Notifications
Clear all
Topic starter
08/07/2026 6:58 pm
TL;DR: Hybrid identity remains the default for many organisations because Active Directory still supports legacy applications, regulatory constraints, and local control while Entra ID adds cloud-native SSO and MFA, according to IS Decisions. The real question is not cloud versus on-premises, but which identity model fits the organisation’s operational and security boundary.
NHIMG editorial — based on content published by IS Decisions: Active Directory vs. Entra ID: what should organisations choose?
By the numbers:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
Questions worth separating out
A: Security teams should govern authentication by mapping each access path to the directory that actually enforces policy, then applying MFA and contextual controls at the authentication edge.
Q: When should organisations keep Active Directory instead of moving fully to Entra ID?
A: Organisations should keep Active Directory when they still rely on legacy protocols, on-premises operational control, data residency constraints, or resilience requirements that cloud identity cannot replace.
Q: What do security teams get wrong about hybrid identity strategy?
A: Teams often treat hybrid identity as an interim compromise rather than an operating model that needs explicit governance.
Practitioner guidance
- Map identity control by workload location Separate legacy on-premises applications, regulated systems, and cloud SaaS into distinct governance buckets so the directory model matches the environment being authenticated.
- Enforce MFA at the authentication edge Apply MFA and contextual access controls at the point where users authenticate to Windows logon, RDP, VPN, OWA, and RemoteApp so legacy pathways are not left as exceptions.
- Document the hybrid operating model Write down which identities, applications, and access paths remain anchored to Active Directory and which move to cloud identity so security reviews reflect operational reality.
What's in the full article
IS Decisions' full article covers the operational detail this post intentionally leaves for the source:
- How the vendor applies MFA to specific AD authentication paths such as Windows logon, RDP, VPN, and OWA.
- How policy mapping works across users, groups, and organisational units without rebuilding the directory.
- What configuration overhead appears when bridging on-premises AD to cloud identity services.
- Which access security features are positioned for regulated or legacy environments that still depend on AD.
👉 Read IS Decisions' comparison of Active Directory and Entra ID for hybrid identity →
Active Directory vs. Entra ID: where should identity live now?
Explore further
08/07/2026 7:21 pm
Hybrid identity is not a transitional state for most enterprises. Many organisations will continue to run Active Directory and Entra ID side by side because legacy applications, compliance constraints, and operational continuity still depend on on-premises identity. That makes hybrid governance a permanent design problem, not a temporary migration artefact. IAM teams should treat the boundary between directory models as a control plane in its own right.
A few things that frame the scale:
- Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities, according to The 2024 Non-Human Identity Security Report.
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts, which shows how slowly governance models are catching up to machine identity sprawl.
A question worth separating out:
Q: What is the difference between directory control and cloud identity convenience?
A: Directory control means the organisation directly governs identity infrastructure, policy placement, and local continuity. Cloud identity convenience means the provider manages more of the underlying service while the organisation gains simpler access and built-in features. The trade-off is control versus operational simplicity, and practitioners should choose based on risk, resilience, and compliance requirements.
👉 Read our full editorial: Active Directory vs. Entra ID in hybrid identity governance
