Visibility
Active Directory
Hybrid Identity
IAM Engineer
Find and govern every Active Directory service account - including the ones from 2010
Cloud-only NHI tools are blind to on-prem. Active Directory service accounts - some running since the early 2010s with non-rotating passwords and unconstrained Kerberos delegation - are the longest-lived, least-governed NHIs in most enterprises. Oleria surfaces them in the same graph as your cloud NHIs, making Active Directory Service Account Governance a continuous program rather than a periodic fire drill.
AD service accounts are the longest-lived NHIs in most enterprises. Some have authenticated continuously since the early 2010s. Most have non-rotating passwords by design. Many have Kerberos delegation set up "just in case." Cloud-only approaches to NHI security simply don't see them.
Covering AD requires an on-prem agent, and that's exactly what Oleria ships. The agent reads service account inventory, last-logon timestamps, password-not-required flags. NIST SP 800-63B and CIS Benchmarks for Active Directory both identify service account credential hygiene as a foundational control - one that requires visibility into the on-prem environment to enforce.
he read-only on-prem agent surfaces service accounts, MSAs, and gMSAs alongside your cloud identities. One view, no coverage gaps.
Non-rotating passwords flagged by account, with last-password-set date - the cleanup list your AD admin has been meaning to build.
Cross-domain trust relationships become visible as scope, not just topology, so you see which accounts can move laterally across domains.
Read-only LDAP queries against the service accounts you scope it to. No writes, no domain controller modifications, no policy changes.
Yes. Specifics are mentioned in the connector documentation.
Native AD tools require domain admin access, return per-domain results, and produce no unified view across forests or cloud identities. Oleria uses a read-only agent, works across multi-domain forests in a single connection, and joins the AD inventory with your cloud NHIs.
Yes. Accounts with unconstrained delegation are explicitly flagged. Unconstrained Kerberos delegation allows any service running under that account to impersonate any user to any other service in the domain - a common lateral movement path exploited in pass-the-ticket attacks.
AD service account findings map to NIST SP 800-53 AC-2 and IA-5, CIS Benchmarks for Active Directory, and SOC 2 CC6.1 (logical access controls).
Inventory syncs on a scheduled cycle. Disabled accounts are included and clearly marked, because a disabled account with Kerberos delegation or group membership that gets re-enabled is a real risk pattern.
