- A half-finished cloud move leaves on-prem Active Directory and an Entra ID tenant as separate islands, giving each person two unlinked accounts.
- Without sync, every hire must be created and every departure disabled in multiple directories, multiplying work and the risk of leaving an account open.
- Directory synchronization establishes one authoritative identity so a password change, account creation, or disablement propagates everywhere at once.
- Sync also unlocks single sign-on and group-based assignment, where adding someone to a security group automatically grants the right licenses and apps.
In late April, the systems director at a multi-office law firm summed up a problem we hear in a lot of half-migrated companies in one sentence: "My password changes over here and then it doesn't change over there."
If that sounds familiar, you almost certainly have two identity systems that aren't talking to each other.
Two directories, two identities
Many growing companies end up with both an on-premises Active Directory (the old, in-house system that logs people into computers and file shares) and a Microsoft Entra ID tenant (the cloud identity behind Microsoft 365). When the move to the cloud is only half done, those two never get connected. They operate as separate islands.
The day-to-day result is exactly what the director described: a person effectively has two accounts, and changing one doesn't change the other. Passwords drift apart, and access in one place doesn't mean access in the other.
The hidden tax
The bigger cost is invisible until you add it up. Every new hire has to be created by hand in multiple directories. Every departure has to be shut off in multiple directories. Multiply that across several offices and a steady flow of staff, and IT is doing every onboarding and offboarding two or three times, with more chances to miss a step and leave an account open.
The fix is directory synchronization: one authoritative identity that propagates everywhere. Change a password once and it changes everywhere. Create a person once and they exist everywhere. Disable them once and every door closes, which is the part that matters most for security.
With sync in place, you also unlock single sign-on and group-based assignment, where adding someone to a security group automatically grants the right licenses and apps, instead of clicking through each one by hand.
If your team maintains two sets of accounts and your passwords don't travel between them, that's a fixable, and frankly tiring, problem. We can map your identity setup and connect the islands so a change in one place sticks everywhere. Let's talk it through.