Topic starter
06/06/2026 11:08 am
TL;DR: Enterprises have accelerated into multi-cloud environments while identity governance, access control, and visibility struggle to keep up, according to Strata Identity’s State of Multi-Cloud Identity report. The real issue is not cloud adoption itself but the assumption that identity controls built for a single environment will still hold across distributed platforms and workloads.
Editorial analysis by NHI Mgmt Group, based on content published by Strata Identity: “Identity & Access Management”.
Key questions
Q: What breaks when identity governance is split across cloud and on-premise systems?
A: The biggest failure is inconsistent control ownership.
Q: Why do multi-cloud environments create more identity risk than single-cloud estates?
A: Because the risk sits in the gaps between providers.
Q: How can security teams tell whether multi-cloud IAM is actually under control?
A: Look for a normalized inventory of identities and entitlements, consistent review outcomes across clouds, and revocation that reaches every platform where access exists.
Practitioner guidance
- Define the authoritative identity boundary Map which identities, entitlements, and lifecycle events are governed centrally and which remain native to each cloud platform.
- Normalise cross-cloud identity inventory Create one inventory model for humans, service accounts, workload identities, and federated access paths so governance teams can compare entitlements across providers.
- Rework access reviews for distributed estates Align recertification and entitlement review to the actual cloud footprint rather than to a single provider’s administrative view.
Bottom line: Multi-cloud identity governance fails when the operating model assumes a single control boundary that no longer exists.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/06/2026 11:45 am
Multi-cloud identity governance breaks when control boundaries no longer match the estate. The article describes a world where identity decisions are still expected to behave as if the organisation had one coherent platform, one administration layer, and one view of access. That assumption does not survive multi-cloud reality, where each environment introduces its own semantics and blind spots. Practitioners should treat this as a governance boundary problem, not a cloud migration side effect.
A question worth separating out:
Q: How should organisations design IAM for cloud adoption without weakening access control?
A: Organisations should treat IAM as a governance layer, not just a login tool. Define who can access which resources, at what privilege level, and under what conditions. Pair role-based access, multi-factor authentication, and automated lifecycle controls so access changes follow job changes. This reduces overexposure as cloud applications expand and helps keep audit evidence consistent across platforms.
👉 Read our full editorial: Multi-cloud identity governance is reaching its breaking point