TL;DR: Thirty percent of enterprise applications are disconnected from identity systems, many of them business-critical, leaving access, audit evidence, and lifecycle controls dependent on manual workarounds, according to Cerby. The maturity gap is no longer about SSO coverage alone, but whether identity programmes can reach the full application estate.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Cerby's research: Disconnected applications remain outside IdP, IGA, MFA, and lifecycle automation, creating a blind spot that drives audit pain, manual work, and stalled identity maturity.
Why it matters: IAM, IGA, PAM, and security teams need to account for the applications their controls cannot reach, because partial coverage creates false confidence and leaves business-critical access unmanaged.
Context
Disconnected applications are SaaS and on-premises tools that do not support standard identity integrations such as SAML, OIDC, or SCIM. When that happens, identity controls stop at the boundary of the application estate rather than governing access end to end.
Cerby's article argues that this is no longer a fringe problem. Identity programmes can look mature on paper while a meaningful share of business-critical applications still depend on tickets, spreadsheets, direct admin logins, and other manual access processes.
The governance gap matters because identity maturity is often measured against connected systems only. If disconnected applications are excluded from policy enforcement, audit evidence, and lifecycle automation, the programme is not complete even when core controls appear strong.
Key questions
Q: What breaks when disconnected applications are not brought into identity governance?
A: When disconnected applications sit outside the identity system, provisioning, review, and offboarding become inconsistent and hard to evidence. Access can persist after business need ends, audit trails fragment, and incident response loses confidence in who still has access. The result is not only operational drag but a control gap that weakens the entire identity perimeter.
Q: Why do disconnected apps create so many audit problems?
A: Because auditors need proof that access was granted, reviewed, and revoked consistently, not just a statement that policy exists. Disconnected apps often force teams to assemble evidence after the fact from emails, screenshots, and export files. That is slow, fragile, and difficult to defend when controls are reviewed at scale.
Q: How should IAM teams prioritise disconnected application remediation?
A: Start with systems that are business critical, heavily privileged, or tied to quarterly access reviews, because those create the highest risk if they remain outside governance. Then sort by the cost of manual handling and the volume of unresolved tickets, so the first projects remove the most control debt.
Q: How should organisations measure identity maturity beyond access reviews?
A: Measure identity maturity by linking access governance to operational outcomes such as response time, helpdesk demand, and audit effort. A mature programme reduces the time needed to detect and contain identity-driven incidents, while also lowering recurring access friction. If those outcomes do not improve, the programme is producing activity but not control.
Technical breakdown
Why disconnected applications sit outside identity control planes
Disconnected applications do not expose the federation and provisioning hooks that identity platforms expect. Without SAML or OIDC for authentication and SCIM for lifecycle actions, the IdP cannot issue the normal trust decision, and the IGA platform cannot push joiner-mover-leaver changes automatically. That forces organisations back to direct admin access, tickets, and manual updates. In practical terms, the control plane is split: policy may exist centrally, but enforcement happens ad hoc inside each application. That makes consistency hard to prove and even harder to scale.
Practical implication: Map every application that cannot be governed through standard federation and provisioning protocols before treating your identity programme as complete.
Why audit evidence breaks when access is managed manually
Audit failure in disconnected application estates is usually an evidence problem before it is a policy problem. Auditors want continuous proof that access was granted, reviewed, and removed under defined control. When teams reconstruct records from spreadsheets, screenshots, exports, and emails, the evidence chain becomes fragmented and retrospective. That weakens the defensibility of access certifications and deprovisioning claims. The issue is not only whether a control exists, but whether the organisation can demonstrate that it operated consistently across the full application estate.
Practical implication: Treat disconnected-app evidence as a control design issue and require auditable records for provisioning, review, and removal.
How disconnected apps stall identity maturity across the estate
Identity maturity stops progressing when a large part of the estate still depends on workarounds. Automating connected applications while leaving disconnected ones on tickets and scripts creates a two-speed operating model. The connected layer gets stronger governance, while the disconnected layer absorbs operational drag, delayed deprovisioning, and uneven access reviews. That split also limits Zero Trust coverage, because continuous verification and least-privilege enforcement cannot extend consistently to applications the platform cannot reach. The maturity gap is therefore architectural, not just procedural.
Practical implication: Measure identity maturity by coverage across the whole estate, not by how well connected applications are governed.
Threat narrative
Attacker objective: The objective is to exploit the identity blind spot around disconnected applications so access persists without effective oversight or evidence.
- Entry occurs through an application that sits outside standard identity integration, so access is granted through direct admin logins, tickets, or weak credentials instead of federated controls.
- Credential and lifecycle abuse follow when those manual processes leave access unreviewed, unrevoked, or difficult to trace across disconnected systems.
- Impact lands as audit findings, delayed deprovisioning, and increased exposure on business-critical applications that remain outside centralized governance.
