Who is accountable when a malicious Entra ID or AD change is not reversed in time?

Why This Matters for Security Teams

When a malicious Entra ID or AD change is not reversed quickly, the issue is rarely just the change itself. The real risk is loss of control over identity, because directory objects can be used to persist access, weaken conditional access, or reintroduce privileges after the initial alert. NIST frames this as a control and response problem, not a purely technical one, especially where identity governance and incident handling overlap, as reflected in NIST SP 800-53 Rev 5 Security and Privacy Controls.

In practice, many security teams first notice this failure mode after a privilege escalation, mailbox rule abuse, or token abuse has already spread across the environment. NHIMG’s research on the Microsoft Entra ID Flaw shows how identity-layer weaknesses can turn a single missed reversal into tenant-wide exposure. This is why accountability must be explicit across detection, escalation, and rollback, not assumed at handoff. In practice, many security teams encounter failure only after the attacker has already chained the change into persistence rather than through intentional validation.

How It Works in Practice

Accountability should be tied to the specific control plane that owns each step of the response. Identity operations typically owns directory change reversal, security operations owns alert triage and severity decisioning, and infrastructure or endpoint teams may own any compensating rollback in connected systems. The key is to define who can approve immediate reversal, who can execute it, and who verifies that the malicious state is gone.

Good practice is to maintain a short, explicit workflow:

• Detect the high-risk Entra ID or AD change and classify impact.
• Assign a named incident owner with authority to trigger rollback.
• Reverse the change through the approved administrative path, not ad hoc edits.
• Validate that related access paths, tokens, and group memberships are also corrected.
• Log the action trail for post-incident review and control improvement.

This is where identity governance and incident response must meet. The Ultimate Guide to NHIs notes that 91.6% of secrets remain valid five days after an organisation is notified, which is a strong signal that slow remediation is a recurring operational weakness, not an edge case. For the control side, NIST SP 800-53 Rev 5 Security and Privacy Controls supports formal assignment of responsibility, access restriction, and incident handling discipline.

These controls tend to break down when change approval is split across multiple teams without a single on-call authority, because the attacker can exploit the delay between detection, approval, and rollback.

Common Variations and Edge Cases

Tighter rollback governance often increases operational friction, requiring organisations to balance speed against change safety and segregation of duties. That tradeoff becomes sharper in hybrid identity environments where Entra ID, on-prem AD, conditional access, privileged access workflows, and sync tooling all interact.

There is no universal standard for this yet, but current guidance suggests three common edge cases need special handling. First, if the malicious change is made by a privileged automation account, ownership may sit with both the platform team and the identity team because the blast radius extends beyond a single directory object. Second, if rollback could disrupt business-critical access, the incident commander may need a time-bound exception process with explicit business approval. Third, if synchronisation delays exist between cloud and on-premises directories, “reversal” is only complete once both sides are verified.

NHIMG’s Schneider Electric credentials breach is a reminder that identity failures often become response failures when ownership is unclear and remediation lags behind attacker activity. Practitioners should treat the accountable party as the one with both authority and operational access to restore the trusted state, not merely the team that first sees the alert.

Related resources from NHI Mgmt Group

• Who is accountable when elevated access is used for time sensitive business operations?
• When do NHI access reviews create more value than a one-time cleanup?
• How do organisations reduce the dwell time of exposed credentials at scale?
• How should teams govern hybrid Active Directory and Entra ID at the same time?