Summary: Ignoring legacy on-premises infrastructure creates massive security blind spots, leaving stale service accounts and unreviewed hybrid permissions vulnerable to exploitation. Integrating Oleria Trustfusion, an AI-native identity security platform, bridges this structural gap by deploying a lightweight, read-only agent that pulls on-premises Active Directory objects into the exact same access graph as your cloud infrastructure.
The on-prem Active Directory that has been the backbone of the enterprise for 20 years still authenticates the workloads that haven't moved to cloud. Most cloud-first identity platforms treat AD as legacy and skip it. Skipping AD means missing the highest-volume identity surface most enterprises still operate - user accounts, service accounts, GPO-governed workloads, and multi-domain forests that aren't going anywhere soon. Oleria brings on-prem AD into the same access graph as your cloud stack, so you stop governing one identity environment and ignoring the other.
Active Directory at most enterprises holds tens of thousands of user accounts, thousands of service accounts, hundreds of OUs, and multi-domain forests with trust relationships. The "we'll move off AD" plan has been on the roadmap for years; the migration is still partial. Meanwhile, AD authenticates production workloads, governs file shares, and hosts services that won't be cloud-native any time soon.
Cloud-first identity platforms that skip AD aren't being modern - they're ignoring where the identities actually are. The result is a split governance model: cloud identities in the IGA platform, AD identities managed separately through scripts, spreadsheets, or not at all. The on-prem service accounts nobody reviews. The accounts from the acquisition two years ago that never got cleaned up. The PasswordNeverExpires accounts that have been running production workloads since before the current security team started.
AD doesn't have a cloud-native API, so getting AD into the access graph requires an agent. Oleria is explicit about this: where the architecture requires an agent, we use one. The agent is read-only, lightweight, and purpose-built for the legacy environments most identity platforms abandon.
Oleria deploys a read-only agent in the AD environment and ingests users, service accounts, groups, OUs, and event logs. Those identities flow into the same access graph as your cloud stack - not a separate pane, not a legacy tab. Active Directory cloud identity graph integration is complete the same day the agent deploys, without waiting for a multi-year migration project to finish.
Oleria deploys a read-only agent in the AD environment and ingests users, service accounts, groups, OUs, and event logs. Those identities flow into the same access graph as your cloud stack - not a separate pane, not a legacy tab. Active Directory cloud identity graph integration is complete the same day the agent deploys, without waiting for a multi-year migration project to finish.
Lightweight agent runs LDAP queries and ingests event logs. No writes to AD. Deployment takes hours, not a migration project.
Per-domain agent deployment with cross-domain trust relationships surfaced in the unified graph. Complex AD environments with multiple domains and forest trusts are supported natively.
AD identities synced to Entra via Entra Connect surface as one unified record - one identity, one review, one lifecycle - rather than two separate objects to reconcile manually.
Service accounts in AD are first-class NHIs in the Oleria graph - with owner, last review, access scope, and the same lifecycle workflows that govern cloud NHIs. PasswordNeverExpires accounts, stale service accounts, and orphaned identities all surface.
Access reviews, certifications, and deprovisioning workflows run across on-prem and cloud identities from the same surface. One operating model, not two.
The security team starts a new access review cycle. Cloud identities - Entra, AWS, GitHub, Salesforce - are all in the graph. But so is AD: 45,000 user accounts, 2,300 service accounts, 180 OUs, and a three-domain forest that authentication still routes through for the production ERP.
The reviewer opens the AD service account queue. Oleria surfaces 340 service accounts, each with owner attribution, last review date, and access scope. Seventy-two have never been reviewed. Eighteen have PasswordNeverExpires set and haven't been accessed in over 90 days. Four are owned by employees who left the company. The reviewer works the queue directly - no LDAP exports, no spreadsheets cross-referenced against HR data.
Entra Connect-synced identities surface as one unified record across AD and Entra. The hybrid identity is a single object in the Oleria graph - one review, one lifecycle, not two separate things to reconcile.
No. The agent is strictly read-only. LDAP queries for discovery, event log ingestion for activity. Deprovisioning actions through AD use a separate write-back mechanism that requires explicit authorization per workflow.
Azure AD DS surfaces via the Entra connector plus the AD agent for domain services workloads. Other directory services such as OpenLDAP connect through separate connectors.
AD doesn't have a cloud-native API. Any platform claiming to ingest AD without an agent is either using a cloud sync proxy (which is an agent with a different name) or skipping AD entirely. Where the architecture requires an agent, we use one. Where cloud APIs are available, we use those. The agent is read-only, lightweight, and purpose-built for on-prem AD environments.
