Disconnected apps and unmanaged identities are reshaping EMEA IAM

At a glance

What this is: This is an analysis of how disconnected apps and unmanaged corporate identities are reshaping IAM in EMEA, with the key finding that identity debt is now an operational and security burden, not just an access-control issue.

Why it matters: It matters because IAM teams have to govern far more than core directory-linked users now, and unmanaged app and identity sprawl increases offboarding risk, compliance drift, and helpdesk load across NHI, autonomous, and human identity programmes.

By the numbers:

• Less than 60% of SaaS applications are integrated into core IAM platforms on average, according to Cerby.
• One Israeli scale-up said more than 25% of its helpdesk tickets were identity-related, according to Cerby.
• An AI-focused Israeli company said bots and automation tools make up 60% of active identities, according to Cerby.

Context

Disconnected apps are applications and identity stores that sit outside the core IAM and IdP control plane, so provisioning, access review, and offboarding become inconsistent. In EMEA, that gap is widening because SaaS sprawl, global hiring, and lean security teams are outpacing governance processes.

The article argues that this is no longer just an IAM administration problem. It is a governance problem because unmanaged corporate identities, including non-human accounts in some environments, create control gaps across access, accountability, and lifecycle management.

Key questions

Q: What breaks when applications sit outside IAM integration?

A: When applications sit outside IAM integration, provisioning, revocation, and access review become fragmented. That creates identity debt because teams must handle access by ticket or spreadsheet instead of a governed lifecycle. The practical result is slower offboarding, weaker accountability, and a larger surface for orphaned access to persist unnoticed.

Q: Why do disconnected apps create operational and compliance risk?

A: Disconnected apps create risk because the organisation cannot consistently prove who has access, who owns the account, or whether access was removed at the right time. That makes compliance evidence incomplete and turns routine identity changes into manual work that consumes time, slows delivery, and increases the chance of mistakes.

Q: What are the warning signs that identity debt is getting out of control?

A: Common warning signs include offboarding that takes days, helpdesk tickets dominated by access issues, large numbers of applications outside the IdP, and unclear ownership for SaaS accounts. When those symptoms appear together, the identity programme is governing only part of the real environment.

Q: How should organisations govern non-human identities in fragmented app estates?

A: Organisations should put machine accounts, automation tools, and bots into the same ownership, inventory, and retirement model used for human identities. The key is to require a business owner, lifecycle visibility, and a revocation path so those identities do not persist beyond the task or system they support.

Technical breakdown

Why disconnected apps break identity governance at scale

Disconnected applications create an identity control plane split. Core IAM can only enforce policy where it has integration, so any app outside the IdP becomes an exception for provisioning, authentication, authorization, and revocation. That exception may look small in isolation, but at SaaS scale it becomes a separate governance surface with no reliable joiner-mover-leaver workflow. The result is that access reviews become partial, offboarding becomes manual, and ownership becomes ambiguous. This is why identity debt behaves like technical debt: each unmanaged app adds future remediation cost and control uncertainty.

Practical implication: treat every unintegrated SaaS app as a governance exception that needs explicit ownership and lifecycle coverage.

Why offboarding and access reviews slow down when apps sit outside IAM

Offboarding depends on knowing where the identity exists, which accounts it controls, and which integrations can revoke it. If an app is not tied into the IAM lifecycle, revocation is manual and often delayed. Access reviews also lose fidelity because reviewers can only certify what the system inventories, not what employees have accumulated through shadow onboarding or team-by-team exceptions. In practice, the control failure is not a missing policy statement but a missing enforcement path. That is why the article’s examples describe days-long offboarding and hours of helpdesk work for identity issues.

Practical implication: map every access path that still requires manual removal and prioritize those accounts for lifecycle automation.

Why non-human identities magnify the same IAM gap

When bots, scripts, and automation tools are treated as ad hoc identities rather than governed accounts, their lifecycle often sits outside the same review and revocation logic as human users. That creates a parallel estate of active identities that can outlive projects, owners, or business justification. In environments where NHI already make up a large share of active identities, the core issue is not whether the account is human or machine. It is whether the organisation can inventory it, assign an owner, and retire it on schedule. Without that, IAM coverage stays incomplete by design.

Practical implication: extend identity inventory, ownership, and offboarding controls to machine and automation accounts, not just employee accounts.

Threat narrative

Attacker objective: The practical objective is to exploit forgotten or poorly governed access paths that remain active after normal business changes, expanding reach without triggering standard IAM controls.

1. Entry occurs when a team adopts a SaaS application or automation account outside the core IAM integration path, creating an identity that is valid but not centrally governed.
2. Credential and account abuse follows when access persists after role change or departure because revocation must be done manually across disconnected systems.
3. Escalation happens as unmanaged identities accumulate privileges, hidden sharing, and orphaned access that reviewers cannot reliably see during certification.
4. Impact is operational and security related. The organisation absorbs slower offboarding, higher helpdesk load, compliance gaps, and a larger attack surface for account misuse.

