What should identity leaders prioritise when mergers add multiple directories?

How to approach directory overlap after a merger

The first priority is to establish which directory is authoritative for each population, region, business unit, and application dependency. If that is unclear, consolidation turns into accidental replication, where the same person, group, or role is managed in two places with different outcomes. A clean ownership map also tells you where identity data can be merged safely and where separation must be preserved for legal, operational, or divestiture reasons.

Identity teams should treat the merge as a control-design exercise, not just a directory migration. That means deciding how matching rules will work, how conflicts will be resolved, and which source of truth wins when attributes disagree. It also means planning for account linking, duplicate resolution, and the retirement of groups or local policies that no longer belong in the target model.

For merger programmes that need a practical starting point, Identity Integration in M&A Guide is the most directly relevant internal reference because it covers directory consolidation, day one access, and inherited identity risk.

Where identity risk accumulates during consolidation

The main risk is not the existence of multiple directories by itself, but the period where both directories remain partially trusted while business operations continue. That is when duplicate identities, orphaned accounts, stale groups, and parallel role models can create broader access than anyone intended. If merge decisions are made too late, the organisation can inherit control drift from the acquired environment instead of resetting it.

Another common failure mode is overconfident automation. Matching logic can help reconcile large populations, but it cannot safely infer authority when naming conventions, employee IDs, contractors, or shared accounts are inconsistent. Where identity data quality is poor, the safer approach is to validate high-risk accounts manually before any bulk merge or decommission step.

For the operational controls that usually need hardening first, the Active Directory and Entra ID Hardening Guide is useful because it focuses on privileged groups, delegation, and hybrid identity risks that often become more visible during consolidation.

What should be merged, linked, or separated

The useful distinction is between identity representation and access entitlement. Users may be linked across directories, but their permissions should be revalidated rather than assumed equivalent. Groups and roles deserve even more scrutiny because they often encode local exceptions, legacy application access, or inherited administrative rights that do not belong in the target structure.

In practice, that means keeping three questions separate: who is the person or workload, what access they should retain, and which directory is responsible for asserting that access. Where those answers differ across environments, the merger plan should preserve separation until the business has agreed the target model. That is especially important when one directory contains service identities or application bindings that should not be collapsed into the same governance path as user identities.

If the programme needs a broader view of how access sprawl and inherited privileges show up across identity populations, Top 10 NHI Issues is a useful companion because it highlights the control failures that appear when accounts, secrets, and permissions outlive their original ownership.

Practitioner Guidance

What to prioritise: Start with authoritative source selection, duplicate detection, and a clear rule for which directory owns which identity attributes. Without that, every later merge step becomes a guessing exercise.

What to verify: Confirm that high-risk groups, privileged roles, and any locally managed access paths have been reviewed before cutover. A successful consolidation should reduce ambiguity, not merely move it into a new directory.

Decision rule: If two directories disagree on identity state or privilege, do not auto-merge the account until an owner has validated the access outcome. In merger environments, mistaken equivalence is usually more dangerous than temporary duplication.

Practitioner takeaway: The objective is not to make directories look uniform as quickly as possible, but to reach a defensible target state where every identity, group, and role has one accountable owner and one clear access truth.

Related resources from NHI Mgmt Group

• What should healthcare security leaders prioritise after an identity-related breach?
• How should organisations justify increased identity spending to business leaders who prioritise revenue growth?
• What should security leaders prioritise before selecting an identity platform?
• Should identity leaders prioritise process removal or new control features first?