Why do fragmented directories create more risk during M&A?

Why fragmented directories make M&A harder to secure

In an acquisition, directories are not just account stores, they are the control plane for authentication, provisioning, revocation, and admin delegation. When those directories are split across business units, clouds, or legacy platforms, the merger team has to stitch together different trust models before it can confidently grant or remove access. That creates a longer period where nobody has a clean view of who can reach what, or which policy is authoritative.

Fragmentation also turns basic identity work into reconciliation work. Instead of one joiner-mover-leaver process, teams inherit multiple schemas, role models, group structures, and exception paths. The result is slower integration, more manual overrides, and a higher chance that access survives after it should have been removed, especially where production, finance, and privileged admin access are involved.

In practice, the security problem is less about the directory technology itself and more about inconsistent enforcement. One environment may require MFA, another may still trust legacy federation, and a third may have local break-glass accounts or stale sync rules. During M&A, those inconsistencies are exactly where gaps appear: the organisation thinks it has merged access, but the actual trust boundary remains fragmented.

Where the real exposure emerges

Fragmented directories increase exposure when teams rely on partial inventory or informal mappings to bridge systems. A user, service account, or admin role may exist in multiple directories with different names, different attributes, or different ownership, which makes it easy to miss overlapping privilege or orphaned access. If the integration timeline is aggressive, temporary exceptions often become permanent.

The risk is especially high when old directories continue to authenticate users while the new target state is being designed. That creates duplicated control paths, and duplicated control paths usually mean duplicated failure modes: one path may be governed, another may not be reviewed, and revocation may only reach one side. If access decisions are not reconciled before cutover, the organisation can carry forward hidden privilege into the combined environment.

For a practical control lens, the issue maps to strong identity governance and least-privilege enforcement. NIST SP 800-53 Rev 5 Security and Privacy Controls describes the core access-control and authentication controls that matter when directories are being unified, while NIST SP 800-207 Zero Trust Architecture reinforces the need to stop treating legacy trust relationships as automatically valid. NIST SP 800-53 Rev 5 Security and Privacy Controls and NIST SP 800-207 Zero Trust Architecture are both useful references for that transition.

How to reduce M&A directory risk without slowing the deal

The right approach is to treat directory consolidation as a governance exercise first and a technical migration second. The integration team should establish a single authoritative source for identity decisions, define which directory owns each population, and verify how MFA, provisioning, and deprovisioning will be enforced during each phase of the transition. If those decisions are left until after the legal close, the organisation will inherit risk before it inherits order.

What to verify: confirm which directory is authoritative for each user class, privileged group, and service identity; confirm that revocation reaches every live authentication path; and confirm that break-glass access is time-bound, monitored, and owned. If any system can still authenticate after the supposed cutover without passing through the new control plane, the merger is not yet secure.

Decision rule: if the integration requires temporary coexistence, keep the exception window short and explicitly track every exception by owner, expiry, and business justification. If you cannot name the owner or the expiry date of an access path, it is not a temporary exception, it is unmanaged access.

Practitioner takeaway: M&A directory risk is usually a control-consistency problem, not a directory-count problem, so the safest merger sequence is to standardise authority, prove revocation, then collapse duplicate trust paths.

Related resources from NHI Mgmt Group

• Why do non-human identities create more audit risk than human accounts?
• Why do non-human identities create audit risk in modern environments?
• Why do non-human identities create compliance risk even when policies exist?
• Why do collaboration tools create such a large secrets risk?