How identity sprawl is quietly expanding your attack surface

No city is designed to become complex. It starts with a simple plan with a handful of streets and a few neighborhoods. Then it grows. New districts appear, roads extend, bridges get built and temporary solutions slowly become permanent. As cities grow, complexity compounds, perhaps because that growth was never planned for.

Identity environments follow the same pattern. No organization wakes up and decides to build four Active Directories (ADs), connect them to two Entra ID tenants and generate a thousand stale accounts along the way. This happens as the business naturally grows, acquires, expands and modernizes.

How organizations maintain visibility and governance as this complexity grows is another question.

The origin of identity sprawl

Identity sprawl builds up gradually. It’s not a single decision but a cascading effect of decisions over time. Consider how much new technology adoption, migrations and even changes in work infrastructure have happened in just a few years:

• Multi-cloud environments

• Software-as-a-service (SaaS) adoption

• Remote and hybrid work shifts

• Legacy silos

For organizations, they’re constantly making decisions based on all of these new changes. And they make sense at the time. When an acquisition occurs, it’s natural to bring in their user directory. When international expansion happens, it feels necessary to stand up a regional data center because of their compliance requirements.

Add in modernization like cloud migration, a few company restructurings and a wave of external contractors brought in to manage excess work. Project-based teams form and disintegrate. Test environments get built for a project, serve their purpose and never get decommissioned.

Everything feels reasonable at the time, but as years pass, this leads to increasing complexity that’s difficult to manage.

Then, new employees inherit these environments without the history behind them. Institutional knowledge walks out the door as people move on. Eventually, nobody fully understands what they're looking at anymore.

Also, a new problem is emerging. Non-human identities (NHIs), autonomous agents and applications are growing faster than human identities. Organizations need specialized security tools and control to gain end-to-end visibility into NHI activity. All of this creates additional complexity, especially in the coming years.

The mistake most organizations make first: Conflating speed with success

Imagine this: On a Monday morning, an email pops up announcing that the company just acquired another business. Leadership is celebrating, finance is pleased and legal is reviewing overlapping contracts. Within a few hours, someone says, “Let’s get them up and running ASAP!”

While it sounds like a reasonable ask, this sets the wrong starting point. Many organizations treat migration speed as the success metric, aiming to get everyone merged into one directory. However, the real goal is to balance the combined environment, keep it productive and manageable now (and years from now) while reducing complexity, rather than just relocating it.

Skip straight to migration without understanding what is merging, and you end up with an IT team fielding a familiar set of unanswerable questions:

• "Who owns this group?"

• "Can we delete this account?"

• “Do we need this anymore?”

• "Why does this person have admin rights?"

A governed environment sounds different, even with the same accounts and the same objects. It doesn’t require new objects, new accounts or an entirely rebuilt directory. Instead, it needs clear ownership, regular reviews and documented processes.

How to solve: Aggregation before consolidation

One of the most effective principles for managing identity sprawl is aggregation before consolidation, bringing environments together logically before merging them physically. Rather than immediately migrating users and groups into a new directory, organizations should first develop a complete picture of their identity landscape.

The first step is understanding relationships and visibility. A logical view of the environment provides the context needed for informed decision-making. Ask:

• Which directories overlap?

• Which systems are connected?

• Where do identities exist across multiple environments?

The next step is mapping ownership to replace uncertainty with accountability. Ask:

• Who owns each security group?

• Who approved privileged access?

• Which teams are responsible for service accounts?

Organizations can then focus on understanding the identities themselves. Duplicate accounts, naming conflicts, dormant users, orphaned objects and privileged accounts all become visible before they become migration problems.

It works the same way as moving into a new house. Most people don't pack every possession without first sorting through each room. They decide what to keep, what to donate and what no longer belongs. They don't move everything simply because it's faster.

Identity migrations deserve the same level of care and discipline. Visibility allows organizations to identify conflicts before they become outages, remove unnecessary accounts before they create security risks and migrate only what's actually needed. Teams make decisions based on facts rather than assumptions, leading to fewer surprises during migration and a much cleaner environment afterward. It removes many of the problems that come from endlessly adding on new environments without considering the overall picture.

Navigating migration nuances in identity

Not every acquisition needs full consolidation. Immediate merging isn't always the right first move, even when leadership assumes it is.

Business continuity matters more than having everyone sitting in a single directory. If users can authenticate, do their jobs and be managed consistently across separate environments, the business is already running smoothly. Consolidation can happen later, on a timeline that makes sense, rather than because a project plan says it has to be finished by day eight.

This applies to divestitures, too. Buying a company is the easy part, because you're in control the whole time. Separating one cleanly, without disrupting either business, is much harder.

What gets entangled over the years is specific:

• Shared identities and groups

• Shared applications

• Shared service accounts

• Overlapping permissions

All of it has to come apart without either business missing a beat. Whatever governance existed (or didn't exist) while that environment was intertwined determines how painful the untangling turns out to be.

The better identities are managed today, the easier tomorrow's separation becomes.

Real-world example: The telecom divestiture

One large telecommunications company experienced this firsthand during a major divestiture. The organization operated multiple AD environments across several countries and business units. As parts of the company were sold, the obvious approach seemed to be immediately migrating users into the buyer's environment. It could feel like the best way to integrate teams quickly.

Instead, the team created a neutral synchronization layer, or "landing zone," between the two organizations. Identity objects were synchronized into this shared environment based on group membership. From there, the acquiring organization absorbed identities without requiring either company to expose its production environment or provide unnecessary administrative access.

This allowed employees to continue working throughout the transition with virtually zero disruption. Admins on both sides maintained visibility into the migration while preserving appropriate separation between the two environments. Everything was clean, organized and still secure.

The migration was completed without interrupting day-to-day operations, while cleanup activities continued afterward on the organization's own schedule. The team wasn't forced to resolve every historical issue before meeting the project deadline.

That approach produced not only a successful migration but also a stronger long-term identity strategy built around business continuity, visibility and governance. Instead of rushing to consolidate and migrate, the team thoughtfully took another approach to manage identity sprawl.

What best-in-class governance looks like

Migration projects eventually end, but governance continues long after the project is complete.

Three years after an integration project, organizations often find themselves dealing with overprivileged administrators, forgotten service accounts, legacy access and shadow IT that accumulated long after the migration was considered finished.

Identity sprawl is primarily a people and process challenge. Technology helps organizations consistently apply governance decisions through automation, visibility and policy enforcement.

A solution like Active Roles by One Identity carries out that governance consistently: unified visibility across AD and Entra ID, delegation that doesn't rely on manual approvals, automated policy enforcement and an audit trail that shows who did what and why, long after the migration project has wrapped and everyone's moved on to the next thing.

Here's a basic checklist for what to look for:

• Ownership

• Access reviews

• Privileged accounts

• Service accounts

• Orphaned objects

Especially as identity governance gets more sophisticated, autonomous governance means that checking these boxes isn’t enough.

Don’t let growth compound complexity

Cities don't become successful by staying small. They become successful because they grow while investing in the underlying infrastructure.

Identity environments are the same. As organizations acquire companies, modernize infrastructure, expand internationally and adopt new technologies, identity complexity naturally increases. It’s not just that multiple identity environments automatically increase risk. Risk grows when organizations lose visibility and can no longer confidently answer who has access, why they have it and who is responsible for managing it.

It’s natural for business growth to create identity complexity, but strong governance makes that growth understandable, manageable and secure.

The most effective identity strategies follow a simple principle:

1. Understand first

2. Govern continuously

3. Then change with confidence

Learn more about Active Roles by One Identity.