Notifications
Clear all
Topic starter
25/05/2026 8:33 pm
TL;DR: Hybrid Microsoft directory environments create inconsistent policies, orphaned accounts, and delayed offboarding when teams rely on manual administration across AD and Entra ID, according to One Identity. Automation shifts joiner-mover-leaver handling, least privilege, and just-in-time access from repetitive effort to governed workflows, which is now a security baseline rather than an efficiency tweak.
NHIMG editorial — based on content published by One Identity: Best practices for hybrid Active Directory automation
By the numbers:
- Workers reportedly use an average of 11 apps a day.
- PCI DSS specifies that when passwords or phrases are the sole authentication factor for user access, they must be changed at least once every 90 days.
Questions worth separating out
Q: How should teams govern hybrid Active Directory and Entra ID at the same time?
A: Treat hybrid identity as one governance domain with multiple execution surfaces.
Q: When does just-in-time access reduce risk in hybrid identity environments?
A: Just-in-time access reduces risk when elevated privileges are short-lived, conditional, and tied to a specific task.
Q: What is the difference between manual access administration and automated lifecycle governance?
A: Manual administration depends on individual action at the moment a change is needed, while lifecycle governance turns identity changes into policy-driven workflows.
Practitioner guidance
- Map every identity lifecycle event to an authoritative trigger Connect joiner, mover, and leaver workflows to HR or approved directory attributes so account creation, group changes, and revocation happen without manual tickets.
- Eliminate orphaned and one-off accounts on a fixed schedule Inventory project accounts, test accounts, and legacy application identities, assign owners, and remove any account that no longer has a valid business purpose.
- Scope privileged access to a short approval window Use just-in-time access with conditional access rules so elevated roles are time-bound, device-bound, and region-aware.
The more identity decisions stay in human memory or ad hoc practice, the more likely they are to produce drift, stale access, and weak audit evidence?
👉 Read One Identity's analysis of hybrid Active Directory automation best practices →
Explore further
25/06/2026 2:10 am
Hybrid AD automation is now a governance requirement, not a convenience feature. The core problem is not that administrators lack skill. It is that repetitive identity operations across AD, Entra ID, and Microsoft 365 create drift, inconsistency, and delayed response. In NHI governance terms, the same pattern applies to service accounts and other machine identities: lifecycle discipline matters more than the interface used to manage it.
A few things that frame the scale:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems.
A question worth separating out:
A: Hybrid environments increase risk because each directory, tenant, and console can develop different rules, timing, and exceptions. That fragmentation makes it easier for privileges to drift, harder to spot orphaned accounts, and slower to prove that offboarding or role changes were completed correctly.
👉 Read our full editorial: Hybrid Active Directory automation closes the identity governance gap
