Field Notes

Shadow IT takes 2 moves.Every SaaS app at your company is known or unknown, and governed or not. Shadow IT discovery moves an app from unknown to known. Governing it is a second move, and most self-serve plans can't make it.Pranay ·
Every app has its own name for youAccount correlation ties every local account, from GitHub usernames to AWS IAM users, to the person or system that owns it. Offboarding is only as complete as that match, and email matching misses the accounts that matter most.Anchit ·
The ticket testAn app is covered when a new hire gets the access the job needs, down to the repo or channel, without a ticket. SCIM provisioning usually stops at the account, and most apps keep it on higher plans.Pranay ·
Who can get your company's email back?Small companies never decide who owns their domain, their email or their cloud account. Whoever set each one up decided, on whatever email they had that day, and offboarding never looks there.Pranay ·
Your SOC 2 auditor asks about March. Okta remembers today.Identity tools are built to show who has access now. A SOC 2 Type II asks when each leaver's access ended, months ago, and most of the systems involved have already forgotten.Pranay ·
Seasonal workers don't resign, so nobody offboards them.Offboarding is built to react to a resignation. A seasonal contract ends on a date everyone knew in October, and no event fires. The leavers you can predict best end up staying open longest.Anchit ·
Your AI agent doesn't have an identity.6 categories of tooling now claim to secure AI agents. Each fails for a different and nameable reason, and the common thread is that no agent ever authenticates. It inherits.Anchit ·
Moving from AD to Entra relocates your identity problem.An Entra migration moves the apps you already governed onto better infrastructure. The apps you never governed were never in scope, and they're still waiting when the project closes.Anchit ·
Your access review is a rubber stamp. Everyone in the room knows it.Thirty managers get a spreadsheet and five days to confirm what their people can do. The auditor receives a completed review. Nothing about anyone's access changed.Pranay ·
Okta was never supposed to be an IGA tool.Okta does exactly what it was built to do. The teams who feel let down by it were expecting a different category of product, and nobody corrected them.Pranay ·
Manual provisioning isn't a process. It's just delayed chaos.A ticket records that something needs to happen. A process makes it happen the same way every time. Most IT teams have the first one and call it the second.Pranay ·
OAuth grants are the access nobody auditsYour employees hand out access one Connect with Google click at a time. The grants outlive the project, the employee, and sometimes the app that asked for them.Anchit ·

Archive

Your ERP is from 2009. It has no API.Anchit · API keys are not managed identitiesPranay · Your company runs 130 SaaS apps. IT governs about 26.Pranay · Orphaned accounts are not an edge casePranay · Someone quit last month. They probably still have access.Pranay · SailPoint is great for companies that aren't youPranay · Have you heard of the SCIM tax?Anchit · Your new hire has been waiting three days for access.Pranay · Partial governance isn't governance. It's theater.Pranay ·