Topic starter
12/07/2026 12:22 pm
TL;DR: Hybrid identity has shifted from a transitional phase to a long-term operating model, and Active Directory still anchors authentication across many environments even as cloud services expand, according to IS Decisions. That reality makes legacy directory security gaps, not migration timelines, the practical issue IAM teams must confront.
Editorial analysis by NHI Mgmt Group, based on content published by IS Decisions: “Why hybrid identity is the long game, not a stepping stone to the cloud”.
Key questions
Q: Why does hybrid identity keep Active Directory in scope for IAM teams?
A: Because many organisations still depend on Active Directory to anchor authentication, group membership, and legacy application access even after adopting cloud services.
Q: What are the main security gaps when Active Directory sits beside cloud identity platforms?
A: The main gaps are inconsistent controls across authentication, monitoring, and session governance.
Q: What do security teams get wrong about hybrid Active Directory governance?
A: They often treat on-premises AD and cloud identity as separate problems, even when the same account is synchronised across both.
Practitioner guidance
- Treat Active Directory as a permanent identity service Map AD into your ongoing identity security programme, with explicit ownership for authentication, group governance, and privileged paths across hybrid estates.
- Add compensating controls around AD sessions Use MFA, session controls, and real-time monitoring where the directory itself does not provide those capabilities natively, especially for remote and privileged access.
- Review directory object growth and attribute sprawl Assess whether user and device objects are approaching size and complexity limits as cloud-linked attributes, certificates, and memberships accumulate.
Bottom line: Hybrid identity has become a durable operating model, so Active Directory must be managed as a live security surface rather than a transitional dependency.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:36 pm
Hybrid identity governance now has to assume permanence, not transition. The article makes clear that many organisations are no longer moving through hybrid on the way to something else. That matters because governance models built around eventual simplification tend to underinvest in the controls needed to operate two identity planes at once. Practitioner conclusion: treat hybrid identity as the steady state and govern it accordingly.
A question worth separating out:
Q: When should organisations keep Active Directory instead of moving fully to Entra ID?
A: Organisations should keep Active Directory when they still rely on legacy protocols, on-premises operational control, data residency constraints, or resilience requirements that cloud identity cannot replace. The decision is driven by workload fit and governance needs, not by cloud migration pressure. If identity supports critical local systems, on-premises control can remain the safer operating model.
👉 Read our full editorial: Active Directory in hybrid identity is not going away