Breaches seen in the wild

• EmeraldWhale Git config credential theft: Tokens in exposed .git/config files let EMERALDWHALE clone private repositories and steal more than 15,000 cloud credentials.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity debt is now a first-order governance problem, not a side effect of SaaS growth. The article shows that every unmanaged application creates an ownership, review, and revocation gap that core IAM cannot see unless it is integrated. That makes identity debt structurally different from ordinary IT sprawl because the risk sits in the control plane itself. Practitioners should treat integration coverage as a governance metric, not an implementation afterthought.

The control failure is lifecycle fragmentation, not lack of policy intent. The organisations described are not short on security awareness. They are short on enforcement paths that can keep up with app adoption, employee movement, and offboarding across a dispersed environment. That means the decisive issue is whether joiner-mover-leaver processes extend beyond the directory to every application that grants access.

Non-human identities expose the same gap with less tolerance for manual handling. When bots and automation tools already account for a major share of active identities, a human-centric IAM model stops reflecting reality. The practical implication is that ownership, inventory, and retirement discipline must apply equally to service accounts, automation accounts, and employee accounts. Otherwise, governance coverage lags actual identity usage.

Disconnected apps reveal a new operating model for EMEA identity governance. The article makes clear that lean teams are being forced to balance security, compliance, and business speed in the same workflow. That pushes IAM from a gatekeeping function into a lifecycle governance discipline spanning access, productivity, and accountability. Practitioners should expect programme success to be measured by how much of the estate is governed, not by how many logins are centrally authenticated.

Identity blast radius is becoming the right way to think about unmanaged access. In fragmented environments, the issue is not just that one identity is exposed. It is that each ungoverned app increases the number of places where access can persist beyond need, ownership, or employment. The safer programme is the one that reduces the blast radius of every identity by keeping lifecycle control attached to the actual application estate.

What this signals

Identity debt will increasingly define IAM maturity in EMEA. As SaaS adoption expands faster than integration coverage, the question is no longer whether teams have an IdP. It is whether the IdP actually governs the applications where work happens, including the long tail of disconnected tools and machine accounts.

Lifecycle governance is becoming the real differentiator. Organisations that can map ownership, offboarding, and review obligations across every app will reduce both risk and helpdesk burden. Those that cannot will keep paying for identity exceptions in the form of manual work, delayed revocation, and audit friction.

For practitioners

• Map application coverage against IAM integration Inventory every SaaS and internal application, then classify whether provisioning, authentication, and offboarding are centrally enforced or still manual. Use the results to identify which systems create identity debt by sitting outside the IdP control plane.
• Extend joiner-mover-leaver controls to disconnected apps Require a named owner, a removal path, and a recertification cadence for every application that stores corporate identities. Where the app cannot integrate directly, define an explicit compensating control and a manual revocation workflow.
• Track offboarding latency by application class Measure how long it takes to disable access across integrated and non-integrated apps separately. The goal is to expose where revocation still depends on tickets, handoffs, or tribal knowledge rather than system-enforced lifecycle control.
• Bring non-human identities into the same governance inventory List bots, scripts, automation tools, and other machine accounts alongside employee identities, then assign ownership and retirement criteria. If the account cannot be tied to a business owner, it should not remain active indefinitely.
• Set a coverage target for IAM-visible applications Define a measurable threshold for how much of the application estate must be under IAM control, then report progress by business unit. This shifts the conversation from ad hoc remediation to managed coverage expansion.

Key takeaways

• Disconnected apps turn IAM into a partial control system, because the most important access paths are often the ones least visible to central governance.
• The article shows that identity debt now carries operational cost as well as security exposure, with offboarding delays and helpdesk load becoming measurable symptoms.
• Practitioners need to expand lifecycle control beyond the directory and into the full application estate, including machine identities and other unmanaged accounts.

Key terms

• Identity Debt: Identity debt is the accumulation of unowned, over-permissioned, or poorly governed non-human identities that security teams cannot cleanly inventory or retire. It usually grows when experimentation outruns access governance, leaving service accounts and tokens active long after their original purpose has passed.
• Disconnected Application: An application that is not integrated with the organisation's central identity and access stack. Access is often managed through shared passwords, manual approval, or local admins, which makes revocation, evidence, and ownership harder to enforce consistently across the application lifecycle.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Lifecycle Governance: Lifecycle governance is the set of controls that cover creation, assignment, review, rotation, and retirement of identities and credentials. For NHIs, it is the difference between a temporary automation asset and a persistent access risk. Strong lifecycle governance keeps ownership and expiry tied to actual business use.

Deepen your knowledge

NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.