Active Directory sprawl and identity governance: what teams miss

AD sprawl is a lifecycle governance failure before it is a technical one. The underlying problem is not that directories grow. It is that lifecycle processes stop being able to prove what should remain, what should be removed, and what still matters downstream. Once that proof disappears, decommissioning gets pushed into indefinite deferral. Practitioners should treat directory complexity as an identity governance signal, not an infrastructure inconvenience.

A few things that frame the scale:

• 1 in 4 organisations are already investing in dedicated NHI security capabilities, with an additional 60% planning to do so within the next twelve months, according to The State of Non-Human Identity Security.
• Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared with nearly 1 in 4 for securing human identities.

A question worth separating out:

Q: What should organisations prioritise first in AD sprawl remediation?

A: They should prioritise the highest-confidence fixes first, such as empty groups, duplicated accounts, and unowned privileged access. Those changes reduce risk quickly and create evidence that the programme can safely expand into more complex forests and trust relationships. Early wins build the trust needed for deeper cleanup.

👉 Read our full editorial: Active Directory sprawl is exposing identity governance blind spots