Breaches seen in the wild
- Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
- Cloudflare Thanksgiving breach 2023: One service token and three service accounts left unrotated after the Okta breach gave a nation-state attacker access to Cloudflare's Atlassian systems.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Disconnected applications are not an edge case, they are a governance boundary failure. Identity programmes often assume that once IdP, MFA, and IGA are deployed, the control plane reaches most of the environment. That assumption fails when applications do not support federation or automated provisioning, because policy cannot be enforced where the control surface ends. The implication is that identity maturity must be judged by coverage, not by control adoption.
Manual access handling creates an evidence debt that auditors eventually surface. Tickets, spreadsheets, screenshots, and ad hoc exports may document activity after the fact, but they do not create durable control evidence. In practice, disconnected applications turn every review into a reconstruction exercise. That is why the compliance problem is operationally expensive long before it becomes formally non-compliant.
Identity maturity metrics built only on connected applications are structurally misleading. A programme can enforce strong controls on federated systems and still leave a material share of business-critical applications outside governance. That creates a false positive on maturity and hides the real exposure area. The practitioner implication is to define maturity by estate-wide enforceability, not by best-in-class coverage of the easiest apps.
Disconnected application sprawl is now an identity lifecycle problem, not just an access problem. Once provisioning and deprovisioning depend on people rather than systems, joiner-mover-leaver discipline becomes inconsistent by design. Access reviews slow down, offboarding slips, and entitlement drift becomes normal. The practical conclusion is that lifecycle governance must account for the applications the platform cannot currently reach.
From our research library:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
What this signals
Disconnected applications expose a coverage problem that many IAM programmes still undercount: the controls are strong where integrations exist, but ineffective where the estate falls back to tickets and direct admin access. The programme signal is simple: if the application cannot be governed, it should not be counted as mature coverage.
Coverage gap debt: identity teams accumulate governance debt every time they accept disconnected systems as exceptions. Over time, those exceptions become the operational norm, which makes lifecycle management slower and audit evidence less defensible.
For practitioners, the next step is to treat disconnected-app remediation as an identity architecture issue rather than a tooling nuisance. That means measuring where control enforcement stops and deciding which business-critical systems must be brought inside the governed boundary first.
For practitioners
- Inventory disconnected application coverage Build a separate inventory of SaaS and on-prem applications that cannot currently be governed through SAML, OIDC, or SCIM, and classify them by business criticality, data sensitivity, and access method.
- Separate evidence collection from manual workflows Define a minimum evidence standard for provisioning, access review, and deprovisioning in disconnected apps so auditors are not forced to rely on spreadsheets and screenshots.
- Prioritise business-critical disconnected apps first Focus remediation on the applications that support core workflows or store sensitive data, because those are the systems where manual governance creates the largest exposure.
- Reduce reliance on brittle automation workarounds Review scripts, RPA flows, and workflow automations that currently substitute for native identity integration, and retire the ones that require constant maintenance or create blind spots.
Key takeaways
- Disconnected applications create a blind spot where identity controls stop working even though the programme appears mature on paper.
- The evidence of the problem is operational as much as technical, with manual workflows making access reviews and audit trails harder to defend.
- The practical response is to measure control coverage across the full application estate and prioritise the applications that matter most to the business.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-03 — Vulnerable Third-Party NHI | Disconnected business apps and AI tools function like unmanaged access surfaces outside standard identity controls. |
| NHI-01 — Improper Offboarding | Manual deprovisioning in disconnected apps creates delayed or missed access removal. | |
| NHI-05 — Overprivileged NHI | Direct admin logins and workaround access patterns often leave excess privilege in place. | |
| Recommendation — Inventory unmanaged application access points and bring them under governed lifecycle control. Track offboarding completion for every disconnected app and verify removal evidence. Reduce standing access in disconnected apps to the minimum required for each role. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about inconsistent access governance across an estate with unreachable apps. |
| Recommendation — Extend entitlement governance to applications that currently rely on manual access handling. | ||
| CIS Controls v8 | CIS-5 — Account Management | Disconnected apps often depend on manual account lifecycle processes that CIS-5 targets. |
| Recommendation — Standardise account creation, review, and removal for every non-federated application. | ||
Key terms
- Disconnected Application: An application that is not integrated with the organisation's central identity and access stack. Access is often managed through shared passwords, manual approval, or local admins, which makes revocation, evidence, and ownership harder to enforce consistently across the application lifecycle.
- Identity Coverage: The portion of an organisation’s application and account estate that is actually reachable by central identity controls. For disconnected environments, coverage is not just about count or inventory. It is about whether policy, lifecycle, and verification can be enforced end to end.
- Evidence Debt: Evidence debt is the accumulation of missing, fragmented, or hard-to-assemble proof needed to show that identity controls are working. It becomes visible during audit, incident response, or investigation, and it usually signals that governance processes are not producing durable, auditable records.
- Identity maturity: Identity maturity is the degree to which an organisation has turned identity from a deployment into a managed operating model. In practice, it covers visibility, governance, automation, and continuous improvement across humans and non-human identities, with measurable controls rather than one-time implementation milestones.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 6, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org