Assigning an owner to every application account

What does ownership mean for an account?

For a personal account the owner is the person who uses it, and HR records say whether that person still works for you. For anything else the owner has to be assigned: a system owner for a service account, a named custodian for a break-glass login, a business owner for the application itself. An orphaned account is one where that link is missing or points to someone who has left.

How does ownership break?

• People leave or change roles and their service accounts stay behind.
• Applications change hands after a reorganization or an acquisition.
• Accounts are created for a project and the project ends.
• Shared logins have many users and therefore no owner.

Where do reviews depend on it?

Access reviews route each decision to someone. SailPoint documents Manager, Source Owner and Search campaigns, which send decisions to a person's manager, to the owner of the system, or to a query-defined reviewer. Microsoft documents reviews for applications that do not support provisioning, run after the users are exported and matched. In each case an account with no recorded owner has no obvious reviewer, and it tends to be approved by default or skipped.

Where does offboarding depend on it?

HR-driven offboarding removes what it can tie to the departing person. C1 describes a lifecycle feature to find what offboarding missed, which is a direct admission that tying everything to a person is hard. Non-human accounts are worse: the OWASP Non-Human Identities Top 10 lists Improper Offboarding as NHI1.

What do regulators ask?

For financial entities in the EU, Commission Delegated Regulation (EU) 2024/1774, which supplements DORA, requires a lifecycle management process for identities and accounts, withdrawal of access rights on termination, and a review of access rights at least once a year for staff with access to ICT assets that support critical or important functions. A review that cannot name an owner for an account cannot show that the account was reviewed.

A workable rule

1. Every application has a business owner and a technical owner.
2. Every non-personal account has a named owner and a stated purpose.
3. Every review routes unowned accounts to the application owner, never to an auto-approve.
4. Every leaver triggers a check for accounts they owned, not only accounts they used.

Sources