How should access reviews be structured for hybrid Microsoft identities?

What a good hybrid identity access review must cover

Hybrid Microsoft access reviews work best when they treat Entra ID and on-premises Active Directory as one entitlement surface, not two separate exercises. The review scope should follow the access path, owner, business purpose and expiry of each account or role, so reviewers can judge whether access is still needed in the current operating model.

That means the review needs to include privileged roles, synced identities, guest accounts, service accounts and any delegated access that can still create effective control over resources. If the certification only covers one directory or only the user-facing account, it misses the real place where privilege is exercised.

A useful structure is to review by business role or application, then drill into the identities that inherit that role across cloud and on-premises systems. That makes it easier to see whether access exists because of active work, inherited group membership, stale delegation or a temporary exception that has quietly become permanent.

How to make the certification decision defensible

Each review item should force a simple decision: confirm the business need, confirm the approver or owner, or remove the access. For hybrid environments, that decision has to be based on the combined state of cloud and on-premises entitlements, because a user can appear clean in one system while still retaining effective access through the other.

Time-bound reviews are stronger than open-ended attestations because they create a revalidation point for privileged access, guest access and any entitlement granted for a project or migration. If expiry is absent, the review should compensate by demanding an explicit justification and a named owner who will carry the review forward.

Use the review to test whether ownership is real, not symbolic. If the approver cannot explain why the access exists, who depends on it, and when it should end, the certification has not answered the core control question.

Where hybrid Microsoft reviews usually fail

Hybrid reviews often fail when organisations certify accounts instead of access relationships. That leads to rubber-stamping of synced accounts, overlooked privileged role assignments, stale guest users, and service accounts that remain active long after the original need has disappeared. The same problem appears when teams review Entra ID access without checking on-premises group membership or local AD delegation.

Another common weakness is exception drift. Temporary approvals, migration shortcuts and emergency access can stay in place if the review process does not require revalidation at the next cycle. Over time, that creates hidden standing access that is technically approved but operationally unjustified.

Access Reviews and Certification Guide is a useful reference for designing reviews that reduce volume, add context and close the loop on remediation. Entra ID entitlement management and access packages can also help when the review process needs cleaner ownership, expiry and delegated administration across the Microsoft stack.

Risk and Threat Considerations

Hybrid identity reviews carry real risk because excess access in either directory can be used to pivot into business systems, administrative functions or sensitive data. The highest-risk failures are usually stale privileged access, uncontrolled guest accounts, and service or delegated accounts that remain active after the original business need has ended.

Failure mechanism: The review only validates one side of the hybrid identity plane, or it accepts an approval without verifying that the entitlement is still needed, so effective access survives through synchronization, delegation or inherited privilege.

Impact: Unused or excessive access remains available for misuse, lateral movement, privilege escalation or accidental abuse, and the organisation may believe it has removed access when it has only reduced visibility.

Practitioner Guidance

What to prioritise: Start with privileged roles, guest users, service accounts and any identity that crosses the cloud and on-premises boundary. These are the accounts most likely to retain access after the original business purpose has changed.

What to verify: For every certification item, verify the business owner, the approver, the expiry state, and whether the access exists through direct assignment, group membership, role inheritance or delegation. If you cannot explain the access path, the review is incomplete.

Practitioner takeaway: A hybrid review is only credible when it proves that access is still needed across the whole Microsoft estate, not just that an account exists in one directory.

Related resources from NHI Mgmt Group

• Guide: Access Reviews and Certification Guide
• How should security teams run access reviews for non-human identities?
• Why do non-human identities create gaps in traditional access reviews?
• Why do non-human identities make access reviews less effective?
• How can teams govern machine identities and AI agents in access reviews?