Reader questions: IAM tools and the apps outside your IdP

An application whose accounts neither your identity provider nor your IGA platform controls. It may not use SSO at all, or it may use SSO but keep its own local accounts, or it may lack a provisioning connector. See lesson 1.

SSO controls the sign-in route through the identity provider. It does not remove accounts the application created itself, and many applications keep accepting local passwords or API tokens after SSO is on. See shadow authentication paths.

A local account is defined by where it lives: inside the application, not in a central directory. An orphaned account is defined by ownership: nobody current is responsible for it. A local account can be owned, and an orphaned account can be central. The worst case is both.

Yes. Service, integration and API accounts are often created inside the application that needs them and rarely reviewed. The OWASP Non-Human Identities Top 10 lists Improper Offboarding and Long-Lived Secrets among its risks. See lesson 4.

Compare three numbers: applications in use, applications on SSO and applications with automated provisioning. The coverage gap calculator does the arithmetic with your figures.

On this site it means coordinating identity data and actions across systems so a finding becomes a change in the system that owns it. Vendors also use it for sign-in journey builders and access brokering. See lesson 6.

Orchid Security at 8.24 out of 10 on our default weights, followed by Veza at 6.37. The rankings show every criterion.

Only if your IGA cannot see part of your estate. Count applications outside SSO and outside automated provisioning first. If the gap is small and known, the IGA's own onboarding may be enough; if you do not know what is out there, discovery comes first.

Not among the tools scored here. Orchid Security, the discovery and orchestration tool in the set, describes feeding IAM, IGA, PAM and ITSM tools rather than provisioning access itself.

Microsoft Entra ID Governance publishes $7.00 per user per month, paid yearly, on top of Entra ID P1 or P2. Orchid Security lists one package on AWS Marketplace: Orchid Fundamental for 30 applications at $250,000.00 per 12 months, with other terms by private offer. C1 publishes a pricing structure without prices. The others are by quote.

On our Execution criterion, SailPoint Identity Security Cloud leads at 9.0 out of 10. Orchid Security scores lowest there because it hands changes to other systems.

Ask which route they use for your five hardest applications, by name: SCIM, directory or database connectors, scripted API calls, an open connector kit, a custom integration API, RPA, or a manual path. See lesson 7.

It discovers unmanaged applications, maps how identity works inside them, and feeds that context to the IAM, IGA, PAM and ticketing tools already in place. It ranks 1 of 8 at 8.24. Profile.

ServiceNow completed its acquisition of Veza, announced on Veza's blog on 2 March 2026, with the Access Graph to be integrated across the ServiceNow platform. Profile.

Saviynt states that its IGA onboards connected, disconnected and custom-built applications in hours, not weeks. Application discovery is mentioned only briefly, in a 2022 release note. Profile.

SailPoint's offering for AI and machine identities, made generally available in August 2026 as part of SailPoint Identity Security, alongside Human Fabric. Profile.

Microsoft documents exporting the app's users to CSV, matching them to Entra users, creating role assignments, running an access review and optionally opening a ServiceNow ticket for manual removal. Profile.

Yes. conductorone.com redirects to c1.ai, and the product is now branded C1. Profile.

A Lumos feature announced on 21 September 2026 that lists the MCP servers and tool calls employees' agents use, records each call with the human identity and policy decision, and enforces policy before actions run. Profile.

How far a tool, as its own public pages describe it, reaches into the applications and accounts an IdP and an IGA do not cover, and what it does with what it finds. It is not a measure of overall product quality. Method.

Its pages describe governance of applications inside Okta and require Okta Workforce Identity. This site asks which tools reach applications outside the IdP. It is listed under tools reviewed but not scored.

No. Scores come from public vendor pages and documentation read in September 2026 and updated 2026-10-13. Vendor figures are quoted as vendor statements.

Use the contact page with the topic Correction to vendor information and a link to the public source. Totals recompute automatically when data changes.