Notifications
Clear all
Topic starter
25/06/2026 3:12 pm
TL;DR: Manual onboarding, review, and offboarding in Active Directory still produce lingering access, privilege creep, and audit gaps, according to SecurEnds. The practical shift is to treat identity lifecycle management as a governance control, not an IT convenience, because delayed deprovisioning and spreadsheet-based reviews leave accounts active after roles change or people leave.
NHIMG editorial — based on content published by SecurEnds: Identity lifecycle management for Active Directory users and access reviews
By the numbers:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
Questions worth separating out
Q: What breaks when identity lifecycle management is manual in Active Directory?
A: Manual lifecycle management breaks when account creation, group changes, and offboarding rely on tickets, spreadsheets, and memory.
Q: Why do identity lifecycle failures matter beyond human accounts?
A: Lifecycle failures matter beyond human accounts because service accounts, API keys, and certificates suffer the same drift when ownership, review, and revocation are inconsistent.
Q: How do security teams know if access reviews are actually working?
A: Access reviews are working only when reviewers can see current entitlements, clear ownership, and a complete decision trail.
Practitioner guidance
- Bind provisioning to a source of truth Connect joiner and mover events to HR or contractor records so role changes update group membership automatically instead of waiting for manual tickets.
- Replace spreadsheet certifications with governed review workflows Use a system that shows current entitlements, named owners, and prior decisions so managers can certify or revoke access with evidence that auditors can trace.
- Automate offboarding as a hard control Trigger account disablement, group removal, and token revocation at the point the source record changes to inactive so access does not linger after departure.
What's in the full article
SecurEnds' full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step identity lifecycle automation for Active Directory and Azure AD environments.
- The example rollout sequence for connecting HR triggers to provisioning and deprovisioning.
- A worked SOX-oriented audit workflow for quarterly access certification.
- The practical dashboard outputs used to track ownership, review status, and removals.
👉 Read SecurEnds' guide to automating identity lifecycle management in Active Directory →
Active Directory lifecycle management: where manual access reviews fail?
Explore further
25/06/2026 4:35 pm
Manual identity lifecycle management is a control failure, not a process preference. The article shows that once provisioning, review, and revocation are handled through email and spreadsheets, the organisation loses authoritative control over who should have access. That is true for human identities in Active Directory and just as true for NHI credentials that follow the same unmanaged lifecycle pattern. The practitioner conclusion is straightforward: if the lifecycle is not governed centrally, it is not governed at all.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
A question worth separating out:
Q: Who is accountable when stale access remains after offboarding?
A: Accountability sits with the identity and business owners who approve access, the process owners who govern offboarding, and the control owners who failed to enforce revocation. In regulated environments, that failure also becomes an audit issue because access should end when the employment or contract relationship ends.
👉 Read our full editorial: Identity lifecycle management for Active Directory users is still brittle
