Each source sees only one slice of the estate. SSO misses direct signups and non-federated apps, procurement misses free and personally purchased tools, and surveys cannot reliably surface dormant access or service accounts. The result is partial scope that looks complete if teams do not reconcile the datasets.
Why each source only shows part of the estate
SSO, procurement and surveys are all useful discovery signals, but each one is blind to a different class of access. SSO is strong for federated sign-in, yet it will not surface direct signups, legacy logins or apps outside the federation boundary. Procurement sees approved spend, not shadow IT. Surveys depend on self-reporting, which is a weak way to uncover dormant access, shared accounts or service accounts.
That is why these sources often look complete in isolation. They each describe a real slice of access, but none of them is a complete inventory of who or what can reach a system.
Where the gaps come from in practice
The biggest failure mode is scope mismatch. SSO data reflects the identity provider, not every application path. Procurement data reflects contracts and purchase records, not free trials, personal cards or “temporary” tools that outlive their justification. Survey data reflects what people remember or believe, not what remains active in the environment.
Identity Provider and SSO Security Guide is useful here because the same trust boundary that makes SSO efficient also makes it incomplete if teams assume it covers every login path.
Practically, this means the missing access is often not exceptional, it is ordinary. Teams underestimate non-federated applications, manually created accounts, direct API credentials and old entitlements that never pass through a clean procurement or SSO record.
What teams have to reconcile to get the full picture
The answer is not to trust one source more than the others, but to reconcile them into a single access view. SSO, procurement, HR, cloud inventory, application telemetry and account discovery each contribute evidence from a different control plane. The useful question is not “which source is right?” but “which access paths are absent from each source?”
Workforce Identity Security Guide fits this problem because lifecycle controls only work when joiner, mover and leaver data is reconciled against the actual systems where access exists.
The 2024 State of Secrets Management Survey also reinforces the point that survey-based visibility is not enough, because access material can persist outside formal approval paths and still remain active long after the original owner has forgotten it.
Risk and Threat Considerations
Partial visibility is itself a security risk because it creates false confidence. If teams believe the estate is smaller than it is, they will miss dormant accounts, overprivileged service identities, externally created access paths and applications that bypass standard controls.
Failure mechanism: Each source captures only the records that pass through its own process, so hidden accounts, direct logins and unmanaged tools remain outside the reconciled view.
Impact: Unseen access increases the blast radius of compromise, weakens offboarding and makes audit or incident response decisions depend on incomplete evidence.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and OWASP ASVS set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | SSO gaps relate to incomplete user authentication coverage. |
| IA-5 — Authenticator Management | Direct signups and dormant access point to unmanaged credentials and tokens. | |
| Recommendation — Compare authenticated user sources to discover accounts outside SSO. Inventory and rotate authenticators that bypass central approval. | ||
| CIS Controls v8 | CIS-5 — Account Management | The question is about incomplete visibility into active accounts and access paths. |
| Recommendation — Reconcile account sources and remove orphaned access. | ||
| ISO/IEC 27001:2022 | A.5.16 — Identity management | Different records describe different identities and access paths. |
| Recommendation — Maintain one reconciled identity register across all access sources. | ||
| OWASP ASVS | V8 — Authorization | The issue is incomplete visibility into who can access what. |
| Recommendation — Verify authorization paths beyond the SSO boundary. | ||
Practitioner Guidance
What to prioritise: Treat access discovery as a reconciliation problem, not a reporting problem. The first pass should compare SSO, procurement and survey outputs against an authoritative application and account inventory so you can see where each dataset is silent.
What to verify: Check for non-federated apps, personal-purchase tools, dormant entitlements and service accounts that are absent from self-reported access lists. If those categories are not explicitly tested, the view is not complete enough to trust.
Practitioner takeaway: A complete access picture only emerges when teams accept that every source is partial and design the process to expose what each one cannot see.