Purple Knight in GCC High closes a federal identity assessment gap

At a glance

What this is: Semperis has extended Purple Knight into Microsoft Government Community Cloud High, closing a federal identity assessment gap between on-premises Active Directory and cloud Entra ID posture.

Why it matters: Federal and defence IAM teams need consistent identity assessment across hybrid environments, because Zero Trust and continuous monitoring fail when cloud tenants remain outside the same validation workflow as Active Directory.

By the numbers:

• Purple Knight scans for 210+ security indicators of exposure or compromise.

Context

Federal identity programmes have long had a split view of the environment: on-premises Active Directory could be checked, while GCC High Entra ID tenants were harder to assess in the same workflow. That creates a governance gap, not just a tooling inconvenience, because identity assurance becomes inconsistent across the hybrid boundary.

Microsoft Government Community Cloud High exists to satisfy FedRAMP High, ITAR, and DFARS requirements, so the question for practitioners is whether identity controls can be validated inside that boundary with the same discipline used elsewhere. Semperis is positioning Purple Knight as a way to close that assessment gap for federal and defence tenants.

The broader issue is that Zero Trust for government identity cannot rely on a single perimeter view. If the cloud tenant is outside normal assessment routines, then hardening, monitoring, and remediation become uneven across the environment.

Key questions

Q: How should federal IAM teams assess hybrid identity posture across GCC High and on-premises AD?

A: Use the same control baseline across both environments, then compare results for gaps in visibility, scoring, and remediation ownership. A hybrid programme is weak if one directory is continuously assessed while the other is only reviewed indirectly. The goal is not more scans. It is consistent evidence across the full identity boundary.

Q: Why does cloud identity coverage matter in federal Zero Trust programmes?

A: Zero Trust depends on continuous verification of identity posture, and that verification loses value if it stops at the data centre. Cloud tenants often hold privileged identities, administrative paths, and configuration drift that do not appear in on-premises checks. If the cloud side is missing, the programme is only partially verified.

Q: What breaks when GCC High tenants are left outside identity assessment workflows?

A: The hybrid baseline breaks first, then the remediation process becomes inconsistent. Teams can no longer compare cloud and on-premises findings cleanly, which makes risk acceptance, audit evidence, and prioritisation harder to defend when identity posture changes inside the regulated cloud boundary.

Q: How do federal identity teams know whether continuous monitoring is working?

A: They should look for parity between observed posture and remediation follow-through across every identity environment they operate. If scans produce findings in one environment but not another, or if cloud tenants are validated less often, monitoring is incomplete and posture drift is still possible.

How it works in practice

Why GCC High created an identity assessment blind spot

GCC High is a controlled Microsoft cloud environment used by many U.S. federal agencies and defence contractors, but specialised identity assessment tools have not always been able to scan it the same way they scan standard enterprise tenants. That matters because hybrid identity governance depends on parity of visibility across Active Directory and Entra ID. If one environment is observable and the other is not, findings, baselines, and remediation priorities diverge. The result is not just less telemetry but a weaker control model, because identity security posture becomes segmented by hosting boundary rather than by risk.

Practical implication: validate that your assessment tooling can reach every identity tenant you actually operate, including regulated cloud enclaves.

How cloud Entra ID assessment changes hybrid security validation

Hybrid identity assessment works when the same security indicators, scoring logic, and remediation workflow can be applied across both on-premises and cloud directories. Without that, teams end up comparing unlike environments and missing posture drift in the cloud. In federal contexts, that drift matters because GCC High tenants often carry stricter compliance expectations and higher consequences for misconfiguration. The technical issue is not whether the cloud is secure in principle, but whether identity hardening can be measured continuously inside the cloud identity plane rather than inferred from adjacent infrastructure checks.

Practical implication: extend baseline, scoring, and remediation workflows from Active Directory into cloud identity before treating hybrid posture as complete.

Why point-in-time identity checks are not enough for Zero Trust

Zero Trust assumes continuous verification, which means identity controls have to be checked in the same place and with the same regularity that access decisions are made. Point-in-time assessments still have value, but they leave gaps when identity state changes faster than review cycles. In regulated government environments, that gap is more dangerous because compensating controls are often expected to be provable, not just claimed. Continuous identity assessment does not replace response or recovery; it creates the evidence layer needed to show that identity controls remain effective across both directories and cloud tenants.

Practical implication: treat continuous identity verification as evidence for Zero Trust, not as a one-time compliance exercise.

