Topic starter
12/06/2026 10:23 pm
TL;DR: Organisations often cannot reliably tie Azure AD, AWS, Jenkins, and other accounts back to one employee, which creates access-control gaps and operational blind spots when accounts drift out of sync, according to Axiad. Identity correlation becomes a governance problem, not just a directory problem.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “Correlating Identities and Their Users”.
Key questions
Q: How should IAM teams correlate employee identities across multiple systems?
A: Start with a common identity model that maps each employee to all known account records, then compare stable attributes such as principal IDs, email addresses, and platform-specific usernames.
Q: Why do account silos create IAM risk?
A: Because access decisions become fragmented when the same person appears as separate accounts in different platforms.
Q: What are the signs that identity correlation is failing?
A: Look for users with mismatched usernames, duplicate emails, inconsistent principal IDs, or lifecycle events that affect one account but not the others.
Practitioner guidance
- Define a canonical employee identity model Use HR as the primary source for person-level identity, then map every downstream account to that record with explicit linkage rules and exception handling.
- Correlate accounts before access reviews Do not run certification processes against disconnected accounts.
- Establish confidence thresholds for matches Separate exact matches from probabilistic correlations and route low-confidence links to manual review before they affect lifecycle actions.
Bottom line: Multiple accounts for one employee are normal in modern environments, but they become a governance risk when no system can reliably link them back to one person.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
13/06/2026 1:06 am
Identity correlation is now a governance primitive, not an enrichment feature: When a single employee exists as several disconnected accounts, IAM loses the ability to apply one lifecycle decision consistently across the estate. That is not merely a visibility issue. It changes whether onboarding, mover, and leaver processes can be enforced with confidence across systems.
A question worth separating out:
Q: When should organisations treat account mismatches as governance exceptions?
A: Treat them as exceptions whenever a person can be onboarded, moved, or offboarded in one system while remaining unlinked or active in another. That is a lifecycle control failure, not a data tidy-up issue, and it needs formal ownership until the identity record is reconciled.
👉 Read our full editorial: Correlating employee identities across account silos reduces IAM risk
This post was modified 6 days ago by NHI Mgmt Group