Topic starter
08/07/2026 6:58 pm
TL;DR: Hybrid identity remains the default for many organisations because Active Directory still supports legacy applications, regulatory constraints, and local control while Entra ID adds cloud-native SSO and MFA, according to IS Decisions. The real question is not cloud versus on-premises, but which identity model fits the organisation’s operational and security boundary.
Editorial analysis by NHI Mgmt Group, based on content published by IS Decisions: “Active Directory vs Entra ID”.
Key questions
A: Security teams should govern authentication by mapping each access path to the directory that actually enforces policy, then applying MFA and contextual controls at the authentication edge.
Q: When should organisations keep Active Directory instead of moving fully to Entra ID?
A: Organisations should keep Active Directory when they still rely on legacy protocols, on-premises operational control, data residency constraints, or resilience requirements that cloud identity cannot replace.
Q: What happens when MFA is added too late in a hybrid identity model?
A: Authentication gaps remain at the directory edge, especially for remote access, privileged logon and legacy pathways that were never built for cloud-first controls.
Practitioner guidance
- Inventory identity dependencies by workload Separate applications that depend on AD protocols or local directory control from those that can operate cleanly through cloud identity.
- Strengthen authentication at the directory edge Add MFA and contextual access controls at the point where AD authentication occurs, including remote access and privileged logon paths.
- Document residency and continuity requirements Record where data residency, offline resilience and legacy protocol support are mandatory.
Bottom line: The core issue is not cloud versus on-premises identity, but which system should remain authoritative for the organisation’s access boundary.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/07/2026 7:21 pm
Hybrid identity is now a governance model, not a transition state. Many organisations still treat Active Directory as legacy infrastructure that will eventually disappear, but the article reflects a more durable reality. Legacy application support, residency requirements and offline continuity keep AD relevant long after cloud migration plans are written. The implication is that identity strategy must be designed for coexistence, not for a single destination.
A question worth separating out:
Q: What is the difference between Active Directory and Entra ID in a hybrid identity architecture?
A: Active Directory is the traditional on-premises identity system, giving organisations direct control over authentication, policy, and data residency. Entra ID is the cloud-first directory service that centralises identity management and integrates more naturally with Microsoft 365 and other SaaS services. The practical distinction is control versus cloud convenience, with hybrid environments often using both for different access needs.
👉 Read our full editorial: Active Directory vs. Entra ID in hybrid identity governance