Overig · Overig
Clean up Active Directory and Entra ID via Joinly
Many organisations struggle with sprawl of groups in Active Directory and Microsoft Entra ID. In this blog, you will read how Joinly provides insight, helps clean up, and makes access rights manageable.
Mike Fraanje · 10 min read
Cleaning up Active Directory and Entra ID: how to regain control over groups and access rights
In many organisations, managing Active Directory and Microsoft Entra ID groups has slowly got out of hand. Over the years, new security groups, Microsoft 365 groups, SharePoint permissions and Teams memberships have been created, often for temporary projects or exceptions. What rarely happens, however, is structural cleanup.
The result is a landscape in which it is unclear which groups are still actively used, which rights are linked to them and why certain users even have access. This not only creates unnecessary complexity, but also poses a serious security and compliance risk.
Why groups in AD and Entra ID clutter so quickly
Active Directory and Entra ID are powerful platforms, but they lack native overview and context. Groups are created technically, but rarely managed functionally. When an employee changes roles, a project ends or someone leaves the company, groups and rights often remain.
Over time, a situation arises where:
no one knows what a group is intended for anymore
groups no longer have an owner
users are members of multiple overlapping groups
rights are indirectly assigned through chains of group memberships
Without insight, cleaning up is risky. Many IT teams do not dare to delete groups for fear of breaking something. And so, the problem continues to grow.
No insight means no control
Without a central overview, it is virtually impossible to answer simple questions such as:
Which groups exist in Active Directory and Entra ID?
Who is a member of which group?
Which rights have resulted from this?
Are these groups still actively used?
This becomes painfully visible during audits. Auditors expect demonstrability, traceability and periodic verification. In practice, organisations must then rely on manual exports and Excel lists, which are often already outdated by the time they are generated.
How Joinly helps with cleaning up AD and Entra ID groups
With Joinly, organisations bring structure back to their Microsoft identity landscape. Joinly provides insight into which groups exist, who is in them and what access results from this, both in Active Directory on-premises and in Microsoft Entra ID.
By bringing this data together in a single overview, true control is established for the first time. IT teams see not only the group structure, but also the actual usage. Groups that have not been used for a long time become visible. Redundant or duplicate groups can be safely identified.
More importantly, cleaning up is not done blindly. Joinly shows which rights are linked to which groups, which greatly reduces the risk of unintended impact. This finally makes it possible to clean up old groups in a controlled manner.
From one-off cleanup to structural management
Cleaning up is only the first step. Without structural management, the sprawl will return sooner or later. Joinly therefore also supports the continuous management of groups and access rights.
New groups become part of a manageable model. Rights are assigned based on roles instead of ad-hoc exceptions. The connection between user, group and resource remains transparent, meaning access is no longer a historical problem, but a controlled process.
With this, Joinly forms the foundation for mature Identity & Access Management and Identity Governance within Microsoft environments.
Audit-proof Active Directory and Entra ID
Because Joinly provides continuous insight into group memberships and access rights, organisations are better prepared for audits. It can be demonstrated instantly:
who has access
through which group
and why that access exists
This makes compliance with standards such as ISO 27001/NIS2 and SOC 2 a lot easier and avoids stressful audit preparations.
Conclusion
Group management in Active Directory and Microsoft Entra ID is often underestimated, but lies at the heart of access and security within organisations. Without insight and cleanup, risk is inevitable.
With Joinly, organisations regain control over their groups, their rights and their Microsoft environment. Not by rebuilding everything, but by finally bringing overview and structure to what is already there.
Want to know how we can help you with this? Schedule a demo with us!
Explore more blogs
Segregation of Duties (SoD): wat het is en hoe je het afdwingt
Wat is segregation of duties (functiescheiding)? Uitleg, voorbeelden en waarom het vaak misgaat. Plus hoe je SoD-conflicten automatisch tegenhoudt.
Marcel van Beek · 4 min read
How do you apply AGDLP in a hybrid Entra/AD environment? (And why you shouldn't want to anymore)
Short answer: preferably not. AGDLP (Accounts → Global groups → Domain Local groups → Permissions) is a concept from the era of manual management. The entire nesting construction exists for one reason: to allow a human to assign permissions with as few mouse clicks as possible. As soon as an agent assigns group memberships directly based on HR data, this reason disappears and only the complexity remains. Moreover, in a hybrid environment, this complexity actively works against you, because Entra ID completely ignores nesting for licences and app assignment. In this article, you can read how AGDLP works and why it was once smart, where it breaks down in a hybrid environment, and what the modern alternative looks like: direct memberships, managed by automation.
Marcel van Beek · 5 min read
How do I set up role-based access control (RBAC) and least privilege for a municipality?
Start with the roles in your HR system and map them to roles, not to individual permissions per person. Group each role with precisely the access required for the job, adhering to the principle of least privilege. Manage these roles centrally and let an orchestration layer automatically assign and revoke them. This keeps access predictable, limited and demonstrable.
Mike Fraanje · 4 min read
See what Joinly can do for your organisation?
Start a free trial today or get in touch for advice on your HR and Microsoft environment.