Topic starter
12/06/2026 9:22 pm
TL;DR: Fewer than 7% of applications support SCIM, and most on-premises or private apps still resist federation, leaving manual identity execution as the default for many lifecycle tasks, according to Cerby. The app gap is structural, so IAM teams need governance models that assume disconnected systems will persist rather than disappear.
Editorial analysis by NHI Mgmt Group, based on content published by Cerby: “Modernizing identity lifecycle management: Why the identity coverage gap won't fix itself”.
By the numbers:
- Fewer than 7% of applications support SCIM.
Key questions
Q: What breaks when an application has no SCIM or federation support?
A: Lifecycle automation breaks at the point where identity systems can no longer push authoritative changes into the app.
Q: Why do disconnected apps create so many audit problems?
A: Because auditors need proof that access was granted, reviewed, and revoked consistently, not just a statement that policy exists.
Q: How should IAM teams handle applications that cannot be automated?
A: Treat them as governed exceptions, not temporary edge cases.
Practitioner guidance
- Map disconnected applications by lifecycle criticality Classify apps that lack SCIM, federation, or usable user management APIs, then rank them by how much access risk they create if onboarding or offboarding is delayed.
- Design a manual fallback control for every uncovered app Define who executes changes, what evidence is captured, and how completion is reviewed when no standards-based integration exists.
- Retire brittle custom connectors on a schedule Assign owners to each bespoke integration, set revalidation checkpoints after app upgrades, and decommission connectors that cannot be sustained.
Bottom line: Disconnected applications are not an edge case in enterprise identity, and the automation gap will persist where vendors do not expose standards-based controls.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
12/06/2026 11:23 pm
App standards gaps are a permanent governance condition, not a temporary integration backlog. The article shows that identity coverage problems persist because many applications will never support SCIM, federation, or reliable lifecycle APIs at baseline. That means lifecycle governance has to assume a durable manual tail instead of waiting for universal automation. Practitioners should treat disconnected apps as a standing control design constraint.
A question worth separating out:
Q: When should organisations prioritise standards support over custom integration work?
A: Prioritise standards support when the application is business-critical, has recurring joiner-mover-leaver activity, or would create a large compliance gap if access had to be managed manually. Custom work may solve one app, but standards reduce long-term maintenance and make lifecycle governance more scalable across the portfolio.
👉 Read our full editorial: Identity automation breaks down where app standards never arrive
This post was modified 3 days ago by NHI Mgmt Group