Over 90 percent of Fortune 1000 companies run their identity on Active Directory and Entra ID. That stat answers two questions at once: Why AD is mission-critical and why it’s the most-attacked identity surface on the planet.
Threat actors go after AD because it’s where the privileged credentials are, and because the tools used to manage it haven’t fundamentally changed in twenty years. Native AD Users and Computers, native delegation and native group management are all useful tools - they just weren’t designed to be a governance layer.
In a recent One Identity session, principal architect Richard Lambert framed it directly: Active Roles by One Identity is “your firewall and your automation engine for managing your Microsoft directories.” A layer between your admins and the directory itself. Native rights go away. Every change flows through a policy-enforced, audited gate.
It’s worth pulling apart what that actually means for the people doing the work.
Automation that replaces the scripts
Most AD shops are running on PowerShell scripts to provision users, manage group membership, rotate passwords, deprovision and clean up. Two thousand lines that one person wrote five years ago, that now nobody quite understands.
Active Roles replaces a lot of that with a drag-and-drop workflow designer and a synchronization service that reads directly from HR systems like Workday, ServiceNow or a SQL back end. A new hire shows up in Workday. A user object lands in AD with the right OU, group memberships and attributes already populated. The help desk never sees a ticket and no admin reaches for a script.
Group membership runs the same way. Dynamic groups update in near real time. Group families and temporal groups work on schedules, so a privileged account can be live for a Saturday change window and gone by Sunday evening without anyone having to remember.
Privilege management that takes away standing rights
Lambert’s advice to admins was to walk through any privileged account in their environment and ask one question: does it actually need those persistent rights, or does it just have them?
In native AD, the answer is almost always that it has them because it’s easier. Your Domain Admins list gets larger every year. Service accounts accumulate access nobody can fully explain. The blast radius of any compromised privileged account is enormous because the privilege is standing.
Active Roles changes the model. Most users get zero native rights to the directory and instead work through Active Roles, which delegates the specific permissions they need for the specific objects they manage. Access templates make those permission sets reusable. Change one access template and every location that uses it updates immediately, with no walking from OU to OU. The time-based group membership noted above is really the same idea applied to privileged groups: rights are granted when they’re needed and removed when they’re not.
Governance that gives you the audit trail you don’t currently have
If you’ve ever tried to put together evidence for a Microsoft directory audit, you know the drill. Every domain controller log changes locally to its own security log. Stale accounts hide across forests. The whole effort ends in screenshots and spreadsheets.
Active Roles centralizes the change record. Every action that flows through it gets logged in one place, across every directory under management, with the kind of detail an auditor actually wants. Managed units let you create virtual containers that span OUs and directories, so the same object can appear in as many views as it needs to. Virtual attributes extend the schema without you touching the schema. Policy enforcement keeps the data clean as it goes in: mandatory fields filled out, SAM account names generated the same way every time, drop-down lists where you want consistency.
Lambert put it bluntly when talking about why this matters even if you already have an IGA solution in place: “If you import messy data, you’re going to have messy data in your IGA tools.” The cleanup needs to happen at the directory layer.
One customer, three outcomes
George Washington University runs an environment that sees a huge amount of object churn each school year. They use Active Roles to automate the whole account lifecycle and to sync password changes across systems. What used to take minutes per account now happens in real time. Lambert described Active Roles as “the foundation of their identity platform moving forward.”
That’s a useful frame for any IT director thinking about where to start. Active Roles isn’t an optional add-on for organizations that take their Microsoft environment seriously. It’s a control plane. And the three things it adds (automation, privilege management and governance) compound on each other.
Where to start
The full session, “Mastering Microsoft directory governance: Best administration practices for streamlined efficiency” walks through each capability in more detail, including the multi-forest console, the workflow designer and the upcoming REST interface for integrating Active Roles into broader automation. It’s worth the watch if your environment is sprawling, your scripts are growing or your audit prep takes too long.