NHI Mgmt Group analysis

Hybrid identity posture fails when assessment stops at the cloud boundary. The core problem in this announcement is not a new feature set, but the removal of a visibility exception for GCC High tenants. Federal programmes have long treated on-premises directory review and cloud tenant review as adjacent tasks rather than one governance surface. That separation weakens identity assurance because the most regulated environments are often the least tolerant of blind spots.

Zero Trust for federal identity is only credible when the same controls can be proven in both environments. Executive Order 14028, FISMA, and OMB guidance all point toward continuous monitoring and hardened identity systems, but those obligations are hard to defend if cloud identity remains outside the assessment workflow. The practical implication is that programme owners must measure whether their tooling can validate the whole hybrid estate, not just the part that is easiest to scan.

Assessment parity is now a governance requirement, not a convenience feature. When Active Directory can be scored but GCC High Entra ID cannot, risk acceptance becomes asymmetric and audit narratives become fragile. That asymmetry matters most for federal civilian agencies, DoD organisations, and defence contractors where compliance expectations are high and identity failure has operational consequences. Practitioners should treat parity of assessment as part of the control objective itself.

Continuous identity monitoring is the missing bridge between posture and response. A point-in-time scan can show exposure, but it does not prove that hardening persists after the scan or that drift is contained before the next review. In regulated hybrid environments, the real value is not the report alone, but the ability to keep identity validation aligned with change. Teams should re-evaluate whether their current monitoring model can sustain that cadence.

Five Eyes-aligned guidance is pushing identity teams toward evidence-based hardening. The significance of the Five Eyes recommendation is that it turns directory posture from a local administrative concern into a common control language for government identity security. That raises the bar for federal and defence programmes because baseline assessment tools become part of the compliance story, not an optional enhancement. Practitioners should align assessment coverage with the environments regulators and advisers expect them to validate.

What this signals

Hybrid identity parity is now the control question. Federal and defence programmes should assume that any identity environment they cannot assess with the same workflow is also the environment most likely to drift. The immediate planning question is whether cloud tenants, directories, and remediation evidence all sit inside one governance loop.

Identity hardening cannot be separated from evidence generation. In regulated environments, teams are not only asked to secure identities, but to prove that the security state is current. That means assessment tooling, monitoring cadence, and audit evidence have to be designed together, not bolted on after deployment.

For practitioners

• Extend assessment coverage into GCC High tenants Confirm that your identity assessment workflow reaches Microsoft Government Community Cloud High rather than stopping at standard enterprise tenants or on-premises Active Directory.
• Benchmark cloud and on-premises identity posture together Use the same scoring, indicator set, and remediation workflow for Entra ID and Active Directory so the hybrid estate is measured with one baseline.
• Map findings to federal hardening requirements Tie identity assessment outputs to the controls and expectations implied by Five Eyes guidance, Zero Trust principles, FISMA, and OMB Memorandum M-22-09.
• Prioritise continuous monitoring over one-time scans Treat periodic assessment as a starting point and add ongoing monitoring where identity drift in regulated cloud tenants would otherwise go unnoticed.
• Review evidence for audit-ready identity assurance Document how your assessment tooling proves posture in each regulated identity environment so the control story survives scrutiny from internal audit and external stakeholders.

Key takeaways

• The article is about closing a hybrid identity visibility gap, not about adding another scan mode.
• The key issue is parity between Active Directory and GCC High Entra ID, because governance breaks when only one side of the environment is visible.
• Practitioners should treat continuous identity assessment as part of the Zero Trust evidence model for regulated federal cloud estates.

Key terms

• Hybrid Identity: Hybrid identity is an architecture that connects on-premises directories with cloud identity providers and SaaS applications. It creates operational flexibility, but it also expands the blast radius of identity compromise across multiple systems that share trust and authentication dependencies.
• GCC High: Microsoft Government Community Cloud High is a restricted cloud environment used for workloads that must meet federal compliance requirements. In identity governance, it matters because visibility and assessment tools must operate inside the same boundary as the regulated workload or risk leaving privileged access unchecked.
• Identity Assessment Tooling: Software used to inspect directory configuration, exposure indicators, and remediation priorities across identity systems. In regulated environments, the value of this tooling is not just finding issues, but proving that the same checks can run consistently across every identity estate that matters.
• Continuous Identity Risk Monitoring: Continuous identity risk monitoring is the ongoing observation of identity activity to detect anomalies, policy violations, and emerging access issues. In SaaS environments, it helps teams find unsafe account behavior sooner, improve response times, and keep access aligned with current business needs and security rules.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.