Topic starter
06/11/2026 6:40 pm
TL;DR: Group management remains difficult because organisations inherit inconsistent group models, span them across AD, Entra and SaaS platforms, and then layer manual changes on top of changing identity data, according to READI. NHI Mgmt Group sees this as a governance problem, not a tooling problem: groups fail when lifecycle discipline, source trust and drift control are not managed together.
Editorial analysis by NHI Mgmt Group, based on content published by READI: “Why is Group Management so Painful?”.
Key questions
Q: How do teams govern group membership across multiple identity systems?
A: Teams govern group membership across multiple identity systems by using a single policy model, with a designated source of truth, synchronised rule logic, and periodic reconciliation.
Q: Why do manual group changes create access drift?
A: Manual group changes create access drift because they bypass the identity governance process and are often not reflected in other connected directories, applications, or entitlements.
Q: How should identity teams handle conflicting attributes in group rules?
A: Identity teams should resolve conflicting attributes by applying a clear precedence order in the rule engine, so the same group logic does not evaluate differently across sources.
Practitioner guidance
- Map every authoritative group source Inventory where group membership is created, modified and consumed across directories, cloud platforms and SaaS systems.
- Eliminate unmanaged manual edits Require every group change to be attributable to a governed workflow, then alert on direct membership changes that bypass the approved process.
- Define attribute precedence for group rules Document which identity sources win when HR, directory and application attributes disagree, especially for role, location and employment status.
Bottom line: Group management becomes unreliable when the same access model is stretched across many directories and applications without consistent ownership.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:42 pm
Group governance fails when membership logic is fragmented across systems: The same identity may be evaluated differently in AD, Entra and SaaS applications, so no single policy layer fully governs access. That creates an environment where group membership becomes locally correct but globally inconsistent. The practitioner lesson is to treat group logic as an enterprise control plane problem, not a directory administration task.
A question worth separating out:
Q: What is the best way to detect group membership drift?
A: Detect group membership drift by comparing live directory group membership against an approved entitlement baseline, then flagging any added or removed users for review. Use automated access recertification, change alerts from the directory service, and exception handling for privileged groups. The key failure mode is stale or unauthorised group access persisting after role changes or offboarding.
👉 Read our full editorial: Why group governance breaks down across modern identity estates