Topic starter
06/11/2026 6:37 pm
TL;DR: The biggest IAM gap is not control design but enforcement gaps around legacy, homegrown, self-hosted, and enterprise-tier-locked applications that sit outside SSO, SCIM, MFA, lifecycle automation, and access reviews, according to Way Security research. The control stack only matters when it reaches every application, including the ones that have been treated as exceptions.
Editorial analysis by NHI Mgmt Group, based on content published by Way Security: “The Last Mile of IAM: How to Fully Extend Your Identity Stack So it Reaches Everywhere”.
Key questions
Q: How should security teams add MFA to legacy apps without changing the origin?
A: Place the authentication decision at the front door, such as CloudFront or another reverse proxy layer, and preserve only the minimum state needed to complete the login flow.
Q: What breaks when identity lifecycle management depends on custom connectors?
A: Custom connectors usually fail when the target application changes its API, data model, or interface.
Q: How can teams tell whether an access review is based on live data?
A: A live access review is based on the current entitlement state, drawn from the source of truth for identities, roles, groups and privileged access rather than a spreadsheet or cached export.
Practitioner guidance
- Define enforcement coverage as a programme KPI Track how many production applications actually enforce SSO, MFA, provisioning, deprovisioning, and review data, not how many are merely catalogued.
- Classify exception-list applications by control gap Separate legacy, self-hosted, homegrown, and enterprise-locked systems so remediation paths match the reason they fell out of scope.
- Validate connectors against live schema drift Test read paths first, then prove write and provisioning flows in staging before production, and keep monitoring for changes that would break enforcement.
Bottom line: The core risk is not a missing identity policy, but production applications that sit outside the enforcement boundary.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:42 pm
Last-mile enforcement is the real IAM boundary: An identity programme is only as complete as the applications it can actually govern. If SSO, MFA, lifecycle automation, and access reviews stop at the exception list, the programme has not failed at design, it has failed at coverage. The practitioner conclusion is simple: measure enforcement reach, not policy intent.
A question worth separating out:
Q: What is the best way to manage applications that fall outside the identity stack?
A: Applications outside the identity stack are managed as governed exceptions, with a named owner, documented access model, and a compensating control where automated provisioning, SSO or SCIM is not available. The exception register should cover authentication method, privileged access, account lifecycle, and periodic review so shadow access does not persist unnoticed.
👉 Read our full editorial: Why identity enforcement fails at the last mile for hard apps