Identity coverage after an acquisition: what to find in the first 90 days

Acquisitions are a common source of unmanaged applications. Orchid Security lists M&A and growth events among its use cases, and the reason is not hard to see: on day one you own an estate you have never inventoried.

What arrives with an acquired company?

• A directory, often a different identity provider or a separate tenant of the same one.
• Applications bought or built by the acquired team, some on SSO and many not.
• Local administrators, vendor logins and break-glass accounts nobody wrote down.
• Service accounts and integration users holding credentials to systems you now own.
• People who are about to leave, because acquisitions change roles.

What does directory integration solve?

Connecting the directories lets people from both sides sign in to shared applications. For organizations on Microsoft Entra, Microsoft documents cross-tenant synchronization for multi-tenant organizations, licensed with Entra ID P1 per synced user, with groups and cross-cloud scenarios needing Entra ID Governance or the Entra Suite. It is the fast part, and it says nothing about the accounts inside the acquired company's applications.

What should the first 90 days cover?

1. Days 1 to 30: build the application list. Combine the acquired company's SSO app list, expense and procurement records, and whatever discovery you can run. Count applications outside SSO and outside automated provisioning; the coverage gap calculator does the arithmetic.
2. Days 31 to 60: pull account lists from the applications that matter most (finance, customer data, production systems) and match them to people. Flag local admins, shared logins and service accounts.
3. Days 61 to 90: assign an owner to every application and every non-personal account, remove what nobody claims, and set the review schedule.

Why do leavers matter more than usual?

Role changes and departures cluster after a deal. A departing employee from the acquired company may hold a local admin account in an application your identity provider has never seen. The OWASP Non-Human Identities Top 10 lists Improper Offboarding first (NHI1), and an acquisition is offboarding at scale.

Where do tools fit?

The tools on this site address different parts of this list. Discovery tools aim at the first 30 days; IGA platforms take over once applications are known and connected; access graphs help with the account review in the middle. The rankings show each tool's layer next to its score, and the register shows which parts of the estate each vendor documents.

Sources