Notifications
Clear all
Topic starter
12/07/2026 12:22 pm
TL;DR: Hybrid identity has shifted from a transitional phase to a long-term operating model, and Active Directory still anchors authentication across many environments even as cloud services expand, according to IS Decisions. That reality makes legacy directory security gaps, not migration timelines, the practical issue IAM teams must confront.
NHIMG editorial — based on content published by IS Decisions: Active Directory in hybrid identity is not going away
By the numbers:
- An 8KB database page size now increases to an optional 32KB for admins that want to expand the size of directory objects beyond current limits.
Questions worth separating out
A: Security teams should govern authentication by mapping each access path to the directory that actually enforces policy, then applying MFA and contextual controls at the authentication edge.
Q: Why does Active Directory still matter to modern identity programmes?
A: Active Directory still matters because it often acts as the authoritative control plane for authentication, group-based authorisation, and privileged administration.
Q: What fails when Active Directory is treated as complete security by default?
A: The programme misses controls that modern identity models assume, including MFA, conditional access, monitoring, and session governance.
Practitioner guidance
- Inventory the identities still anchored in Active Directory Document which users, service accounts, certificates, and application links still rely on AD as the source of truth.
- Separate native controls from bolt-on controls List which protections are delivered by Active Directory itself and which depend on adjacent tooling for MFA, session control, monitoring, or conditional access.
- Reduce directory object and membership drift Review user objects, application attributes, and group memberships for fields that no longer serve access decisions.
What's in the full article
IS Decisions' full article covers the operational detail this post intentionally leaves for the source:
- The specific Windows Server 2025 functional level changes and what they mean for domain controller interoperability
- The article's examples of how UserLock extends Group Policy Objects for MFA, session management, and real-time monitoring
- The practical discussion of concurrent sessions, RDS, terminal, and VPN connection control in a hybrid estate
- The author's full argument for why Active Directory remains a long-term identity anchor in mixed environments
👉 Read IS Decisions' analysis of Active Directory security in hybrid identity →
Active Directory in hybrid identity: what IAM teams need now?
Explore further
12/07/2026 12:36 pm
Hybrid identity has become the default operating model, so Active Directory governance is now a permanent discipline rather than a migration bridge. The article correctly describes hybrid as long-term for many organisations, which means identity teams cannot plan around a clean cutover to cloud-only control. The practical implication is that AD remains a governance anchor even when cloud identity grows around it.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing how remediation windows stay open longer than teams expect.
A question worth separating out:
Q: How do teams reduce risk when AD remains the primary identity store?
A: They should focus on explicit control layering, not directory nostalgia. That means tightening group memberships, validating federation paths, adding session and access monitoring, and proving that cloud and on-premises enforcement are both working before they rely on the directory as the authority.
👉 Read our full editorial: Active Directory in hybrid identity is not going away
