Identity security roadmap: what changes for AD and Entra ID

At a glance

What this is: This on-demand webinar outlines a roadmap for Active Directory and Entra ID identity security that focuses on real-time attack detection, posture management, governance, and AD CS risk reduction.

Why it matters: It matters because IAM teams need to understand how directory security, certificate services, and governance workflows are converging into one identity-risk programme rather than separate workstreams.

Context

Identity security is the discipline of controlling who and what can authenticate, authorize, and persist in directory environments such as Active Directory and Entra ID. In practice, the hard problem is not just access control, but spotting abuse paths, governance gaps, and certificate-based trust that attackers can turn into lateral movement.

This on-demand webinar frames identity as the control plane for data and focuses on how Netwrix is evolving its portfolio around detection, posture management, governance, and AD CS protection. For practitioners, the useful question is how to compress identity risk discovery and response into one operational model instead of managing directory, certificate, and review processes in isolation.

Key questions

Q: How should security teams prevent unwanted persistence in Active Directory and Entra ID?

A: Security teams should tie identity removal to lifecycle events, not just login disablement. That means revoking group membership, delegated rights, application links, and privileged role assignments when a user, admin, or application changes state. The goal is to retire the identity object completely enough that it cannot remain a persistence anchor.

Q: Why do posture management and governance need to work together for identity security?

A: Because posture tells you what is exposed, while governance tells you whether the access or trust should exist at all. If the two are separated, teams can detect risk without having a reliable path to revoke, re-scope, or justify it.

Q: What breaks when AD CS is treated as separate from identity security?

A: Certificate trust can outlast the account or role that originally justified it, which creates durable authentication paths that normal password controls do not touch. That makes AD CS a governance issue as much as a technical one.

Q: How can identity teams tell whether their assessment workflow is actually working?

A: Look for shorter time from finding to decision, clear ownership of identity risks, and visible closure of the path that created the exposure. If assessments only produce reports, the workflow is not reducing identity risk.

Background and context

How identity attack paths form in directory environments

Active Directory and Entra ID remain attractive because they combine authentication, authorization, and trust relationships in one place. When attackers find weak governance, they often do not need a novel exploit. They move through standing privileges, stale directory relationships, over-permissioned accounts, or certificate-based trust chains that were never redesigned for modern threat pressure. AD CS matters because certificates can extend trust in ways that outlive the original user or system context. The real architectural issue is that identity systems often expose multiple paths to the same asset, so defenders need to understand how those paths compose.

Practical implication: Map the directory trust paths that matter most, especially where AD CS or legacy delegation can turn one weak link into broad access.

Why posture management and governance now share the same workflow

Posture management answers what is exposed, while governance answers who should have access and whether that access is still justified. In directory environments, those two functions increasingly overlap because excessive privilege, orphaned relationships, and mis-scoped trust become exploitable only when governance fails to keep pace with environment change. A useful way to think about this is that assessment without remediation speed becomes reporting, not risk reduction. This is why redesigning the risk assessment experience matters: not for prettier dashboards, but for faster actionability across identity owners, admins, and security teams.

Practical implication: Tie posture findings directly to ownership and remediation workflows so identity risk does not stall in review queues.

What AD CS changes in identity security architecture

Active Directory Certificate Services creates a different class of identity risk because certificates can authenticate subjects and services outside the normal password lifecycle. That means misconfiguration, weak issuance controls, and overly broad trust assumptions can create durable attack paths even when user credentials are well managed. Certificate security is therefore not a side topic. It is part of the identity control plane when certificates are used for authentication, device trust, or service identity. Once certificate trust is mis-scoped, it can be difficult to unwind without understanding the full issuance and authorization path.

Practical implication: Treat AD CS as an identity security domain with explicit issuance, trust, and revocation controls rather than as a separate PKI concern.

NHI Mgmt Group analysis

Identity risk is now a control-plane problem, not a product-silo problem. The article’s framing is correct in that Active Directory, Entra ID, governance, and certificate trust are all part of the same attack surface. When those functions are managed separately, security teams lose the ability to see how a directory weakness becomes an attack path. The practitioner conclusion is that identity security programmes need shared risk language across directory, governance, and certificate operations.

