Notifications
Clear all
Topic starter
07/06/2026 8:26 pm
TL;DR: Hybrid and multi-cloud environments expose a persistent gap between authenticating identities and authorising what they can do, especially when legacy apps cannot support modern methods and multiple identity providers multiply risk, according to Strata Identity. The practical issue is not confusion over terms, but programme design that treats identity proof and access enforcement as interchangeable controls.
NHIMG editorial — based on content published by Strata Identity: authentication and authorization in hybrid and multi-cloud identity access management
By the numbers:
- 25 years ago, username and password was the gold standard of authentication.
Questions worth separating out
Q: How should security teams separate authentication from authorization in hybrid cloud IAM?
A: Security teams should treat authentication as identity proof and authorization as a separate policy decision.
Q: When does strong authentication still leave an organization exposed?
A: Strong authentication still leaves an organisation exposed when authorization is inconsistent or over-broad.
Q: What do IAM teams get wrong about RBAC and ABAC?
A: Teams often assume RBAC or ABAC automatically solves access control, but those models only work when policy is consistent and current.
Practitioner guidance
- Separate proof from permission in your control design Document which systems authenticate identities and which systems authorise actions, then test for gaps where a verified identity can still reach sensitive resources through inherited policy or exception paths.
- Inventory legacy applications that block modern authentication List applications that cannot support SSO, MFA, or adaptive checks without wrappers or exceptions, and prioritise them as identity-risk migration work rather than pure application debt.
- Standardise authorization policy across cloud environments Use common policy patterns for RBAC and ABAC so access decisions do not drift between Azure, AWS, GCP, and on-prem systems, especially for executive, privileged, or regulated data.
What's in the full article
Strata Identity's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step examples of how authentication and authorization differ in everyday access flows.
- Specific guidance on SSO, MFA, adaptive authentication, RBAC, and ABAC in practice.
- How identity orchestration is positioned to bridge multiple identity silos without recoding legacy applications.
- The article's cloud and multi-cloud examples that show where the controls break down.
👉 Read Strata Identity's explanation of authentication and authorization in hybrid IAM →
Authentication vs authorization in multi-cloud IAM: what teams miss?
Explore further
07/06/2026 10:20 pm
Authentication and authorization fail for different reasons, and IAM programmes break when they collapse the two into one control story. Authentication proves a claim about identity. Authorization governs the resulting permissions. In hybrid and multi-cloud estates, teams that treat those as interchangeable often overestimate their security posture because proof of identity does not prevent over-broad access. The practitioner conclusion is to design each control as a separate decision point.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- 79% of organisations have experienced secrets leaks, and 77% of those incidents resulted in tangible damage.
A question worth separating out:
Q: How can organizations keep legacy apps compatible with modern access controls?
A: Organisations should place legacy apps into an explicit exception class and control them with orchestration, compensating policy, and staged migration plans. If older apps cannot support SSO or MFA directly, the risk is not only weaker login security but fragmented authorization logic that becomes harder to audit and govern over time.
👉 Read our full editorial: Authentication and authorization gaps in hybrid multi-cloud IAM
