directory gaps are now a hybrid operating risk, not a migration inconvenience. The absence of native MFA, conditional access, monitoring, and secure SSO means the platform still requires compensating controls when it anchors a mixed estate. This is where lifecycle, session, and access control discipline become mandatory rather than optional. Practitioner conclusion: secure the directory as if it will remain in production for years, because that is the most likely outcome.
Active Directory object growth is a governance signal, not just an engineering detail. The move toward larger directory objects reflects how many more identity attributes hybrid estates now carry, from authentication keys to cloud memberships. That creates a stronger case for lifecycle control over identity data, not just authentication events. Practitioner conclusion: manage directory objects as governed identity records with scope, size, and retention boundaries.
Control stitching is the new identity architecture challenge. The article describes a world where cloud and on-premises systems co-exist, but do not share identical security assumptions. That means teams have to design for consistent enforcement across federation, sessions, and access policy layers. Practitioner conclusion: identity strategy should focus on continuity of control across environments, not on platform migration slogans.
What this signals
Hybrid identity is now a steady-state governance problem. Teams should stop planning as if Active Directory will disappear on a near-term schedule and instead design controls for coexistence across on-premises and cloud identity layers. The practical question is whether current governance can sustain both environments without gaps in monitoring, privilege control, or session enforcement.
Directory control is shifting from migration planning to boundary enforcement. As more identity data accumulates in directory objects, the operational issue becomes whether the estate can maintain consistent control across federation, authentication, and admin pathways. Teams that still frame AD as “legacy” risk leaving the most persistent identity junction under-governed.
For practitioners
- Treat Active Directory as a permanent identity service Map AD into your ongoing identity security programme, with explicit ownership for authentication, group governance, and privileged paths across hybrid estates.
- Add compensating controls around AD sessions Use MFA, session controls, and real-time monitoring where the directory itself does not provide those capabilities natively, especially for remote and privileged access.
- Review directory object growth and attribute sprawl Assess whether user and device objects are approaching size and complexity limits as cloud-linked attributes, certificates, and memberships accumulate.
- Harden the cloud-to-on-premises trust path Inspect federation, synchronization, and admin account pathways for gaps that could let a compromise in one environment spread into the other.
- Revisit privileged access assumptions in hybrid estates Confirm which AD accounts, groups, and session types still have standing access that should be narrowed, monitored, or segmented.
Key takeaways
- Hybrid identity has become a durable operating model, so Active Directory must be managed as a live security surface rather than a transitional dependency.
- The article shows that modern directory objects now carry more keys, memberships, and cloud-linked attributes, which raises the governance burden on the identity store.
- IAM teams should focus on compensating controls, privileged access discipline, and boundary enforcement across AD and cloud identity platforms.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5, CIS Controls v8 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Hybrid identity in this article centres on who can authenticate and what access persists across AD and cloud. |
| Recommendation — Review entitlement boundaries in AD and cloud directories to keep access permissions consistent across the hybrid estate. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The article discusses MFA gaps, authentication keys, and directory object growth tied to credential management. |
| AC-6 — Least Privilege | The article highlights privilege elevation, admin account risk, and the need to narrow access in hybrid estates. | |
| Recommendation — Apply authenticator management to harden directory-backed credentials and reduce reliance on standing access. Enforce least privilege on AD and hybrid admin accounts to limit blast radius across connected environments. | ||
| CIS Controls v8 | CIS-5 — Account Management | Active Directory remains the primary account store in the environments described, making account governance central. |
| Recommendation — Use account management controls to review, disable, and segment hybrid identity accounts that no longer need standing access. | ||
| NIST Zero Trust (SP 800-207) | Section 2.2 — Zero Trust principles | The article's hybrid trust boundary problem aligns with continuous verification across directory and cloud access paths. |
| Recommendation — Apply zero trust principles to authenticate and authorise every access path across AD and cloud services. | ||
Key terms
- Hybrid Identity: Hybrid identity is an architecture that connects on-premises directories with cloud identity providers and SaaS applications. It creates operational flexibility, but it also expands the blast radius of identity compromise across multiple systems that share trust and authentication dependencies.
- Active Directory: Microsoft's directory service for managing identities, authentication, and permissions across many enterprise environments. In security analysis, it matters because it often sits at the center of access control, so a compromise can affect users, systems, and administrative trust across the organisation.
- Federation entity: A federation entity is an organisation or technical participant that publishes metadata describing its keys, endpoints, and capabilities. It is the unit of participation inside the federation, and it can be an identity provider, relying party, wallet provider, or AI agent acting on behalf of a system.
- Directory Object Bloat: Directory object bloat is the accumulation of too many attributes, memberships, and identity-related fields inside directory objects. It weakens manageability, increases audit complexity, and can hide risk because administrators lose clarity on which identity data is still necessary for access decisions.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on July 12, 2026.
Updated on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org