The answer in fifty-five words
The risks that derail Australian hybrid AD to Entra cutovers are almost all programme risks: undocumented Kerberos dependencies, premature AD Connect retirement, unmonitored privileged access during the cutover window, Privacy Act 1988 (OAIC — the Privacy Act, accessed 16 June 2026) lapses, certificate authority orphaning, and Essential Eight ML2 control gaps during migration. The technology cutover is short. The discovery and risk management are long.
Why a named risk register matters
The Microsoft Hybrid Identity Documentation (Microsoft Learn, current) walks through the technical sequence of a cutover. The ASD Information Security Manual (ASD — Information Security Manual, accessed 16 June 2026) (November 2025 release) and ACSC Essential Eight Maturity Model (ACSC — Essential Eight Maturity Model, accessed 16 June 2026) (current 2025 revision) describe the controls that must remain in place. Neither document lists the programme risks that turn a clean cutover plan into a Monday-morning incident.
The risks below are observed in Australian mid-market and government-adjacent hybrid identity cutovers over the last twenty-four months. Each has a stated likelihood (against the typical Australian organisation undertaking a cutover) and impact (against the cutover programme and the broader information security posture), plus the specific mitigation that addresses it.
The register is meant to be copied into a programme risk log and adapted. The numbers are starting estimates; calibrate against your environment.
R1 — Undocumented Kerberos-bound legacy application breaks at cutover
Likelihood: High. Impact: High (cutover rollback, multi-day outage for the application).
The most common cutover failure mode. An application acquired before the current IT manager started, with a service account in Domain Admins, authenticates users via Kerberos integrated Windows authentication. The application owner has retired; the documentation refers to it as "the legacy app." AD Connect is retired; the application breaks on Monday morning.
Mitigation. Run a Kerberos dependency discovery at least six months before cutover: network packet capture on each domain controller looking for unusual TGS requests, an audit of every service account with delegated rights, application-owner interviews for every application listed in the application portfolio. For each Kerberos-bound application, choose modernise, front with Entra Application Proxy, or retire.
R2 — AD Connect retired before workloads are off Kerberos
Likelihood: Medium. Impact: Very High (forest-level identity outage).
The temptation is real: AD Connect is the most visible on-premises identity component, and the cutover programme is judged by what has been retired. Retiring AD Connect before Kerberos-bound workloads are migrated breaks sign-in for those workloads.
Mitigation. AD Connect retirement is the last technical step, not the first. Sign a go-no-go gate that requires zero Kerberos-bound workloads in the production inventory before AD Connect retirement. ASD ISM auditing requirements apply throughout — the gate is part of the audit trail.
R3 — Certificate authority orphaned
Likelihood: Medium. Impact: High (silent expiry of certificates).
The on-premises AD-integrated certificate authority issues certificates for web servers, RDP gateways, 802.1X-authenticated devices, and S/MIME signing. When the last domain controller retires, the CA orphans. Existing certificates remain valid until their natural expiry, then quietly fail.
Mitigation. Migrate certificate issuance to a replacement CA (Microsoft Entra-based issuance via Microsoft Intune, a public certificate authority via Microsoft Entra Certificate-Based Authentication, or a standalone enterprise CA) at least one full certificate-life ahead of cutover. Inventory every device whose certificate is issued by the AD-integrated CA; track it to migration completion.
R4 — Conditional Access misconfiguration during ADFS retirement
Likelihood: Medium. Impact: Medium (user lockout, false-positive incidents).
When ADFS retires, Conditional Access replaces the federated claim rules. The cutover policy set is usually drafted in haste; the first business day exposes mis-targeted policies that lock out legitimate users or expose protected applications.
Mitigation. Build Conditional Access policies in report-only mode for at least one billing cycle (Microsoft Learn, Conditional Access: Report-only mode, current). Compare the report-only results with the ADFS claim rule outcomes for the same access events. Switch to enforced only after the comparison is clean. Microsoft Entra ID Premium P1 includes the report-only telemetry.
R5 — Privileged access discipline lapses during the migration window
Likelihood: High. Impact: Very High (Tier 0 compromise during a noisy cutover).
The cutover window is exactly the time attackers prefer. Change management throttles are relaxed, change tickets are merged, vendors have temporary privileged access. Tier 0 discipline lapses; an attacker who has waited for the window walks through.
Mitigation. Maintain Essential Eight ML2 controls throughout the cutover. Privileged Identity Management, Conditional Access on privileged role activation, restrict administrative privileges, multi-factor authentication on privileged users — all stay enforced. Build a change-freeze in the cutover plan for everything not strictly required for the cutover. ASD Restricting Administrative Privileges guidance (2025) applies at the same bar.
R6 — Privacy Act 1988 breach during the migration window
Likelihood: Low. Impact: High (Notifiable Data Breaches scheme notification, regulator engagement).
Australian Privacy Principle 11 requires reasonable steps to protect personal information including during system changes. A cutover that creates a window where personal information is more exposed than baseline — for example, logging is suspended, MFA temporarily relaxed, a database is exported to a less protected location for migration — creates Privacy Act exposure.
