ZONE A
Apps nobody connected
SSO and SCIM need someone to configure them, app by app. Applications bought by a team, built in-house or inherited in an acquisition often never get that configuration, so they never appear in the IdP's app list.
EDITION 2026.10 · VENDOR FACTS READ SEPTEMBER 2026 · UPDATED 2026-10-13
IAM compared: which identity tools reach the apps your IdP and IGA cannot see
The short answer
Single sign-on and IGA connectors cover the applications someone wired into them. The rest of the estate (shadow SaaS, legacy and on-prem apps, custom-built tools, the local and service accounts inside them) is where audit findings and leftover access collect. On our eight weighted criteria Orchid Security leads at 8.24 out of 10, followed by Veza at 6.37. The tools that execute provisioning themselves score higher on that criterion, and Microsoft is the only one with a per-user price on its own site; Apono and Orchid list prices on AWS Marketplace.
By The Credential Desk · Editorial assessment · Published 2026-10-08
Leader on default weights: Orchid Security
- DISC
- Unmanaged app discovery
- 9.5
- INAPP
- Accounts inside the app
- 9.0
- NOAPI
- Reach into apps without APIs or SCIM
- 9.0
- ORCH
- Orchestrates through the existing stack
- 9.5
- EXEC
- Executes changes itself
- 4.5
- NHI
- Machine, service and agent accounts
- 7.5
- EVID
- Audit evidence
- 8.5
- PRICE
- Pricing transparency
- 6.0
Each sector is one criterion. The longer the engraved sector, the higher the editorial score. Sectors are equal width, so the picture shows the shape of a tool's reach, not its weighted total.
What does an identity provider leave out?
ZONE B
Accounts the app created itself
Many applications keep their own user store: local admins, break-glass logins, vendor support users, service accounts with passwords written into a script. Disabling a person in the IdP does not touch any of them.
ZONE C
Evidence that has to be rebuilt
Auditors ask who can reach in-scope systems and whether leavers lost access on time. For apps outside central control the answer is often assembled by hand for every audit cycle.
How do the eight tools rank on reach?
| Rank | Tool | Rosette | Layer | Reach score | Designation |
|---|---|---|---|---|---|
1 | Orchid Security | Discovery and orchestration layer | Discovery and in-app identity mapping for the unmanaged estate | ||
2 | Veza | Access graph and governance | Entitlement-level view across 325+ integrations | ||
3 | C1 (formerly ConductorOne) | Identity governance (IGA) platform | Shadow app detection and open-source connectors | ||
4 | SailPoint Identity Security Cloud | Identity governance (IGA) platform | Deepest lifecycle execution, with agent and machine identity coverage | ||
5 (tied) | Microsoft Entra ID Governance | Governance add-on to an identity provider | Published per-user price and documented on-prem connectors | ||
5 (tied) | Saviynt | Identity governance (IGA) platform | One IGA platform that onboards disconnected apps | ||
7 | Lumos | Identity governance (IGA) platform | Shadow IT analytics and HRIS-driven offboarding | ||
8 | Apono | Just-in-time privileged access | Just-in-time privileged access for people, machines and AI agents |
How far a tool, as described in its own public material, reaches into the applications and accounts that an identity provider and an IGA platform do not cover, and what it does with what it finds. It is not a measure of overall product quality.
Full rankings, criteria and the registerWhich parts of the estate does each tool document?
| Tool | Unsanctioned SaaS | On-prem and legacy apps | Custom-built apps | Local accounts in apps | Service accounts and hardcoded credentials | AI agents |
|---|---|---|---|---|---|---|
| Orchid Security | Documented: Discovers SaaS and cloud applications, including unmanaged ones | Documented: Discovers on-prem and legacy applications | Documented: Discovers custom-built applications | Documented: Local user activity and orphaned accounts inside apps; publishes an Orphan and Local Accounts report | Documented: Hardcoded accounts and credentials detected | Partial: Guardrails for autonomous identity listed as a use case; detail not reviewed |
| Veza | Not documented: Discovery of unconnected SaaS not described | Documented: The Open Authorization API imports authorization metadata from custom or on-premise apps | Documented: Custom systems connect through OAA | Documented: Reveals local accounts outside identity platforms | Partial: Reveals machine and service accounts; hardcoded credentials not described | Partial: Acquisition post frames the combined offer as an agent identity control plane |
| C1 (formerly ConductorOne) | Partial: Shadow app sign-up and login monitoring | Documented: C1 Bridge for on-prem systems | Partial: Open-source Baton connectors you can extend | Partial: Find what offboarding missed | Not documented: Not described on the pages reviewed | Partial: Shadow AI Discovery listed |
| SailPoint Identity Security Cloud | Not documented: Automatic discovery of unconnected apps not described | Partial: Integration templates and owner self-registration | Partial: Integration templates | Not documented: Orphan and local account discovery inside apps not described | Partial: Entro Security acquisition: non-human identities, secrets and tokens | Documented: Agentic Fabric generally available for AI and machine identities |
| Microsoft Entra ID Governance | Not documented: Discovery of apps outside Entra not described in the governance docs reviewed | Documented: ECMA connector host, LDAP and SQL for on-prem apps | Partial: REST, SOAP and PowerShell connectors; CSV path otherwise | Partial: Account discovery shows app users not matched to Entra users | Partial: Workload identities priced and governed in Entra; hardcoded credentials in apps not described | Documented: Entra Agent ID generally available |
| Saviynt | Partial: A 2022 release note mentions enhanced application discovery; scope not detailed | Partial: Disconnected-app onboarding; on-prem apps not named as such | Documented: Custom-built application onboarding | Partial: Usage modeling of accounts and entitlements | Partial: CPAM auto-discovers Windows service accounts and Azure privileged accounts (2022 release note) | Partial: Zuma AI identity security platform launched July 2026; agent detail not reviewed |
| Lumos | Partial: Shadow IT surfaced in Identity Analytics | Partial: Revocation across on-prem systems | Partial: Revocation across custom apps | Partial: Revocation across local accounts; dormant accounts surfaced | Not documented: Not described on the pages reviewed | Partial: MCP Governance for agent tool calls |
| Apono | Not documented: Discovery of unconnected SaaS not described | Not documented: On-prem and legacy apps not described | Not documented: Custom-built apps not described | Not documented: Local accounts inside apps not described | Partial: Just-in-time access for machines; hardcoded credentials not described | Documented: Just-in-time access for AI agents and Agent Privilege Guard |
Where does Orchid Security lead, and where does it trail?
