The reason here being that the organization we're setting up Splunk ES for is in the process of centralizing 4 different Active Directories into a single centralized one (Azure AD). We're planning to wrap up our implementation of Splunk ES in a month, while the central AD implementation will be done in December. Does anyone see any concerns or issues with bringing in only asset data for now, and then waiting until December to introduce the identity data? I understand that we'll just miss out on contexts associated with users performing actions that result in notable events, but wondering if there will be any actual concerns that we need to take into account.
