When operating in a hybrid environment, the idea is to have the user maintain responsibility for a single ID with the infrastructure federating all other required identities. This federation would include the primary identity needed by an end user and all associated enterprise roles that the user is likely to hold within the enterprise.