IDENTITY CLASSROOM
Identity classroom: lessons on the apps and accounts your IdP cannot see
The short answer
Ten lessons in three tracks: map what sits outside the identity provider, choose which layer of the identity stack should handle it, and prove control to an auditor. Each lesson takes a few minutes and links the sources it uses. Start with the first lesson if the term unmanaged estate is new to you.
By The Credential Desk · IAM Compared · Published 2026-10-08
What sits outside the identity provider?
The applications, accounts and sign-in routes central identity tools do not see.
LESSON 01
The unmanaged application estate: what your identity provider missesThree kinds of unmanaged app, where they come from and why they matter.
3 min read
LESSON 02
Local accounts, break-glass logins and hardcoded credentials inside applicationsThe accounts an application creates for itself, and why offboarding misses them.
3 min read
LESSON 03
Shadow authentication paths: sign-ins that bypass single sign-onWhy an app on single sign-on can still be entered another way.
2 min read
LESSON 04
Service accounts and other non-human accounts created inside applicationsMachine accounts that applications create for themselves.
2 min read
Which layer of the identity stack does what?
IdP, IGA, access graph, discovery and connectors, and where each one stops.
LESSON 05
IdP, IGA, access graph and discovery: which layer of the identity stack does whatWho signs people in, who governs, who maps and who finds.
2 min read
LESSON 06
What identity orchestration means, and why vendors use the term differentlyOne term, three meanings, and the questions that separate them.
2 min read
LESSON 07
How identity tools reach applications without APIs or SCIMSeven ways to get account data in and out of a hard application.
3 min read
How do you show an auditor you are in control?
Ownership, audit evidence and the numbers worth reporting.
LESSON 08
Assigning an owner to every application accountWhy unowned accounts are the ones that stay open.
2 min read
LESSON 09
Application access evidence for SOX IT general controlsWhy the user list is the evidence auditors test first.
2 min read
LESSON 10
Measuring identity coverage: the numbers worth reporting each quarterFive numbers that show whether the gap is closing.
2 min read