Topic starter
06/11/2026 6:35 pm
TL;DR: MFA policies only cover the applications an identity provider can actually front, leaving legacy, homegrown and premium-gated apps outside conditional access and phishing-resistant controls, according to Way Security. The enforcement problem is scope, not policy design: if the IdP cannot see the app, the control never exists there.
Editorial analysis by NHI Mgmt Group, based on content published by Way Security: “The Asterisk on "MFA Everywhere": Your IdP Enforcement Gap”.
Key questions
Q: How should teams close identity provider enforcement gaps across applications?
A: Close the gaps by moving authentication and policy enforcement into a central identity plane, then retiring app-local credentials where possible.
Q: Why do some applications stay outside MFA and conditional access policies?
A: Some applications stay outside MFA and conditional access because they do not route sign-in through the identity provider, or they use local accounts, legacy protocols, or embedded authentication that bypasses the policy engine.
Q: What should IAM teams do with local application logins?
A: IAM teams should replace local application logins with federated authentication wherever possible, then map users to centrally governed roles and groups.
Practitioner guidance
- Audit federated versus unfederated apps Build a current inventory of every application that sits outside IdP enforcement, including legacy, homegrown and vendor-restricted systems.
- Classify every local login as an exception Treat any app that still authenticates users outside the central identity plane as a standing exception until it is federated, wrapped or retired.
- Prioritise federation for high-value apps Focus first on the applications that handle production data or privileged workflows and that still bypass conditional access, MFA or session controls.
Bottom line: An identity programme is only as complete as the applications the IdP can actually govern, and unfederated systems remain outside central enforcement.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:42 pm
Coverage, not policy intent, is the real identity control metric. A board slide that says MFA is enforced across the enterprise can be technically true and operationally misleading at the same time. If the policy only applies where the IdP has reach, the organisation has partial enforcement, not universal enforcement. Practitioners should measure control scope by application coverage, not by the existence of a policy statement.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: What should IAM teams do with local application logins?
A: IAM teams should replace local application logins with federated authentication wherever possible, then map users to centrally governed roles and groups. When local accounts must remain, they should be inventoried, owned, and reviewed, with strong password controls, MFA where supported, and deprovisioning tied to the joiner-mover-leaver process. The parallel trust model exists because the application trusts its own credentials separately from the enterprise identity provider.
👉 Read our full editorial: IdP enforcement gaps leave MFA everywhere only partly true