Orchid Security ranks 1 of 8 on default weights. It scores highest in set on Unmanaged app discovery, Accounts inside the app, Reach into apps without APIs or SCIM, Orchestrates through the existing stack and Audit evidence, and trails the leader on Executes changes itself (4.5 against SailPoint Identity Security Cloud at 9.0), Machine, service and agent accounts (7.5 against SailPoint Identity Security Cloud, Microsoft Entra ID Governance and Apono at 8.0) and Pricing transparency (6.0 against Microsoft Entra ID Governance at 9.5).
Orchid does not provision or revoke access itself, and its only listed price is a single AWS Marketplace package. It is built to feed what it finds into the IdP, IGA and ticketing tools you already run, which is why it pairs with a governance platform rather than replacing one.
Which tool fits which starting point?
| Situation | Tool | Why |
|---|---|---|
| You run an IdP and an IGA and need to find what they miss | Orchid Security | Documents discovery of unmanaged SaaS, on-prem, legacy and custom apps and the accounts inside them, and feeds the tools you have. |
| You want effective permissions and dormant accounts across many connected systems | Veza | Access Graph across 325+ integrations, including local, machine and service accounts. |
| You are choosing one IGA that must also onboard disconnected apps | Saviynt | States onboarding of connected, disconnected and custom-built applications. |
| Lifecycle execution and agent identities are the priority | SailPoint Identity Security Cloud | Joiner, mover and leaver automation plus Agentic Fabric for AI and machine identities. |
| Entra is your IdP and you need a price before the first call | Microsoft Entra ID Governance | $7.00 per user per month published, with ECMA connectors for on-prem apps. |
| Shadow app sign-ups are the first problem | C1 | Monitors shadow app sign-ups and logins and offers open-source connectors. |
| SaaS-heavy, with offboarding and license reclamation to fix | Lumos | Shadow IT analytics and HRIS-triggered offboarding. |
| You want to remove standing admin access in cloud resources, including for AI agents | Apono | Just-in-time access with automatic revocation for people, machines and AI agents; does not describe discovering unmanaged apps. |
What does this site measure, and what not?
We score how far each tool, as its own public pages describe it, reaches into the applications and accounts an identity provider and an IGA platform do not cover, and what it does with what it finds. Vendor facts were read in September 2026, updated 2026-10-13. We did not test the products. On our published weights Orchid Security ranks 1 of 8, and it trails on 3 of 8 criteria.
Read the assessment methodWhere to go next
- Coverage gap calculator
Count the apps outside your IdP and re-weight the ranking
- Set side by side
Put two to five tools side by side
- Identity classroom
Ten lessons on the unmanaged estate
- The Dossier
Analysis from The Credential Desk
Latest from The Dossier
FILE 01 · 2026-09-24 · 3 min read
Orchid Security and SailPoint: Discovery Meets Governance- Vendors
- Market
One finds the applications, the other governs them. What buyers should check.
FILE 02 · 2026-09-26 · 3 min read
Identity Consolidation in 2026: Who Bought Whom- Market
Six ownership and name changes in identity security this year, and the questions they raise.
FILE 03 · 2026-09-28 · 3 min read
Microsoft Entra's Path for Apps Without Provisioning, Step by Step- Vendors
- Practice
The CSV route Microsoft documents, and what it asks of your team.
Frequently asked questions
What is the unmanaged application estate?
It is every application and account that your identity provider and IGA platform do not control: apps nobody configured for SSO or provisioning, custom and legacy systems, and the local, service and break-glass accounts that applications create for themselves. Offboarding in the IdP does not reach them.
Which identity tool covers applications outside the IdP best?
On our weights Orchid Security leads, because it documents discovery of unmanaged SaaS, on-prem, legacy and custom apps and the accounts inside them. Veza follows, then C1. Tools that execute provisioning themselves, led by SailPoint, score higher on that criterion.
Does a discovery tool replace an IGA platform?
Not in the products scored here. Orchid Security describes feeding identity context into IAM, IGA, PAM and ITSM tools, and it joined SailPoint's Technology Alliance Partner program in August 2026. Provisioning, reviews and revocation stay in the governance platform.
Are these scores based on testing?
No. They are an editorial assessment of public vendor pages and documentation, vendor facts read in September 2026, updated 2026-10-13. The assessment method page lists the limits.