“Identity Drift” is the silent killer

Cornerstone Cyber
Aug 14
2 min read

In most Microsoft 365 environments (or any other environement where there is an identity providor involved), the biggest risk isn’t a hacker - it’s the slow, silent rot of identity mismanagement.

We call it Identity Drift - the gradual accumulation of user access that no longer matches business reality.

It happens when:

Contractors keep access after their projects end
Staff move roles but retain legacy permissions
Admins get elevated access that never expires
Former employees' shadow accounts remain enabled

This isn’t theoretical. It’s happening right now in hundreds of Aussie businesses - and it’s one misstep away from a breach.

Why It Matters

Every standing permission is a security liability. It increases your blast radius if credentials are compromised and raises your exposure during audits.

Most mid-sized organisations don’t have the people, process, or systems in place to maintain access hygiene. But they do have tools that can help—built into the Microsoft 365 stack.

Let’s break it down.

Spotting Identity Drift

Start with your Identity provider (Entra ID in the case of M365). Ask these questions:

Who’s in privileged roles, and why?
Are former employees still listed as “active”?
Do users belong to groups that no longer exist in org charts?
Are external guests still able to log in?

If you’ve never looked before, the results might be shocking.

How to Fix It (With What You Already Own)

1. Implement PIM (Privileged Identity Management)

2. Run Regular Access Reviews

3. Use Dynamic Groups + Rules

4. Automate Offboarding

5. Implement Conditional Access for Visibility

Final Thoughts

You don’t need a new tool to fight identity risk.

You need better hygiene. Better habits. And the will to configure the tools already in your licensing.

Identity Drift is real—but preventable.

Build a quarterly rhythm around access reviews, dynamic roles, and just-in-time admin rights. You'll:

Reduce your risk surface
Improve audit outcomes
Sleep better at night

And you’ll do it without blowing out your licensing or headcount.

Do you need help setting up your environment to be managable, scaleable and secure? We'd love to hear from you!