Notifications
Clear all
Topic starter
24/06/2026 10:34 pm
TL;DR: 40% to 80% of custom-built applications are not connected to IGA systems, leaving entitlement governance fragmented and compliance reporting harder across enterprise estates, according to Saviynt. That gap matters because identity programmes that stop at packaged apps still leave the largest custom surface unmanaged.
NHIMG editorial — what this means for NHI practitioners
By the numbers:
- 83% of organizations globally also use hundreds of custom-built apps to fulfill specific internal business requirements.
- 40% to 70% of custom-built applications are not connected to IGA systems.
- 80% for organizations with lower-maturity IGA programs.
Questions worth separating out
Q: How should security teams govern entitlements in custom applications that lack standard connectors?
A: They should define a repeatable entitlement model first, then require every custom connector to support request, approval, provisioning, audit, and removal in the same workflow.
Q: Why do custom applications create more identity governance risk than packaged SaaS apps?
A: Custom applications usually expose unique entitlement structures, which makes policy enforcement harder to standardise.
Q: What breaks when entitlement provisioning stays manual in IGA programmes?
A: Manual provisioning introduces delay, inconsistency, and weak evidence quality.
Practitioner guidance
- Map custom applications to entitlement ownership Assign a business owner, technical owner, and identity owner for every custom application before connector work begins.
- Standardise entitlement objects before building connectors Define how groups, roles, and app-specific entitlements are represented in the identity platform so every custom connector uses the same lifecycle pattern.
- Remove manual provisioning steps from entitlement flows Where the target app exposes APIs, automate the provisioning path end to end so entitlement requests, approvals, and audit logging occur in the same workflow.
What's in the full announcement
Saviynt's full blog post covers the operational detail this post intentionally leaves for the source:
- Connector-level implementation detail for database and REST-based target apps, including how the framework is applied in practice.
- The full workflow mechanics behind entitlement provisioning, approval handling, and audit trail generation.
- How ELMF works alongside previous-generation connector frameworks in existing environments.
- The vendor's own description of deployment scope and usage patterns for IAM administrators, application owners, and help desk staff.
👉 Read Saviynt's blog post on entitlement lifecycle management for custom apps →
Custom app entitlement governance: what IGA teams need now?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
25/06/2026 7:17 am
Custom application entitlement sprawl is the real IGA failure mode here. The headline risk is not connector scarcity by itself, but the inability to govern entitlement changes consistently across a long tail of bespoke applications. When 40% to 70% of custom apps are outside IGA coverage, the programme is already certifying only part of the estate. The implication is that entitlement governance must be designed for heterogeneity, not only for supported enterprise apps.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which means entitlement governance often starts from incomplete inventory data.
A question worth separating out:
Q: Who is accountable when a custom app entitlement is provisioned outside policy?
A: Accountability should sit with the application owner and the identity governance owner together, because one owns the business use case and the other owns the control path. If the process cannot show who approved, who provisioned, and what policy was applied, the entitlement should be considered uncontrolled.
👉 Read our full editorial: Entitlement lifecycle management for custom apps and IGA gaps
