Topic starter
25/06/2026 12:48 am
TL;DR: Disconnected apps now make up a large share of enterprise SaaS and legacy estates, and the source article argues that identity teams still govern them with tickets, spreadsheets, and manual password updates, creating visibility, compliance, and remediation gaps according to Cerby. Manual control can extend coverage, but it does not scale as a durable identity governance model.
Editorial analysis by NHI Mgmt Group, based on content published by Cerby: “Cerby + Okta Identity Governance: Bringing Governance to Disconnected Apps”.
By the numbers:
- Around 65% of SaaS applications used within organizations are not approved by IT.
Key questions
Q: What breaks when disconnected applications are not brought into identity governance?
A: When disconnected applications sit outside the identity system, provisioning, review, and offboarding become inconsistent and hard to evidence.
Q: Why do disconnected apps create operational and compliance risk?
A: Disconnected apps create risk because the organisation cannot consistently prove who has access, who owns the account, or whether access was removed at the right time.
Q: How should security teams govern applications that do not support SCIM or SAML?
A: They should treat those applications as lifecycle exceptions that still need full governance, not as exempt systems.
Practitioner guidance
- Inventory disconnected apps as a separate governance estate Build a distinct inventory for applications that lack SAML, SCIM, or usable API control, and record owners, admins, entitlement models, and lifecycle path for each one.
- Replace spreadsheet-based reviews with app-owner evidence Require each disconnected app to have a named owner who can validate entitlements, approve access, and confirm offboarding evidence during access certification.
- Automate password rotation for manual-control apps Set shorter credential lifetimes for apps that still depend on human-managed logins, especially where admin access or shared accounts remain in use.
Bottom line: Disconnected apps create a governance blind spot because standard identity integrations cannot reach them, so access control depends on compensating processes.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 9:49 am
Disconnected apps create an identity governance boundary problem, not just an integration problem. If an application cannot speak the standards your identity stack expects, it falls outside the automated lifecycle that makes governance auditable. That means access control becomes partial by design, and the gap is structural rather than accidental. Practitioners should treat the disconnected-app boundary as a governance domain of its own, not a leftover exception.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: Should organisations prioritise remediation of disconnected apps before expanding access governance?
A: Yes, if the disconnected estate is large or contains sensitive systems, because adding more workflow around a blind spot only scales the gap. Teams should first establish inventory, ownership, and revocation paths, then expand review and approval coverage.
👉 Read our full editorial: Disconnected app governance is the identity blind spot teams miss