Orphaned Account
An active account with no valid owner, typically left behind after someone leaves or changes roles. A common audit finding and a soft target for attackers.
Orphaned accounts are dangerous precisely because they are boring: no owner means no one notices the login, no password change, and no MFA enrollment. They cluster in the systems outside SSO, in local admin accounts on appliances, and in service accounts created for a project that ended. Reconciling every account against an authoritative owner is the only reliable way to find them.
See also: deprovisioning, what is IGA, joiner-mover-leaver, access certification
Related on Start with Identity
- GlossaryProvisioning
Creating user accounts and entitlements in target systems. Modern provisioning is automated via SCIM or vendor APIs, triggered by HR system events. Manual provi
- GlossaryCIEM
Cloud Infrastructure Entitlement Management. Tools that discover and right-size identities and permissions across AWS, Azure, and GCP, reducing excessive and un
- GlossaryEntitlement
A specific permission or right an identity holds over a resource. Governance and CIEM exist to keep entitlements understood, justified, and minimal. Entitlement
- PodcastIdentity at the Center
The longest-running weekly show on identity and access management programs, hosted by two practitioners. The best single feed for keeping up with the field.
- PodcastKuppingerCole Analyst Chat
Weekly conversations between KuppingerCole analysts on identity architecture, governance, AI agents, and the market. Over 300 episodes since 2020.
- BlogMoving into IAM? Start with workforce identity and learn to trace one person's access
Most people who move into identity and access management land in workforce identity first: employees, contractors and the systems they sign in to. The fastest w