TL;DR: Opal Security shows that mergers and acquisitions are turning access governance into a multi-IDP problem, with duplicated users, conflicting sources of truth, and inconsistent policy enforcement across Okta, Entra, Google Workspace, and legacy systems. Standardisation alone does not solve the governance burden; organisations need to manage heterogeneity directly.
At a glance
What this is: Opal Security argues that M&A now creates identity sprawl across multiple identity providers, making access governance a multi-system coordination problem rather than a simple migration exercise.
Why it matters: IAM and IGA teams need to govern inherited identity ecosystems, not just consolidate them, because access decisions, audits, and reviews break when identity data is fragmented across acquired environments.
👉 Read Opal Security's analysis of M&A identity complexity and access governance
Context
M&A identity complexity arises when each acquired company brings its own identity provider, directory structure, and access model into the parent organisation. The result is not just more users, but conflicting sources of truth, duplicated identities, and governance work that spans multiple systems at once.
In this environment, access governance stops being a single-stack problem and becomes an orchestration problem. IAM teams have to preserve operational continuity while maintaining reviewability, policy consistency, and lifecycle control across heterogeneous identity estates.
The article treats architectural diversity as the operating condition, not the exception. That is typical of modern M&A programmes, where integration timelines are shorter than the time needed to fully standardise identity infrastructure.
Key questions
Q: What breaks when an acquired company keeps its own identity provider?
A: Access governance breaks when teams assume one source of truth still exists after acquisition. Duplicated users, conflicting attributes, and separate approval paths make provisioning, deprovisioning, and review evidence inconsistent unless identity correlation and source ownership are explicit across the new estate.
Q: When should organisations prioritise multi-source governance over directory consolidation?
A: Organisations should prioritise multi-source governance when consolidation would take years, disrupt critical workflows, or delay the security posture needed for the next acquisition. The immediate goal is control continuity across systems, not premature standardisation that creates more operational risk than it removes.
Q: What do security teams get wrong about M&A access management?
A: Teams often treat identity sprawl as a temporary inconvenience and try to eliminate it with a fast migration. That usually creates brittle dependencies, weak identity resolution, and incomplete audit trails. The better assumption is that multiple identity authorities will coexist for a long time.
Q: How should IAM teams govern digital IDs in a multi-provider ecosystem?
A: Treat the ecosystem as a shared trust fabric, not a single authentication tool. Governance needs clear assurance criteria, consent rules, attribute minimisation, revocation paths, and independent certification. If those controls are inconsistent across providers, users may still authenticate successfully while the underlying trust state is no longer valid.
Technical breakdown
Why multi-IDP governance breaks traditional access models
M&A often leaves organisations with several authoritative identity sources at once, such as Entra, Okta, Google Workspace, and legacy directories. Traditional governance models assume one dominant source of truth, but that breaks when the same person exists with different usernames, policies, or lifecycle states across systems. Identity resolution becomes the core control problem because provisioning, approvals, and audits all depend on correctly linking the same human or workload across directories. Once identities are duplicated, every downstream control inherits ambiguity.
Practical implication: design governance around identity correlation and source-aware policy, not around a single directory assumption.
How hub-and-spoke and multi-source models change control ownership
A hub-and-spoke model centralises governance through one dominant identity authority, while the downstream systems continue to exist as managed spokes. A multi-source model keeps each acquired environment authoritative for its own population, which preserves autonomy but increases the need for conflict resolution and policy orchestration. These are not just deployment preferences. They define where approvals happen, which system owns lifecycle changes, and how access evidence is collected for audit and recertification.
Practical implication: choose the model that matches the integration timeline and make control ownership explicit before consolidating anything.
Why ABAC becomes fragile across acquired identity systems
Attribute-based access control only works if attributes are stable, correctly sourced, and semantically consistent. In M&A environments, the same label can mean different things in different systems, and synchronisation failures can corrupt policy decisions if attributes are merged too aggressively. Keeping tag namespaces isolated avoids false equivalence between populations and reduces the chance that one system's metadata pollutes another's access decisions. That makes ABAC usable at scale without forcing premature normalisation.
Practical implication: separate attribute namespaces by source and test access policies against conflicting metadata before relying on them in production.
Breaches seen in the wild
- Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.
- Cloudflare Thanksgiving breach 2023: One service token and three service accounts left unrotated after the Okta breach gave a nation-state attacker access to Cloudflare's Atlassian systems.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
M&A identity sprawl is now a governance state, not an integration bug. The article shows that security teams inherit multiple identity providers, overlapping usernames, and inconsistent policies as a normal outcome of acquisition. That means the core identity problem is no longer how to eliminate diversity, but how to govern it without losing auditability or lifecycle control. The practitioner conclusion is that architecture heterogeneity must be treated as a permanent input to IAM design.
