Most organisations don’t move to the cloud in one clean jump. They end up with a foot in both worlds: some systems on-premises, some in Azure or AWS, and a lot of plumbing connecting the two. That in-between state is where most of the real security risk lives, and it rarely gets the attention it deserves.
I’ve spent years working in and around hybrid environments, and the same gaps come up again and again. None of them are exotic or unusual. They are just the kind of thing that gets missed when everyone assumes someone else is handling it.
What is the identity seam in a hybrid setup?
When you connect your on-premises Active Directory to a cloud identity provider, you create a seam. Accounts sync, permissions flow, and suddenly a compromise in one environment can walk straight into the other.
The mistake I see most often is treating the two directories as if they’re one trusted system. They are not. A service account with too much reach on-premises becomes a much bigger problem the moment it has a path into your cloud tenant. Privileged accounts especially need to be looked at end to end, not just within whichever environment you happened to be reviewing that day. It’s the same reason break-glass accounts should be cloud-only.
Map out exactly what can move between the two, and assume an attacker will find the shortest path. Usually they do.
Stale permissions that never get cleaned up
Hybrid setups accumulate permissions like a garage accumulates junk. Someone needs temporary access for a migration project, it gets granted, the project ends, and the access stays. Multiply that across a few years and a few hundred people and you’ve got a sprawl that nobody fully understands anymore.
The fix isn’t glamorous. It’s regular review, automated where possible, and a genuine willingness to remove access that isn’t being used. The hardest part is cultural. People hate having access taken away, even access they’ve never touched. But every unused permission is a door left unlocked.
Logging that looks fine until you actually need it
Plenty of organisations tick the “logging enabled” box and move on. Then an incident happens, they go to investigate, and they find the logs don’t cover the thing they actually care about, or they’re scattered across systems that don’t talk to each other.
Hybrid makes this worse because your visibility is split. On-premises logs live in one place, cloud logs in another, and the connection between them is exactly where you need clarity during an incident. It’s worth doing the boring work upfront. Decide what you’d need to see if something went wrong, then check you’re actually capturing it. Test it before you’re depending on it at 2am. If those logs land in Sentinel, a few lines of KQL is the quickest way to check what’s really there.
The shared responsibility confusion
Cloud providers are clear about where their responsibility ends and yours begins. The problem is that internally, teams often assume the provider handles more than it does. “It’s in the cloud, so it’s covered” is a sentence that has preceded a lot of incidents.
In a hybrid setup this gets muddier still, because responsibility shifts depending on which part of the stack you’re looking at. The only fix is to be explicit. Write down who owns what, for each system, and make sure the people running things have actually read it.
None of this is about buying more tools
Here’s the part that tends to surprise people. Most hybrid security gaps get solved by understanding your environment properly, removing what you don’t need, and being honest about who’s responsible for what, rather than by spending more money on products.
Tools do help, but a clear picture of your own estate, kept up to date, is worth more than any dashboard you bolt on top of confusion. Handling hybrid well has far less to do with the size of the security budget than with knowing what you’re actually running.
That’s the unglamorous truth of it. Good security in a hybrid world is mostly about paying attention to the joins, the places where two systems meet and everyone assumes the other side has it covered.
I write about security, Azure, data, and the practical side of running things. If this was useful, connect with me on LinkedIn.
Originally published at alanconlon.com, where I post practical security, Azure and data write-ups every other Tuesday.
Top comments (0)