At close, the buyer acquires legal ownership. Operational control does not arrive with the funds. It follows the identity layer: the accounts, administrators, credentials, devices, recovery paths, service identities and third parties through which people and systems are recognised. If those remain opaque, the buyer may own an institution it cannot reliably command, observe or recover.
The identity layer is wider than the directory
Deal teams often ask for a user list and an administrator list. That is a start, not an inventory. The operational identity layer includes:
- Employees, contractors, advisers and former personnel with live access.
- Privileged administrators in infrastructure, applications, security and data platforms.
- Service accounts, API keys, certificates, signing keys and automated integrations.
- Recovery email addresses, phone numbers, devices and provider support processes.
- External identities accepted by banks, registrars, insurers, customers and vendors.
- Shared accounts and informal channels used when the formal system is inconvenient.
Control can fail through any one of them.
Day-one mistakes create inherited blast radius
The buyer is under pressure to connect reporting, communications and operations immediately. Fast integration can spread the target’s weaknesses into the acquirer. Connecting directories before understanding privilege may import dormant or excessive access. Deploying a common endpoint agent may disrupt unsupported systems. Federating applications may preserve local administrators the buyer cannot see. Resetting every credential may break machine identities and critical operations. The answer is not delay for its own sake. It is gated integration.
Establish minimum viable control
Before broad connection, the buyer should be able to:
- Identify the people and non-human identities supporting critical processes.
- Reach and verify the owners of privileged access.
- Disable or contain a compromised identity without destroying the business.
- Observe authentication and material administrative changes.
- Control creation of new privileged accounts and integrations.
- Recover critical accounts through channels that no departing person or seller still controls.
- Preserve evidence if an incident predates the transaction.
If these conditions are not met, isolate the relevant environment and treat every new connection as a risk decision.
Create an identity control ledger
For each critical system, record the authoritative identity source, privileged roles, recovery route, machine identities, external support access and owner. Add the last validation date and the evidence used. The ledger should reconcile three realities:
- What policy says should exist.
- What the system reports actually exists.
- What operators say they use to keep the business running.
The discrepancies are often more important than the official list. A service account shared through a messaging thread may matter more than twenty ordinary user accounts.
Treat recovery as ownership
An account is not under the buyer’s control if a seller, former employee or legacy provider can recover it. Change the recovery path, not only the password. Validate the registered contacts with the provider and test the process for the most critical accounts. Where a provider relies on personal knowledge or an individual relationship, convert that trust into an institutional record and a verified successor contact.
Sequence privilege before convenience
The first post-close identity programme should prioritise consequence:
- Remove access for people with no continuing role.
- Constrain and monitor privileged accounts.
- Rotate credentials that crossed transaction teams or shared repositories.
- Reissue machine credentials according to dependency and outage risk.
- Place new access behind a documented approval path.
- Only then expand federation, single sign-on and broader collaboration.
A cleaner login experience is not the same as control. Centralisation without understanding can centralise the compromise.
The ownership test
Ask the target team to walk through a critical identity failure: a cloud administrator is hostile, the primary domain is unavailable, or the recovery phone belongs to a departed founder. Observe who can act and what evidence the providers require. The buyer has operational control when it can authorise, observe, revoke and recover identity without borrowing the seller’s memory or goodwill. Until then, the share register is ahead of reality.