Identity security posture only matters when it drives faster decisions. A risk assessment experience that is not tied to remediation ownership and priority is just inventory. The article points toward a faster, more actionable model, which is the right direction for teams trying to reduce time-to-triage on identity exposures. The practitioner conclusion is to measure identity controls by how quickly they change decisions, not by how many findings they produce.

AD CS belongs inside identity governance conversations. Certificate services are often treated as infrastructure plumbing, but that framing misses how certificates can reinforce trust, persistence, and unauthorized authentication. The issue is not simply certificate hygiene. It is whether the governance model understands certificate issuance, lifecycle, and revocation as identity events. The practitioner conclusion is to bring certificate paths into the same governance lens as accounts, groups, and delegated access.

Redesigned assessment experiences matter because identity attack paths are composable. One weak directory setting, one stale trust path, or one over-scoped certificate relationship can create a much larger exposure than the original misconfiguration suggests. This is why identity programmes should focus on path reduction as much as on control coverage. The practitioner conclusion is to evaluate whether your current identity workflow shows the chain of exposure, not just the individual control failure.

Netwrix’s roadmap reflects a broader market shift toward continuous identity risk operations. The field is moving away from periodic review models and toward operational identity security that blends detection, governance, and posture in near real time. That direction validates a more integrated programme architecture for both Active Directory and cloud identity. The practitioner conclusion is to plan for identity operations that behave more like continuous risk management than annual compliance.

From our research library:

• 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
• Read next: Identity Threat Detection and Response (ITDR) Guide

What this signals

Identity risk operations are moving from periodic review to continuous decisioning. For AD and Entra ID programmes, the practical shift is not another report cycle but a workflow that collapses detection, ownership, and remediation into one operating model. That is where identity security stops being descriptive and starts changing exposure in time to matter.

Certificate paths are becoming a first-class governance concern. When AD CS can extend trust beyond the original account or role context, teams need to review certificate issuance and revocation with the same seriousness as privileged access. The implication is that directory hygiene alone no longer tells the whole story.

69% of security leaders agree identity management must fundamentally shift to address agentic AI systems. That figure points to a broader governance reset, where identity teams must build for faster, more composable trust decisions across human, machine, and future agentic use cases.

For practitioners

• Map identity attack paths across directory and certificate trust Inventory the Active Directory and Entra ID relationships that create reusable trust, especially where AD CS, delegation, or legacy group structures can extend access beyond their intended scope.
• Unify posture findings with remediation ownership Connect identity risk findings to named owners, review cadence, and closure criteria so posture management produces action instead of static reporting.
• Bring AD CS into identity governance reviews Treat certificate issuance, trust paths, and revocation as part of identity governance so certificate-driven authentication is reviewed alongside account and role changes.
• Measure risk assessment speed, not just coverage Track how quickly identity findings move from detection to decision and remediation, because assessment value drops when the workflow cannot keep pace with change.

Key takeaways

• Identity security in Active Directory and Entra ID now spans attack paths, governance workflows, posture management, and certificate trust.
• The article points to faster assessment and more actionable remediation as the real operational objective, not simply more visibility.
• If AD CS and directory trust are governed separately, identity teams will miss the paths attackers can stitch together across the control plane.

Key terms

• Identity Attack Path: A sequence of trust relationships and privileges that lets an attacker move from one compromised identity to broader access. In practice, it is the shortest route from weak configuration to meaningful control, often spanning directory permissions, delegated administration, and certificate trust.
• AD CS: Active Directory Certificate Services is Microsoft’s certificate infrastructure for issuing and managing certificates used in authentication and trust. In identity governance, it matters because certificates can create durable authentication paths that outlive the original account context and must be managed as part of identity lifecycle and access control.
• Identity Posture Management: Identity posture management is the continuous discovery, assessment, and monitoring of identity risk across an environment. In NHI contexts, it focuses on exposure, privilege, ownership, and drift, so teams can find risky access before it becomes an incident or an audit gap.
• Identity Governance: Identity governance is the set of controls that defines who approves access, who owns it, how it is reviewed, and when it is removed. In practice, it turns identity management from a deployment task into a durable control system that can withstand audits, organisational change, and operational growth.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.