Microsoft Entra: Simplify hybrid identity lifecycle management

While the future of technology rests in the cloud, many organisations still rely on a mix of cloud and on-premises infrastructure.

This hybrid setup poses a challenge for identity lifecycle management.

Namely, how do you integrate the security and efficiency benefits of the cloud into legacy on-premises systems?

The solution lies with Microsoft Entra.

In this blog we’ll examine the common challenges and how to achieve secure, efficient management of every identity across a hybrid estate.

Everything starts with user provisioning

If an employee doesn’t have a digital identity, they can’t work.

Take a new starter on their first day. Even if their account is set up, without the right permissions, they can’t access what they need.

Traditionally, managing identities is a manual process involving multiple systems (HR, email, telephony, etc.), which is time-consuming, error-prone, and slow. This frustrates employees, delays productivity, and creates security risks.

Wouldn’t it be better if the process were automated, giving employees the access they need from day one?

But this creates another challenge.

Access management complexities

While birthright access ensures new employees get the necessary permissions, specific roles often need tailored access that shouldn’t be universal.

Furthermore, managing privileged access — which involves high-level permissions that cause considerable damage if misused — adds another layer of risk and complexity.

As a manual process, it means more work, more time, and more risk of error and breach.

What’s needed is a robust, auditable process that uses self-service and automation to minimise human intervention.

The challenge of user deprovisioning

Deprovisioning—removing user access—is crucial when an employee leaves.

Prompt revocation is key to avoiding security risks. However, many organisations struggle with this.

Often, IT teams are not immediately notified when someone leaves, or they may not know all the systems and applications to which the user had access.

This creates a significant security gap, where ex-employees could still have access to sensitive data and systems.

Microsoft Entra’s cloud-only identity utopia

Given the scale of Microsoft Entra’s development over the past couple of years it should come as no surprise to learn that it already offers clear solutions to these challenges.

For instance:

• Microsoft Entra’s HR and API-driven provisioning automates user access updates by integrating with HR systems (or other sources of record), to enable real-time changes.
• Lifecycle Workflows automate birthright access by assigning roles based on a user’s position, ensuring timely updates, and reducing manual intervention.
• Access packages enable self-service access with automated approvals, ensuring role-based access.
• Access reviews maintain security by regularly adjusting user permissions.
• Privileged Identity Management (PIM) enhances security by providing temporary, just-in-time access and requiring approval workflows for privileged roles.

This is great news for cloud-only organisations. But as we said at the top, many organisations still rely heavily on on-premises infrastructure for critical applications.

Hybrid environments require a hybrid solution for consistent identity lifecycle management across all platforms.

Leveraging Microsoft Entra in a hybrid environment

In hybrid environments, Microsoft Entra extends its identity lifecycle management capabilities to on-premises systems through various tools:

API-driven provisioning

Facilitates user provisioning and deprovisioning on-premises from Entra ID.

This can connect with SCIM-based services, LDAP directories, SQL databases, and more, using custom connectors or PowerShell scripts, ensuring that changes in user status are consistently reflected across all systems, regardless of location.

Logic apps

Provide a no-code method for encapsulating complex business logic into workflows, enabling automation of identity-related tasks such as user provisioning, deprovisioning, and managing approval processes.

This reduces the need for extensive developer resources while providing flexibility and maintainability.

Automation accounts

Allow organisations to run scripts and execute runbooks on on-premises Windows and Linux infrastructure, using tools like PowerShell or Python for tasks like updating group memberships, managing access permissions, and performing routine maintenance.

These can be triggered by lifecycle workflows and entitlement management processes, ensuring all identity management tasks are consistently performed.

Combined, these tools enable organisations to apply Entra ID governance features across on-premises and cloud systems, bridging the gap between different environments and providing a unified approach to identity management.

Identity management use cases

Here’s a couple of examples of where the Kocho team have applied Microsoft Entra’s flexible tools to provide operational savings and security improvements for our clients.

Plus a use case scenario to highlight how Entra’s versatility can be used to drive improved governance across different systems and platforms.

Secure, time-saving privileged account management

A client’s manual process for managing privileged accounts took days each quarter to audit. They wanted automation and self-service account requests with a robust approval system.

Using Microsoft Entra, we implemented an access package system. Approved requests triggered logic apps to create accounts in Active Directory, with automatic group membership updates and account disabling when access expired.

Comprehensive dashboards ensured full auditing and compliance, reducing human intervention to approvals and report generation, saving the client considerable time each quarter.

Streamlining the joiner-mover-leaver process

A client’s complex, manual onboarding process involved multiple systems and steps, including manually provisioning users and manually issuing temporary access passes (TAPs). They sought to reduce complexity and automate user provisioning for on-premises applications.

We implemented a solution using API-driven provisioning, access packages, and logic apps to automate user creation in Active Directory, SQL databases, and other systems. External users could self-service account requests, with automatic account disabling or deletion when they left. This simplified the process, reducing manual effort and improving efficiency.

Identity Governance on non-Windows platforms

Microsoft Entra can also govern identity on non-Windows systems. API-driven provisioning and automation accounts manage user lifecycles on platforms like LDAP directories or local accounts.

Using Linux hybrid workers, custom business logic can be executed via Python scripts to provision users in systems like Red Hat IdM or Oracle Identity Manager, manage server accounts, and update privileges or sudoers files.

Conclusion

Most organisations operate in hybrid IT environments, making it unrealistic to rely solely on cloud-based solutions.

By leveraging Microsoft Entra’s hybrid tools—such as API-driven provisioning, logic apps, and automation accounts—organisations can optimise identity lifecycle management across both cloud and on-premises environments.

This hybrid approach offers the necessary flexibility and security for managing identities effectively, regardless of where the infrastructure resides. However, the right tools and expertise are essential to tailor solutions to an organisation’s needs.

At Kocho, we have a proven track record in deploying Microsoft Entra solutions for diverse clients, from local businesses to multinationals, enabling them to implement best practices, avoid pitfalls, and achieve an efficient, secure identity management strategy.

Key takeaways

Next steps

Like this article?

Don’t forget to share it.