Topic starter
09/07/2026 3:23 pm
TL;DR: Identity remains the primary attack surface in Microsoft environments, with stolen credentials driving 31% of breaches and cloud account compromise affecting 46% of organisations, according to Verizon and Netwrix research. Native Entra ID controls are necessary, but hybrid visibility, audit retention, and privileged access still require additional governance layers.
Editorial analysis by NHI Mgmt Group, based on content published by Netwrix: “8 Entra ID security solutions to harden identity in 2026”.
By the numbers:
- Stolen credentials were the initial access vector in 31% of breaches.
- The Netwrix 2025 Cybersecurity Trends Report puts cloud account compromise at 46% of organizations in 2025.
Key questions
Q: Where does Entra ID security fail in hybrid Microsoft environments?
A: It fails where control data is split between on-premises Active Directory and the cloud.
Q: Why do native identity controls not fully solve hybrid audit and access risk?
A: Because the operational problem is broader than authentication.
Q: What are the signs that privileged access in Entra ID is still too persistent?
A: Look for admin roles that are activated but not fully removed, tokens that remain reusable after the task is complete, and workflows that depend on long-lived privileged credentials.
Practitioner guidance
- Correlate both identity planes Map every change, authentication event, and privileged action across on-premises Active Directory and Entra ID so investigations can follow one identity path instead of two disconnected logs.
- Extend audit retention beyond native limits Route identity logs into storage that matches SOX, HIPAA, or internal evidence requirements, and verify that role changes, consent grants, and Conditional Access edits remain retrievable.
- Replace standing admin access with session-scoped privilege Use just-in-time privileged access for administrative tasks so elevated accounts are issued only when needed and destroyed at session end.
Bottom line: Hybrid Microsoft environments still leave identity governance gaps even when native Entra ID controls are in place.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 3:42 pm
Hybrid identity governance fails when cloud controls are treated as the whole control plane. Entra ID can secure the cloud boundary, but it does not erase the governance burden created by on-premises Active Directory, legacy protocols, and cross-plane administration. The practical issue is not feature overlap, but whether identity events can be governed as one estate across two execution planes.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations add third-party identity tooling if they already use Microsoft Entra ID?
A: Yes, when the native stack does not cover the full hybrid operating model. The decision usually turns on whether you need cross-plane detection, longer audit evidence, or session-scoped privileged access. If any of those are gaps, native controls are a baseline, not a complete programme.
👉 Read our full editorial: Entra ID security solutions expose the hybrid identity gap