Lepide Active Directory Cleaner Behavior in Hybrid Environments

Overview:

Lepide AD Cleaner is designed to identify inactive users and computers based on activity within an on-premises Active Directory (AD) environment. It does not integrate with or analyze activity from Microsoft Entra ID (Azure AD).

Limitation in Hybrid Environments:

In hybrid environments where both on-prem AD and Microsoft Entra ID are in use, AD Cleaner evaluates inactivity solely based on on-prem AD logon data. It does not consider:

Entra ID (Azure AD) sign-in activity or Cloud-based authentication or usage
Any user activity outside the domain network

• As a result:

  • Users who are actively working in cloud services (e.g., Microsoft 365) but not logging into the on-prem domain will be marked as inactive

  • This can lead to incorrect identification of active users as stale or unused accounts

• Impact

  • Due to this limitation, the following risks may occur:

  • Active cloud-only users may be flagged for cleanup

  • Automated actions (such as disablement or deletion) may affect valid accounts

  • Administrative overhead may increase due to false positives

• Recommendation

  • Based on this behaviour, it is recommended to:

  • Disable AD Cleaner in hybrid environments where users primarily authenticate via Entra ID

  • Avoid relying on AD Cleaner for inactivity detection in environments with significant cloud-only usage

  • This ensures that no unintended actions are taken against users who are active outside the on-premises domain.