Hybrid identity is an environment where an organization’s on-premises directory, such as Active Directory, is connected to cloud identity services. User accounts, groups, and sign-in rules may be synchronized or federated between the two sides so people can access local resources and cloud apps with related identities.
In cyber security, hybrid identity matters because compromise in one layer can affect the other. If an attacker steals a privileged on-prem account, abuses sync settings, or tampers with federation trust, they may gain cloud access, persistence, or wider privilege. Defenders should monitor directory synchronization, federation changes, privileged role assignments, and unusual sign-ins across both environments. Strong MFA, tight admin separation, and careful recovery planning help limit blast radius when identity is the target.