How should security teams govern access when only part of the application estate is connected to SSO and SCIM?

Why This Matters for Security Teams

When only part of the application estate is connected to SSO and SCIM, identity governance becomes a visibility problem before it becomes an access problem. Connected apps may look compliant while disconnected apps still contain stale accounts, shared secrets, and permissions no one reviews. That split estate is especially risky for NHIs because service accounts, API keys, and automation often live outside human-centric workflows and are missed by periodic access reviews. The Ultimate Guide to NHIs notes that only 5.7% of organisations have full visibility into their service accounts, which is why partial federation can create a false sense of control. Current guidance from the NIST Cybersecurity Framework 2.0 still points teams toward asset visibility, identity governance, and ongoing monitoring rather than assuming one control plane is enough.

Security teams often get caught by the gap between “managed” identities and the rest of the estate, especially where legacy apps, contractor tools, and machine accounts were never designed for SCIM. In practice, many security teams encounter orphaned access only after an incident forces a full inventory, rather than through intentional governance.

How It Works in Practice

The practical answer is to govern to the whole estate, not just the connected slice. Start with discovery across SaaS, internal apps, APIs, CI/CD, and infrastructure so that every user, service account, and token has an owner and an application context. Then segment the estate into what is federated, what is provisioned by SCIM, and what must be managed by local controls. That distinction matters because SSO proves authentication for a session, not entitlement hygiene across the lifecycle.

For connected applications, enforce SCIM as the source for joiner, mover, and leaver events, and reconcile the resulting entitlements against actual use. For disconnected applications, use compensating controls: vaulted credentials, manual attestation, privileged access management, and tighter logging. The OWASP Non-Human Identity Top 10 is useful here because it frames the risks introduced by static secrets, excessive privilege, and weak lifecycle discipline, all of which become more common when SCIM does not reach an app.

• Build a canonical inventory that includes owned and shadow applications.
• Map each app to its identity control state: SSO, SCIM, local auth, or service-only.
• Review entitlements, not just login status, for both humans and NHIs.
• Apply JIT or short-lived credentials where local integration is unavoidable.
• Reconcile accounts after moves, vendor changes, and app retirements.

For NHIs, pair this with lifecycle controls from the Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs, because provisioning and deprovisioning discipline is what keeps partial federation from becoming permanent exposure. These controls tend to break down when legacy applications cannot support directory sync and business teams preserve local admin accounts as “temporary” workarounds for months.

Common Variations and Edge Cases

Tighter governance often increases operational overhead, requiring organisations to balance faster onboarding against stronger entitlement control. That tradeoff is real in mixed estates, especially where acquired companies, regulated workloads, or third-party integrations cannot be moved onto SSO quickly. Current guidance suggests prioritising risk-based coverage first: the applications with sensitive data, privileged functions, or machine-to-machine access should be addressed before low-risk collaboration tools.

One common edge case is an app that supports SSO for users but not SCIM for deprovisioning. In that model, the security team should not assume identity lifecycle is solved; stale accounts can remain active indefinitely if local admins can recreate them or if service credentials are never rotated. Another is SaaS used by vendors or contractors, where access may be intentionally local rather than federated. In those cases, governance depends on contract-backed ownership, periodic review, and clear offboarding triggers, not just directory status. The Top 10 NHI Issues reinforces that over-privilege and poor rotation are recurring failure modes, while NIST SP 800-53 Rev 5 Security and Privacy Controls remains the right reference for compensating monitoring, access review, and revocation controls.

Partial SSO coverage also breaks down when teams treat authentication as equivalent to authorization, because disconnected apps still need explicit entitlement governance and audit evidence.

Related resources from NHI Mgmt Group

• How should security teams govern non-human identities that have persistent access?
• How should security teams govern API keys used for generative AI access?
• How should security teams govern non-human identities at scale?
• How should security teams govern non-human identities for compliance?