A computer-implemented method comprising: storing, in an LDAP directory having a root node, in a first directory subtree (910A-N) that descends from the root node, identities of entities that are associated with a first identity domain but not with a second identity domain; storing, in the LDAP directory, in a second directory subtree (910A-N) that also descends from the root node but is separate from the first directory subtree, identities of entities that are associated with the second identity domain but not with the first identity domain; in response to a deployment of a first service instance to the first identity domain but not to the second identity domain, generating a first credential which, when inspected by an LDAP server that maintains the LDAP directory, causes the LDAP server to permit the first service instance to access identities that are stored in the first directory subtree but not identities that are stored in the second directory subtree; providing the first credential to the first service instance; in response to a deployment of a second service instance to the second identity domain but not to the first identity domain, generating a second credential which, when inspected by the LDAP server, causes the LDAP server to permit the second service instance to access identities that are stored in the second directory subtree but not identities that are stored in the first directory subtree; providing the second credential to the second service instance and permitting a cloud administrative component to access identities that are stored in all directory subtrees descending from the root node. storing, in an LDAP directory having a root node, in a first directory subtree (910A-N) that descends from the root node, identities of entities that are associated with a first identity domain but not with a second identity domain; storing, in the LDAP directory, in a second directory subtree (910A-N) that also descends from the root node but is separate from the first directory subtree, identities of entities that are associated with the second identity domain but not with the first identity domain; in response to a deployment of a first service instance to the first identity domain but not to the second identity domain, generating a first credential which, when inspected by an LDAP server that maintains the LDAP directory, causes the LDAP server to permit the first service instance to access identities that are stored in the first directory subtree but not identities that are stored in the second directory subtree; providing the first credential to the first service instance; in response to a deployment of a second service instance to the second identity domain but not to the first identity domain, generating a second credential which, when inspected by the LDAP server, causes the LDAP server to permit the second service instance to access identities that are stored in the second directory subtree but not identities that are stored in the first directory subtree; providing the second credential to the second service instance and permitting a cloud administrative component to access identities that are stored in all directory subtrees descending from the root node.