Notifications
Clear all
Topic starter
09/07/2026 3:26 pm
TL;DR: Hybrid identity environments create a single failure domain across AD and Entra ID, so outages, deletions, or corruption can quickly lock users out of critical systems and halt incident response, according to Commvault. The practical issue is not just backup coverage, but whether identity recovery is fast, granular, and unified enough to preserve access when directory services fail.
NHIMG editorial — based on content published by Commvault: hybrid identity protection for Active Directory and Entra ID
Questions worth separating out
Q: What breaks when AD and Entra ID are not protected as one system?
A: When AD and Entra ID are treated as separate recovery domains, a failure in one can leave identity data inconsistent across both.
Q: Why do hybrid identity outages affect more than login access?
A: Hybrid identity outages affect more than login because directory services control the relationships that make access work.
Q: How do security teams know whether identity recovery is actually working?
A: They know it is working when they can restore specific objects, policies, and relationships without rebuilding the full directory.
Practitioner guidance
- Define a hybrid identity recovery scope Classify AD and Entra ID as one operational recovery domain and document the objects, policies, and relationships that must be restored together.
- Test object-level restore paths Run recovery exercises that restore missing or overwritten attributes, not just entire directories.
- Measure identity recovery time objectives Set recovery targets for authentication services, directory objects, and policy rollback.
What's in the full article
Commvault's full article covers the operational detail this post intentionally leaves for the source:
- Automated forest recovery workflows for Active Directory, including runbook generation and point-and-click recovery steps.
- Detailed coverage of granular restore options for users, groups, Group Policy Objects, roles, and conditional access policies.
- Interactive domain and tenant-wide comparison capabilities for spotting deleted objects and overwritten attributes.
- Centralised management details for teams that need to oversee identity recovery alongside other protected workloads.
👉 Read Commvault's analysis of hybrid AD and Entra ID protection →
Hybrid identity protection gaps in AD and Entra ID: are controls keeping up?
Explore further
09/07/2026 3:46 pm
Hybrid identity resilience fails when organisations treat AD and Entra ID as separate recovery problems. In practice, the identity layer is already shared, because directory data, policies, and access dependencies flow between the two systems. The relevant question is not which platform failed first, but whether recovery is coordinated across the full identity graph. Practitioners should assume a single failure domain until proven otherwise.
A few things that frame the scale:
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts, according to The 2024 Non-Human Identity Security Report.
- Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities, according to The 2024 Non-Human Identity Security Report.
A question worth separating out:
Q: Who is accountable when hybrid identity protection fails?
A: IAM, infrastructure, and security leadership all share accountability because directory services underpin access across the enterprise. In practice, accountability should include recovery objectives, backup coverage, and restore testing for both AD and Entra ID. If identity is a business-critical service, it needs named ownership at that level.
👉 Read our full editorial: Hybrid identity protection gaps expose AD and Entra ID resilience
