Hybrid identity

1. What I walked into

Two worlds that did not know about each other: on-premises Active Directory for the old applications, and separate cloud accounts for email. Passwords drifted apart, and leavers kept working accounts for months.

• a third of all tickets were password resets
• laptops were set up by hand, one at a time
• access reviews were a spreadsheet filled in once a year

2. What I changed or built

One identity everywhere: Active Directory in sync with Entra ID, with conditional access and mandatory multi-factor sign-in. Intune manages the devices, and new machines set themselves up with Autopilot.

• self-service password reset
• a leaver is disabled everywhere in one step
• policies written as code and kept under version control

3. The numbers

640 accounts in sync, every one with multi-factor sign-in. A new laptop goes from box to ready for work in 25 minutes without the user touching a setting. Password-reset tickets fell by 70%.

4. The tools, and why these

Entra ID and Intune because email and the office apps already lived there — the question was how to bring the on-premises directory along, not what to buy. Terraform means a policy change is reviewed like any other change to code.

5. What it meant for the business

Signing in became easier for staff and harder for attackers. The access chapter of the financial audit now closes without questions, and on a leaver’s last day every access really does end.