The shift to Cloud-First Identity in 2026

Australia, Feb 11, 2026

For many organisations, the move to cloud collaboration platforms such as Microsoft 365 happened years ago. Email, Teams, SharePoint, and file storage are now firmly cloud-based.

Yet identity, the very control plane that governs access often remains anchored on-premises.

Despite widespread cloud adoption, many organisations still rely on legacy Active Directory (AD) and Exchange management tooling as their authoritative identity source.  

This has historically been necessary due to legacy applications, authentication dependencies, and long-standing operational habits.

In 2026, new feature releases from Microsoft are making the shift to a cloud-first identity model a practical reality for organisations of any size.

Why Identity Has Lagged Behind

Hybrid identity has been the norm for over a decade. Even organisations running entirely cloud-hosted workloads frequently maintain:

  • On-premises Active Directory Domain Services (AD DS)
  • Exchange management servers
  • Synchronisation infrastructure such as Entra Connect

In many cases, these components remain the source of authority for user and group objects.

This lag is largely driven by legacy applications that require LDAP, Kerberos, or direct on-prem integration. These requirements essentially anchored AD DS as the primary authority, creating a bottleneck for organizations that were otherwise ready to go cloud-native.

The result has been:

  • Dual management overhead
  • Operational complexity
  • Reduced automation capability
  • Security blind spots across identity boundaries

Microsoft’s Cloud-First Identity Direction

Microsoft’s recent hybrid identity innovations represent a significant turning point.

The introduction of Source of Authority (SoA) transformation capabilities allows organisations to shift identity control to Microsoft Entra ID, even when on-premises directory services and application dependencies still exist.

Microsoft’s own guidance now explicitly encourages a cloud-first posture where on-premises AD is gradually minimised. (Microsoft Learn)

What feature releases make this possible?

Microsoft is releasing new capabilities to support this shift to cloud-first Identity.

Group Source of Authority – Manage your Synced Groups directly in the Cloud.
(Microsoft Learn)

Cloud-Based Management of Exchange Attributes - manage Exchange attributes for directory-synchronised users directly in Exchange Online
(Microsoft Learn)

User Source of Authority – Manage user attributes in Entra ID
(Microsoft Learn)

Cloud Kerberos Trust – Kerberos authentication to on-prem applications, password-less authentication supported, no hybrid join required!
(Microsoft Learn)

Many of these capabilities, including Source of Authority transitions and cloud-managed Exchange attributes are currently in public preview or staged release, with broader general availability expected in the coming months.

What This Means for IT Leaders

The transition to cloud-first identity is not just a technical change, it’s an operational shift.

Organisations that embrace it will gain:

  • Simplified identity lifecycle management
  • Reduced infrastructure footprint
  • Improved security visibility
  • Faster automation and integration capabilities
  • Stronger alignment with Zero Trust architecture

Those that delay may find themselves maintaining increasingly complex hybrid stacks with diminishing vendor support.

Take the next steps on your modern identity journey

The conversation has shifted from “Can identity live in the cloud?” 

to “Why are we still managing identity on-prem?”

Understanding your current state, mapping out dependencies and shifting workloads may seem daunting, but not with Logicalis by your side.

Let us take the hassle out of simplifying and securing your identity future.  

Contact an Identity Expert now. 

Topic

Related Insights