Directories and Identity Stores

Directories are infrastructure. They are also mirrors of organizational reality. Every gap between the governance you wrote down and the reality your organization lives shows up in them first.

Governance decides what should be true. Directories and identity stores are where those decisions become technically real or do not. Accounts, attributes, groups, downstream representations. If the enforcement layer is weak, governance never fully lands no matter how good the policy looks on paper.

Most identity teams are not architecting these environments from scratch. They are managing what they inherited. Stores added during migrations that nobody fully reconciled. Application repositories doing source-of-truth work they were never meant to do. The model has to be implemented in that reality.

Most environments now span multiple identity stores at once. The seams between them are where the operating model either holds across systems or stops at the first one. They are also where attackers move, which makes enforcement consistency a security concern as much as a governance one.

Implementing the operating model for directories and identity stores does not require a consolidation project or new technology. It can be built piece by piece. Define what each store is actually for. Establish authoritative scope for each attribute. Document the enforcement chain so governance decisions reach the systems that enforce them. Identify accidental authority and either make it intentional or move it. Govern groups deliberately with named owners and review cycles. The work here depends on the foundations earlier posts named: decision rights, the system catalog, the entitlement work. Start with the highest-risk stores and the groups carrying the most access. The rest follows.

Start by getting clear on:

• Which platforms enforce account and access state
• Which attributes are governed centrally and where they land downstream
• Which stores have become source of truth by accident

Measure:

• Governed attributes enforced downstream
• Overrides to governed state
• Unmanaged groups or directory objects
• Enforcement failures by platform

A directory that is clean, intentional, and aligned becomes a stabilizing force. A directory that is inconsistent becomes a multiplier of drift. What you see in your directory today is what your organization actually decided yesterday.

❓ Which identity store in your environment is carrying more responsibility than it was ever meant to hold?