What do security teams get wrong about identity orchestration in hybrid environments?

Why This Matters for Security Teams

Identity orchestration is often introduced as the practical bridge between legacy directories, cloud services, and newer authentication patterns, but the operational mistake is assuming the bridge is the destination. Security teams inherit duplicated entitlements, stale service accounts, and inconsistent policy enforcement when orchestration is layered on top of an unchanged control plane. NIST Cybersecurity Framework 2.0 frames the issue well: identity and access decisions must support risk governance, not simply connectivity.

That matters because orchestration can hide dependency, not remove it. If the legacy directory still authorises critical paths, the organisation has only added another layer to manage during incidents, audits, and migrations. NHIMG research on the Ultimate Guide to NHIs shows why this is more than a theory problem: NHIs outnumber human identities by 25x to 50x in modern enterprises, so every orchestration gap scales quickly across service accounts, API keys, and automation workflows. In practice, many security teams encounter the failure only after a migration stalls or a legacy identity path is exploited, rather than through intentional retirement planning.

How It Works in Practice

Effective orchestration coordinates identity state across systems during transition, then steadily reduces reliance on the old authority. That means synchronising identities, normalising attributes, enforcing consistent policy, and tracking where authentication and authorisation still depend on the legacy directory. For hybrid environments, the best approach is usually to treat orchestration as a lifecycle capability: provision, modify, attest, revoke, and retire.

Practitioners usually get better outcomes when they separate three layers:

• Source of truth for identity attributes, which may not be the same as the runtime authoriser.
• Policy decision points, which should reflect current business rules rather than directory structure.
• Execution paths, which must be monitored so access can be withdrawn when the migration stage changes.

This is where NIST guidance is useful: CSF 2.0 expects organisations to establish control and accountability across identity services, while operationally the team must verify that the old directory is no longer the only place where entitlements can be granted. NHIMG’s State of Non-Human Identity Security reports that only 1.5 out of 10 organisations are highly confident in securing NHIs, which is a reminder that orchestration without visibility creates false confidence. External standards such as NIST Cybersecurity Framework 2.0 and modern identity governance practices both point to the same operational rule: orchestrate to move authority, not to preserve it.

Hybrid orchestration should also account for non-human identities. Service accounts, workload identities, and API credentials often bypass the human IAM processes that orchestration tools were originally designed to support. If those identities remain tied to long-lived permissions in the legacy stack, the migration creates parallel control planes and inconsistent revocation. These controls tend to break down when mainframe, directory federation, and SaaS provisioning are all managed by different teams because policy drift becomes invisible between release cycles.

Common Variations and Edge Cases

Tighter orchestration often increases migration overhead, requiring organisations to balance speed against control consistency. That tradeoff becomes sharper in environments with mergers, regulated workloads, or application owners who cannot change authentication patterns quickly.

There is no universal standard for hybrid identity orchestration yet, so current guidance suggests making the transition explicit in governance documents. A mature programme should define when the legacy directory is authoritative, when it is read-only, and when it is retired. It should also distinguish between human access, application access, and machine-to-machine access, because each moves on a different timeline.

One common edge case is partial federation: the cloud side appears modern, but the legacy side still stores privileged groups or emergency access. Another is directory sync used as a substitute for entitlement cleanup, which keeps stale access alive even after an application has moved. NHIMG’s Top 10 NHI Issues and 52 NHI Breaches Analysis both reinforce the same lesson: the risk is not orchestration itself, but leaving long-lived identity dependencies in place after the business believes the transition is complete.

Related resources from NHI Mgmt Group

• What do security teams get wrong about eBPF and identity enforcement?
• What do security teams get wrong about low-latency identity controls?
• What do security teams get wrong about zero trust in agentic access environments?
• What do security teams get wrong about workload identity in cloud and CI/CD environments?