Book an initial call
Book an initial call

The challenge

Orphaned accounts without reviews

Many applications manage their user accounts without a connection to an IGA solution. These accounts are subject to neither a governed lifecycle nor access reviews, so orphaned accounts go undetected.

Book an initial call

The challenge

Where the gap shows

  • Ownerless accounts

    Applications without IGA integration hold local accounts that are not linked to any identity. Who owns such an account is usually known only to the administrator who created it.

  • No complete view

    The same employee is mmueller in Active Directory, M4711 in SAP and maria.mueller in the business application. Her entitlements cannot be consolidated, so an SoD check is not possible.

  • Residual access after exit

    The HR system reports the exit, but the leaver process only takes effect in connected systems. In all others, the account stays active.

  • Access reviews with gaps

    Only what the IGA solution knows gets reviewed. Applications without integration are missing from the review, although the DORA RTS requires regular review of access rights (Article 21).

  • Impact

    Without identity governance

    Each application manages its own accounts. Control ends at the system boundary, and evidence is assembled by hand.

    • Orphaned accounts after exits
    • No complete view of an identity's entitlements
    • Access reviews only for connected applications
    • Every integration a one-off project
    • Audit evidence collected manually from business units
  • Our approach

    With identity governance

    Every application is connected to the IGA solution, and every account is assigned to a unique identity from the authoritative source. Uncorrelated accounts are clarified or disabled.

    • Authoritative source per population, such as HR for employees
    • Unique identifier per identity across all systems
    • Account correlation, uncorrelated accounts as findings
    • Standardized onboarding with the WertFels Application Onboarding Engine
    • Access reviews across all connected applications
ACCOUNTS IN THE APPLICATIONSIDENTITY?Orphaned accountno owner, not assignedFINDINGActive DirectorymmuellerSAPM4711Business applicationmaria.muellerReporting systemreport_batchMaria Müllerone identitySource: HR3 accounts assignedThree accounts belong to one person. The fourth has no owner and only surfaces once the application is integrated.ACCOUNTSIDENTITY?Orphaned accountno ownerActive DirectorymmuellerSAPM4711Business applicationmaria.muellerReporting systemreport_batchMariaMüllerSource: HR3 accountsThree accounts belong to one person.The fourth has no ownerand only surfaces with integration.

Results

What integration delivers

  • Accounts with owners

    Every account is assigned to an identity. Orphaned accounts surface during correlation, not at the next audit.

  • No residual access

    The leaver process revokes access automatically in all connected applications, without tickets to individual business units.

  • Complete reviews

    Managers and application owners review access rights across all connected applications, not just in Active Directory.

  • Audit-ready under DORA

    Every person has a unique identity with assigned accounts, as Article 20 of the DORA RTS requires. Joiner, mover and leaver processes run automatically.

Abstract digital network icon

Approach

From inventory to operations

APPLICATIONEFFORTIGA solutionSource: HRUnique IDCorrelationAccess reviewActive DirectorySSAPLBusiness appMMainframeXLCloud serviceSLDAPSAPJDBCRACFSCIM?Owner clarifies01 Inventory02 Define authoritative sources03 Correlate accounts04 Integrate applications05 Access reviews and operationsExample, simplified
  1. 01

    Inventory

    All applications and accounts are captured from the CMDB and target systems. Each application gets an effort class from S to XL.

  2. 02

    Define authoritative sources

    HR for employees, a dedicated system such as supplier management for externals. Each identity gets a unique identifier.

  3. 03

    Correlate accounts

    Matching by employee ID, identifier or email address. The application owner clarifies uncorrelated accounts, otherwise they are disabled.

  4. 04

    Integrate applications

    Integration in waves using standard connectors such as AD/LDAP, SCIM, JDBC, REST, SAP and RACF, with an acceptance test before every go-live.

  5. 05

    Access reviews and operations

    All connected applications are added to access reviews. New applications go into production only with IGA integration.

Ready for the next step

Talk to us about your IAM landscape

Tell us briefly about your project. We will get back to you and discuss where your IAM stands today.

    Thank you for your inquiry

    Your message has been sent.
 Our team will get back to you as soon as possible.