Bringing 10,000+ identities, including the ones nobody could see, under control
Unified visibility across Active Directory, surfaced 100+ unmanaged service accounts and enforced MFA on 250 privileged accounts.
Context
Encora ran a deliberately decentralised model, with identity controls delegated to local business units. Service accounts were created without process or ownership, privileged accounts had no MFA and authentication paths weren’t monitored.
“We were trying to identify accounts that are not mapped as user accounts: service accounts, accounts we cannot put MFA on, admin accounts. There was no visibility.”
Approach
- Inventory before enforcement. First get every human and machine identity, and every authentication path, into one view.
- Give every machine identity an owner. Service accounts were mapped to named owners and expected behaviour, so anomalies became visible.
- Protect what legacy can’t. MFA was extended to privileged and legacy AD accounts that couldn’t take it natively.
Outcome
100+ previously unmanaged service accounts discovered, MFA enforced on 250 unprotected privileged accounts, identity risk moved from high to low, and alignment with ISO 27001, SOC 2 and cyber-insurance requirements.
What I’d do again
Start with machine identities. They outnumber people and almost nobody owns them.