Topic starter
24/06/2026 10:41 pm
TL;DR: Fewer than 7% of roughly 10,000 applications support SCIM, leaving most enterprise apps outside automated provisioning, deprovisioning, and access governance workflows, according to Cerby. That app gap turns identity lifecycle management into manual work, with orphaned accounts, delayed removals, and fragmented audit trails becoming structural rather than exceptional.
Editorial analysis by NHI Mgmt Group, based on content published by Cerby: “Modernizing identity lifecycle management: Why IAM programs miss the apps that matter most”.
Key questions
Q: What breaks when an application has no SCIM or federation support?
A: Lifecycle automation breaks at the point where identity systems can no longer push authoritative changes into the app.
Q: When does manual lifecycle management become a security risk?
A: Manual lifecycle management becomes a risk as soon as entitlement changes depend on tickets, email, or human memory.
Q: What are the signs that IAM coverage is only partial?
A: A partial IAM programme usually shows up as a split between federated apps and locally managed apps, plus inconsistent offboarding completion and fragmented evidence for access reviews.
Practitioner guidance
- Inventory disconnected applications by lifecycle coverage Classify apps by whether they support SCIM, expose user management APIs, or require local administration so you can see where joiner, mover, and leaver workflows break down.
- Prioritise leaver workflows for manual apps For apps outside IAM and IGA control, build a revocation sequence that confirms account disablement, token removal, and audit evidence rather than assuming a ticket closed the loop.
- Separate authentication from lifecycle governance Do not treat SAML or OIDC support as proof that an app is governed.
Bottom line: Disconnected applications turn identity lifecycle management into a partial control problem, not a fully automated one.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 7:28 am
The app gap is no longer an exception problem, it is the operating model. Identity programmes that assume most applications can be governed through standards-based provisioning are already misreading enterprise reality. Cerby’s data point that fewer than 7% of roughly 10,000 applications support SCIM is the signal: lifecycle control coverage is structurally incomplete, not merely under-implemented. Practitioners should treat disconnected apps as a permanent governance tier, not a backlog item.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: How should teams govern apps that cannot be automated through identity tools?
A: They should govern them as exceptions with explicit ownership, documented manual controls, and stronger verification of revocation. If automation is impossible, the control objective shifts to making manual execution auditable, repeatable, and tied to application criticality rather than leaving it informal.
👉 Read our full editorial: Disconnected apps are breaking identity lifecycle automation