M&A identity integration exposes the limits of fragmented IAM

At a glance

What this is: This article argues that M&A creates identity integration failures when two organisations try to merge incompatible directories, access policies, and lifecycle processes.

Why it matters: It matters because IAM teams need a repeatable way to unify access, enforce MFA, and avoid lingering privileges when organisations merge or split.

Context

M&A identity integration is the process of merging or separating user identities, access policies, and directory structures across two organisations. When each side runs different directories and security protocols, the integration problem becomes an IAM problem before it becomes an operations problem.

The security gap is not abstract: without a central authority for identity, policy enforcement becomes inconsistent, access provisioning slows down, and divestitures can leave residual access behind. For IAM, IGA, and PAM teams, the question is whether identity is being treated as a governed control plane or as after-the-fact cleanup.

Key questions

Q: What do IAM teams get wrong when onboarding identities after an acquisition?

A: A common mistake is focusing on day one provisioning while neglecting deprovisioning and identity cleanup. Teams may get users productive quickly, but leave behind access that is no longer needed or is hard to attribute. That creates lingering permissions, audit friction, and unnecessary exposure. A disciplined onboarding process must be matched by a clean offboarding path.

Q: Why do fragmented directories create more risk during M&A?

A: Fragmented directories create risk because they force teams to reconcile access across systems that enforce different policies and trust boundaries. That inconsistency makes it easier for gaps to emerge in MFA, provisioning, and revocation, especially when the integration has to move quickly.

Q: What are the signs that M&A identity integration is failing?

A: Long provisioning delays, inconsistent MFA coverage, duplicate accounts, and manual exception handling are strong signs that the integration is not governed cleanly. Those symptoms usually mean the organisation is relying on temporary workarounds instead of a central identity model.

Q: What should organisations do differently for divestitures?

A: They should treat separation as a lifecycle event that requires explicit revocation, entitlement reassignment, and confirmation that the carved-out entity no longer retains access to shared systems. Without that discipline, residual access becomes a compliance and security problem.

Technical breakdown

Why fragmented directories break M&A access control

In an acquisition, the core technical problem is not just user migration. It is the clash between separate identity stores, application entitlements, and security policies that were never designed to interoperate. When teams rely on manual reconciliation or directory-to-directory trust workarounds, they create inconsistent states where accounts exist in one system but not another, policies differ by environment, and access decisions become hard to audit. That fragmentation undermines both control and speed because every exception becomes a one-off integration task.

Practical implication: map directory fragmentation and policy drift before the transaction closes, so access decisions are governed rather than improvised.

How inconsistent MFA enforcement creates security exposure

Multi-Factor Authentication is only effective if it is enforced consistently across the combined population. In an M&A scenario, one side may have MFA, conditional access, or stronger authentication controls while the other does not. That asymmetry creates a weakest-link problem, because attackers only need the less-protected identity path to enter the merged environment. The issue is not that MFA is missing somewhere in the abstract, but that integration often leaves enforcement uneven during the most sensitive part of the deal cycle.

Practical implication: make MFA parity a day-one integration requirement, not a post-merger cleanup task.

Why access provisioning becomes the bottleneck in divestitures

Divestitures reverse the merger problem. Instead of joining identities, the organisation must separate them cleanly so the carved-out entity can operate independently without retaining access to shared systems. That requires accurate identity ownership, entitlement scoping, and offboarding discipline. If access rights are copied too broadly or revoked too late, the departing business unit can keep unintended reach into corporate systems, creating compliance exposure and the possibility of post-separation incidents.

Practical implication: build separation workflows that revoke inherited access explicitly, rather than assuming the split will happen cleanly on its own.

Breaches seen in the wild

• JumpCloud breach 2023: North Korean hackers breached JumpCloud and abused its device commands framework against a few customers; all admin API keys were reset.
• Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity integration, not directory migration, is the real control problem in M&A: The article shows that the technical failure mode is not simply moving accounts from one tenant to another. It is the absence of a governed identity layer that can unify policy, access, and lifecycle decisions across incompatible environments. For IAM teams, that means the merger is won or lost on control consistency, not on administrative throughput.

Day-one access is a governance requirement, not a convenience feature: Delayed provisioning in M&A is more than an onboarding annoyance. It signals that identity has been treated as a back-office task instead of a transaction-critical control. When users wait weeks for access, the organisation pays twice, once in productivity loss and once in shadow workarounds that weaken security posture.

Identity blast radius: Fragmented IAM expands the number of places where access can drift, remain unreviewed, or be enforced differently after a deal closes. That broader blast radius is why M&A exposes weak lifecycle governance so quickly. The practitioner takeaway is that centralised identity governance must cover both the acquired population and the original estate from the moment integration begins.

Divestiture hygiene is the same identity discipline applied in reverse: The same weak controls that allow uncontrolled onboarding also allow incomplete offboarding. If the organisation cannot separate identities, entitlements, and resources cleanly, then a divestiture leaves behind residual access and compliance risk. The implication for practitioners is to manage separation as a first-class lifecycle event, not as a spreadsheet exercise after legal close.

What this signals

Identity integration is where merger risk becomes operational. The closer an M&A programme gets to close, the more identity policy becomes the mechanism that decides whether the combined business can function securely on day one. Teams should expect access governance, not infrastructure alone, to determine how much friction the deal creates.

Centralised identity control reduces the number of manual decisions that have to be made under deadline pressure. In practical terms, that means fewer exceptions, clearer policy enforcement, and less room for inconsistent authentication states to survive the integration window.

For practitioners

• Run an identity pre-close audit Inventory directories, authentication methods, application entitlements, and privileged accounts before the transaction closes. The goal is to identify where policy gaps and duplicated identities will block clean integration or separation.
• Set MFA parity as a day-one requirement Require the acquired or divested population to meet the same authentication baseline immediately, including MFA enforcement and conditional access where it exists in the target state.
• Establish a central identity authority Use one governed identity source as the control point for onboarding, offboarding, and access decisions across both organisations, instead of depending on ad hoc directory trust relationships.
• Design a separation workflow for divestitures Define how identities, entitlements, and shared resources will be revoked or reassigned so the carved-out business unit does not retain unintended access after the split.

Key takeaways

• M&A exposes weak IAM because separate directories, policies, and entitlements do not merge themselves into a governable access model.
• The article’s core operational signal is delayed provisioning, inconsistent MFA, and residual access during separation, all of which increase security and productivity risk.
• A central identity authority with explicit lifecycle and separation workflows is the control pattern that changes M&A from cleanup into governed integration.

Key terms

• Identity Integration: Identity integration is the process of connecting an external directory or identity source to the systems that provision and govern access. It reduces manual account creation and makes onboarding, policy application, and offboarding more repeatable. In MSP environments, it also helps keep the client’s source of truth aligned with operations.
• Disk Fragmentation: Disk fragmentation occurs when files grow into non-contiguous blocks across storage, forcing extra read and write work. In database and identity workloads, fragmentation can slow processing, increase I/O overhead, and make growth behavior less predictable as files expand over time.
• MFA Parity: MFA parity means both sides of a merged or separated environment enforce the same authentication baseline for equivalent users and access paths. In practice, it prevents the weaker side of the integration from becoming the entry point for attackers or the source of inconsistent user experience.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.