Webinar recording from 26.03.2026:
Cleaning up Active Directory: From chaos to a secure IT structure
Do you know exactly which permissions in Active Directory (AD) each person in your company has? In many organically grown IT environments, the AD turned into a black box long ago. Over the years, complex group structures, nested permissions and outdated accounts build up – often without documentation. The reason: time pressure, a shortage of skilled staff and operational priorities.
The result: a lack of transparency, security risks and blocked IT projects – especially during IAM rollouts or zero-trust strategies.
Watch the webinar recording now:
This is what the webinar “AD Clean-up” was about
The complexity trap in Active Directory
AD structures usually grow in an uncontrolled way and are often modelled on the organisational chart. What seems logical leads to massive problems in practice:
- Extreme nesting: Instead of clear role models (user → role → permission), deeply nested groups emerge that are highly prone to errors.
- Redundant permissions: Users receive rights via several paths – revoking them in a targeted way becomes almost impossible.
- Missing transparency: Without documentation, no one understands any more which dependencies exist.
These factors turn Active Directory into an acute security risk and prevent sustainable optimisation.
The solution: context instead of isolated data
migRaven.MAX takes a different approach: instead of isolated tables, the system analyses your IT structure via a Knowledge Graph. In doing so, data from more than 90 sources – including Active Directory, Entra ID, file servers and Microsoft Teams – is linked together.
The result: real understanding of interrelationships. You not only recognise dass a permission exists, but also warum – including dependencies on applications, services and data.
Ownership: The key to a sustainable AD Clean-up
A successful AD Clean-up rarely fails because of the technology – but because of missing decisions. migRaven.MAX therefore establishes a clear ownership model:
- Application Owner: Responsible for applications and the associated permissions
- Managers: Validate the access rights of their employees
- Sponsors: Review external access regularly
The integrated AI supports the identification of these responsible parties, e.g. through pattern recognition in group names and structures.
Safe clean-up with soft delete and control
The biggest hurdle when cleaning up: fear of outages. That is why migRaven.MAX relies on a multi-level safety concept:
- Soft delete: Objects are first deactivated instead of deleted
- Scream test: Final removal only takes place after a review phase
- Four-eyes principle: Critical changes are approved
- Rollback function: Every action can be reversed at any time
AI-supported analysis for well-founded decisions
migRaven.MAX acts as a virtual IT expert, which supports you in your decisions – without making any changes itself. You receive specific recommendations for action, checklists or requirement specifications based on your real system data.
The analysis is carried out on the basis of your own infrastructure – not on generic models. This produces reliable results without “hallucinations”. Your data remains protected because processing takes place locally or in compliance with the GDPR.
Conclusion: Active Directory as a security foundation
A clean Active Directory is the foundation of modern IT security. With the right strategy, an organically grown system once again becomes a controllable, secure and future-proof structure.
Start now: Analyse the state of your Active Directory and create the basis for secure IT processes, IAM projects and sustainable governance.
Further information
FAQ on the webinar “The path to a healthy Active Directory”
In many companies, Active Directory has grown over the years without sufficient documentation and has become a confusing “black box”. One main problem is the excessively deep nesting of groups, often across more than 7 to 9 levels, which creates redundancies and makes revoking permissions considerably more difficult.
migRaven.MAX uses a knowledge graph to link information from more than 90 data sources and to make dependencies visible. This allows administrators to see exactly why certain objects exist and whether they can be safely deleted.
The AI in migRaven.MAX works as an agentic system with direct access to the context of the local infrastructure database. Unlike generic AI systems, which frequently hallucinate, it delivers specific answers based on the real environment.
It helps, for example, to identify owners for groups, to recognize naming patterns such as „CTX“ for Citrix, or to produce ready-made requirement specifications and project plans for Clean-up projects.
Security has top priority: all data and backend systems remain on-premises in the customer's environment. Only meta information about the infrastructure is analyzed, not the contents of documents.
An Azure OpenAI key is used for language processing, ideally located in Sweden with regard to GDPR compliance and model availability. According to Microsoft, this data is not used to train the AI.
To reduce the fear of system outages when deleting, migRaven.MAX works with a staged model. With soft delete, accounts or groups are first disabled and moved to an interim OU.
Final deletion only takes place after a successful „scream test“, that is, when no error messages occur after a few days. Every action is fully documented and can be undone immediately with a mouse click if required.
migRaven.MAX is available in two main editions. The edition Foundation covers all functions for analysis and clean-up. The edition Evolution extends this with user provisioning via templates, the management of AD structures and alarming functions.
Important: both editions can also be used entirely without AI. The graph technology and all reports in the web interface remain fully functional even without AI support enabled.
