Topic starter
24/06/2026 9:08 pm
TL;DR: Opal Security shows that mergers and acquisitions are turning access governance into a multi-IDP problem, with duplicated users, conflicting sources of truth, and inconsistent policy enforcement across Okta, Entra, Google Workspace, and legacy systems. Standardisation alone does not solve the governance burden; organisations need to manage heterogeneity directly.
Editorial analysis by NHI Mgmt Group, based on content published by Opal Security: “Scaling Security through M&A: How Opal Simplifies Access Management for Growing Organizations”.
Key questions
Q: What breaks when an acquired company keeps its own identity provider?
A: Access governance breaks when teams assume one source of truth still exists after acquisition.
Q: When should organisations prioritise multi-source governance over directory consolidation?
A: Organisations should prioritise multi-source governance when consolidation would take years, disrupt critical workflows, or delay the security posture needed for the next acquisition.
Q: What do security teams get wrong about M&A access management?
A: Teams often treat identity sprawl as a temporary inconvenience and try to eliminate it with a fast migration.
Practitioner guidance
- Define identity ownership by source system Document which directory, HR feed, or access platform owns each user population and attribute set before integration begins.
- Implement cross-directory identity resolution Link duplicate accounts for the same person across Entra, Okta, Google Workspace, and legacy directories so approvals and revocation follow the individual rather than the username.
- Preserve source-specific attribute namespaces Keep tags and attributes separate by source instead of normalising them into a single merged schema.
Bottom line: M&A creates identity sprawl that turns access governance into a multi-system problem rather than a single-directory administration task.
What's in the full article
Opal Security's full product post covers the operational detail this post intentionally leaves for the source:
- Deployment patterns for hub-and-spoke and multi-source identity governance across acquired environments
- How secondary email resolution and identity matching work across separate identity providers
- Operational examples of cross-system group management and access request routing
- Practical details on unified catalog views, access reviews, and conflict resolution rules
👉 Read Opal Security's analysis of M&A identity complexity and access governance →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 6:10 am
M&A identity sprawl is now a governance state, not an integration bug. The article shows that security teams inherit multiple identity providers, overlapping usernames, and inconsistent policies as a normal outcome of acquisition. That means the core identity problem is no longer how to eliminate diversity, but how to govern it without losing auditability or lifecycle control. The practitioner conclusion is that architecture heterogeneity must be treated as a permanent input to IAM design.
A question worth separating out:
Q: How should IAM teams govern digital IDs in a multi-provider ecosystem?
A: Treat the ecosystem as a shared trust fabric, not a single authentication tool. Governance needs clear assurance criteria, consent rules, attribute minimisation, revocation paths, and independent certification. If those controls are inconsistent across providers, users may still authenticate successfully while the underlying trust state is no longer valid.
👉 Read our full editorial: M&A identity complexity is reshaping access governance models