Mitigation. The cutover plan is reviewed against APP 11 before approval. Logging continues throughout the cutover. MFA enforcement does not relax for any privileged user. Migration export targets are at least as protected as the source. The OAIC's Australian Privacy Principles guidelines (OAIC — Australian Privacy Principles, accessed 16 June 2026) (current) describe the obligations in detail.
R7 — Backup discipline lapses on the assumption that AD is going away
Likelihood: Medium. Impact: High (forest recovery impossible during cutover incident).
The AD forest is alive until the last domain controller is decommissioned. The temptation is to defer backup verification and the annual forest recovery rehearsal because the forest is being retired soon. An incident during the cutover finds the team without a usable backup.
Mitigation. Run the annual forest recovery rehearsal at least one quarter before cutover. System State backups continue daily through the cutover. The Essential Eight ML2 Control 8 requirement does not relax because the asset is being retired.
R8 — Microsoft 365 backup not provisioned before cutover
Likelihood: High. Impact: Medium (mass-delete cannot be undone).
Once identity is cloud-only, mass deletion events propagate across Microsoft 365 services. Microsoft's native retention is not a backup against ransomware-grade deletion. Many Australian organisations carry the assumption that Microsoft 365 is the backup.
Mitigation. Configure Microsoft 365 Backup (the Microsoft-native service, generally available in 2024) or a third-party backup (Veeam, Commvault, Cohesity, Rubrik, AvePoint) before the cutover. The backup destination is outside the production tenant.
R9 — Group Policy dependencies orphaned
Likelihood: Medium. Impact: Medium (configuration drift on Entra-joined devices).
Some on-premises configuration that group policy enforces (drive maps, login scripts, certain proxy and Office configuration) does not have a one-to-one Microsoft Intune equivalent. Devices migrating to Entra-joined lose the configuration silently.
Mitigation. Inventory every group policy applied to in-scope OUs. For each GPO, identify the Microsoft Intune (or Microsoft Entra) equivalent. Settings that have no equivalent require redesign — typically through Microsoft Intune Configuration Profiles, Settings Catalog, or PowerShell remediations.
R10 — Help desk overwhelm in the first week after cutover
Likelihood: Very High. Impact: Medium (user productivity, support burden).
The first week after the major cutover step generates support volume disproportionate to the actual number of issues. Users sign in with the wrong account form (username vs [email protected]), legacy bookmarks point at retired federation endpoints, devices that should have re-enrolled in Microsoft Intune did not.
Mitigation. Communicate the cutover at least two weeks ahead. Provide a one-page user reference for the new sign-in pattern. Stage the cutover for non-critical user cohorts ahead of broader cutover. Increase service desk staffing for the first ten business days.
Go-no-go checklist
Before the major cutover step, every line below is green:
- Kerberos-bound workload inventory complete; zero workloads remain on Kerberos at cutover step.
- Conditional Access policies in enforced mode after at least one report-only cycle.
- Privileged Identity Management active for every Tier 0 cloud role.
- Certificate authority migration complete or scheduled within one certificate-life of cutover.
- Annual forest recovery rehearsal completed within the last quarter; documented gaps closed.
- Microsoft 365 backup provisioned and tested.
- Group policy parity confirmed in Microsoft Intune for in-scope OUs.
- Help desk briefed; user communications sent.
- ASD Essential Eight ML2 control evidence pack updated for the cutover window.
Where to go next
- Pillar guide: AD tier model and Essential Eight ML2 recovery.
- The step-by-step technical sequence: Hybrid AD to Entra cutover walk-through.
- Baseline your full posture: the Active Directory Security and Resilience Assessment.
- Practitioner-led deep dive: the paid Active Directory Resilience Review.
Sources cited
- Microsoft. Hybrid Identity Documentation. Microsoft Learn, current.
- Microsoft. Decommission AD FS. Microsoft Learn, 2025.
- Microsoft. Conditional Access: Report-only mode. Microsoft Learn, current.
- Microsoft. Microsoft 365 Backup. Microsoft Learn, 2024 general availability.
- ASD. Information Security Manual. November 2025 release.
- ASD. Essential Eight Maturity Model. Current 2025 revision.
- ACSC. Restricting Administrative Privileges. 2025 revision.
- OAIC. Australian Privacy Principles guidelines (APP 11). Current.
Sources referenced in this article: ASD Information Security Manual, ACSC Essential Eight Maturity Model, Privacy Act 1988, OAIC Australian Privacy Principles guidelines (APP 11), Microsoft Hybrid Identity Documentation (Microsoft Learn), Microsoft Decommission AD FS (Microsoft Learn), Microsoft Conditional Access: Report-only mode (Microsoft Learn), Microsoft 365 Backup (Microsoft Learn), ACSC Restricting Administrative Privileges, Veeam / Commvault / Cohesity / Rubrik / AvePoint.
