The application coverage gap: why IAM tools miss some apps and accounts

Why does the gap exist?

Integration catalogs are large: Okta lists 8,000+ integrations, Veza 325+ and Lumos 300+. They cover popular SaaS well. They do not cover the in-house billing system, the supplier portal with its own user table, or the legacy application that predates single sign-on. Costco's Jon Raper, quoted by Orchid, says onboarding an application "can take days, weeks, and even months".

What lives in the gap?

• Local accounts that never pass through the identity provider, so disabling a leaver in the directory leaves them active.
• Hardcoded credentials in code and configuration.
• Alternate sign-in paths that bypass the identity provider.
• Privilege drift: access that grows inside the application with no record outside it.

Orchid lists all four on its home page as problems it detects.

How do vendors approach it?

Inside a governance platform: Saviynt describes onboarding connected, disconnected and custom-built applications into its IGA "in hours, not weeks", which is Saviynt's claim. SailPoint's Application Management add-on gives application owners a self-registration portal and integration templates.

Beside the stack: Orchid describes discovering SaaS, cloud, on-premises, legacy and custom-built applications, mapping identity inside them, and feeding that to IAM, IGA, PAM and ITSM tools.

From identity data outward: Veza reveals accounts that exist outside identity platforms and connects custom systems through its Open Authorization API; C1 detects shadow app signups and logins; Lumos surfaces shadow IT; Microsoft documents account discovery for app users who match no Entra ID user, and a manual CSV path for applications without provisioning.

How do you size your own gap?

1. List every application in audit scope.
2. Mark which are connected to single sign-on, which to SCIM provisioning and which to your governance tool.
3. For the rest, note how leavers are removed today and who checks.
4. Count the local admin accounts in those applications.

If step 3 says "ticket" or "nobody" for many in-scope applications, this job belongs on the Core list in the stack builder.

Who else does this job?

Saviynt is also documented for this job, and where the gap is small the partial approaches above may be enough. The application coverage job page lists every vendor with its status.