Topic starter
24/06/2026 11:04 pm
TL;DR: Disconnected apps without SCIM or APIs leave onboarding, offboarding, and access review processes manual, fragmented, and error-prone, according to Cerby’s analysis of identity automation gaps. The real issue is not SCIM itself but the governance gap it exposes when identity policy cannot reach every application.
Editorial analysis by NHI Mgmt Group, based on content published by Cerby: “SCIM for identity management: Why it’s critical but still not enough for automation”.
By the numbers:
- 58% of organisations say former employees have retained access to systems after departure, largely due to apps without SCIM or API-based automation.
Key questions
Q: What breaks when an application has no SCIM or federation support?
A: Lifecycle automation breaks at the point where identity systems can no longer push authoritative changes into the app.
Q: Why do disconnected apps create so much access risk?
A: Disconnected apps create risk because they sit outside the enterprise identity fabric, so access is granted and removed locally instead of through central controls.
Q: How do you know if disconnected app governance is actually working?
A: Look for complete application inventory, documented ownership, timely revocation after departure, and audit-ready evidence for each critical account.
Practitioner guidance
- Map disconnected-app exceptions Build a register of applications that do not support SCIM or user management APIs, and tag them by business criticality, privilege level, and offboarding risk.
- Prioritise offboarding paths first Start with the applications where former users retain access for the longest periods, especially tools with direct login credentials, shared admin paths, or no central revocation trigger.
- Separate audit evidence from app exports Require a controlled evidence process for disconnected systems that records who reviewed access, when revocation happened, and which account states were confirmed.
Bottom line: Disconnected applications create a governance gap because identity changes cannot be pushed consistently into every system.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 7:51 am
Disconnected applications create a lifecycle governance blind spot. SCIM is not the point in itself. The real issue is that identity policy stops at the edge of connected applications, while the business keeps using tools that never join the automation plane. That means joiner, mover, and leaver controls become partial by design, and partial governance is not governance. Practitioners should treat disconnected apps as a permanent control boundary, not a temporary inconvenience.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should IAM teams do when SCIM does not cover the full SaaS stack?
A: They should assume SCIM is only one layer of deprovisioning and design a fallback process for apps that keep their own sessions or tokens alive. If the application cannot respond to lifecycle events directly, the offboarding control must still terminate access in that app before the user is considered fully removed.
👉 Read our full editorial: SCIM gaps are leaving disconnected apps outside identity control