The unmanaged application estate: what your identity provider misses

What counts as unmanaged?

In identity terms an application is managed when a central system decides who can sign in to it and when that access ends. In most organizations that means an identity provider for sign-on and an IGA platform for provisioning, reviews and removal. An application is unmanaged when neither of them controls its accounts. That covers three different situations:

• The app is not in the identity provider at all. Nobody configured single sign-on for it, so it does not appear in the IdP's application list.
• The app signs in through the IdP but keeps its own accounts. Sign-on is central, but the application also holds local users, admin logins or API users that the IdP never created.
• The app is known but has no provisioning connector. Joiners and leavers reach it through a ticket, a spreadsheet or a person who remembers.

Why does the identity provider miss it?

Sign-on and provisioning are configured one application at a time. SCIM, the standard provisioning protocol, is defined in RFC 7644 as an HTTP-based protocol that makes managing identities across domains easier, and it only helps when the application implements it. Many older on-prem systems, custom-built tools and niche SaaS products do not. An identity provider can only report on what it has been connected to, so its view of the estate is really a list of the integrations someone built.

Where does the unmanaged estate come from?

• Teams that buy SaaS directly and sign up with an email address and password.
• Applications built in-house, where authentication was written by the team that built the app.
• Acquisitions, which arrive with their own directories, applications and admin accounts.
• Legacy and on-prem systems that predate the identity provider.

Why does it matter?

Two problems recur. The first is leavers: disabling a person in the identity provider does not touch an account the identity provider did not create. The second is evidence: auditors ask for the list of people with access to in-scope systems, and for applications outside central control that list is pulled by hand each cycle. NIST SP 800-53 control AC-2 covers account management across the whole lifecycle, including disabling accounts that are no longer associated with a user. It does not exempt applications that lack a connector.

How do tools approach it?

The tools scored on this site take different routes. Some find applications from sign-up and login activity: C1 monitors shadow app sign-ups and logins, and Lumos surfaces shadow IT in its Identity Analytics. Orchid Security states that it discovers SaaS, cloud, on-prem, legacy and custom-built applications and maps how identity works inside them. IGA platforms such as Saviynt onboard disconnected applications once someone has identified them. The Outside-Estate Register records what each vendor documents, zone by zone.

What should you do first?

Count. Put three numbers side by side: applications in use, applications signed in through the IdP, and applications with automated provisioning. The coverage gap calculator does the arithmetic. The difference between the first and the third number is the part of the estate where leavers keep access unless someone removes it by hand.

Sources