Identity resolution has become a control plane issue. When the same person exists in more than one directory, every access review, entitlement decision, and deprovisioning action depends on accurate correlation. If identity matching is weak, compliance evidence fragments and lifecycle actions become inconsistent across subsidiaries or business units. Practitioners should view identity correlation as a prerequisite for governance, not as a back-office data clean-up task.
Multi-source access governance is the right model when acquisitions outpace migration. Forcing a single-platform standard can take years and can break operational continuity before the integration is complete. A managed multi-source model preserves local autonomy while still enabling central policy, which better reflects how modern M&A programmes actually unfold. The practical takeaway is to govern the federation of systems first and let consolidation remain an option, not a dependency.
ABAC in M&A requires source isolation, not attribute blending. The article's strongest technical point is that access control fails when teams assume same-named attributes mean the same thing across directories. That assumption creates policy drift, false matches, and fragile synchronisation. A named concept here is attribute namespace isolation: keeping source-defined tags separate so policy decisions remain tied to their authoritative system. The practitioner conclusion is to stop collapsing metadata too early.
Architectural diversity is becoming the default access governance pattern. This does not weaken governance; it changes where the governance work sits. Instead of migration projects absorbing all risk, the burden moves to correlation, conflict resolution, and source-aware policy enforcement. The discipline now is to build identity controls that survive the next acquisition, not just the current one.
What this signals
Attribute namespace isolation: M&A governance gets fragile when teams merge metadata too early and let same-named attributes acquire different meanings across directories. Keeping source-defined tags separate makes access decisions more stable during long integration windows.
Security leaders should assume that identity consolidation will lag business integration. The practical programme response is to invest in identity correlation, policy orchestration, and review coverage that works while the acquired environment remains partially independent.
For practitioners
- Define identity ownership by source system Document which directory, HR feed, or access platform owns each user population and attribute set before integration begins. That prevents duplicate lifecycle actions and reduces ambiguity during access reviews.
- Implement cross-directory identity resolution Link duplicate accounts for the same person across Entra, Okta, Google Workspace, and legacy directories so approvals and revocation follow the individual rather than the username.
- Preserve source-specific attribute namespaces Keep tags and attributes separate by source instead of normalising them into a single merged schema. This avoids policy collisions when different systems use the same label for different meanings.
- Run access reviews across all connected systems Review a person's entitlements holistically across parent and acquired environments so audit evidence includes every active grant, not just the grants in the corporate primary directory.
Key takeaways
- M&A creates identity sprawl that turns access governance into a multi-system problem rather than a single-directory administration task.
- The main risk is not just duplication, but inconsistent lifecycle control, fragmented audit evidence, and policy drift across inherited identity providers.
- Teams should govern source diversity directly by correlating identities, isolating attributes by source, and running reviews across every connected system.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Multi-IDP access governance depends on explicit entitlement control across inherited systems. |
| ID.AM-01 — Physical devices and systems within the organisation are inventoried | The article centres on maintaining an accurate inventory of identity sources and connected systems. | |
| Recommendation — Apply PR.AA-05 to govern entitlements consistently across every connected identity source. Inventory every identity provider and downstream system before attempting cross-domain governance. | ||
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | M&A identity sprawl creates account lifecycle complexity across multiple directories and populations. |
| IA-5 — Authenticator Management | Multiple identity providers require controlled handling of credentials and authenticators during transitions. | |
| Recommendation — Use AC-2 to align account creation, modification, and termination across all inherited systems. Use IA-5 to govern authenticator lifecycle consistently across acquired and parent environments. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Acquired environments often retain active identities and access longer than intended during integration. |
| Recommendation — Track and revoke inherited identities promptly so offboarding does not lag behind ownership change. | ||
Key terms
- Identity Resolution: Identity resolution is the correlation step that determines whether multiple accounts belong to the same person or accountable role. It combines identifiers, context, and system-specific attributes to reduce false splits and missed matches, which is what makes governance outputs dependable rather than approximate.
- Source of truth: A source of truth is the authoritative store that holds the current, trusted version of project state or operational knowledge. For AI workflows, it should be a controlled system such as a repository, task platform, or note vault that agents can read and update through governed access paths.
- Attribute Namespace Isolation: Attribute namespace isolation keeps similarly named tags or attributes separate when they come from different systems. It prevents one directory's metadata from being incorrectly reused in another, which is critical when M&A introduces overlapping labels with different meanings.
- Multi-Source Governance: Multi-source governance is an access management model that coordinates policies, reviews, and lifecycle actions across several authoritative identity systems. It is designed for organisations where consolidation is slow, partial, or strategically undesirable.
What's in the full article
Opal Security's full product post covers the operational detail this post intentionally leaves for the source:
- Deployment patterns for hub-and-spoke and multi-source identity governance across acquired environments
- How secondary email resolution and identity matching work across separate identity providers
- Operational examples of cross-system group management and access request routing
- Practical details on unified catalog views, access reviews, and conflict resolution rules
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 23, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org