BCN-T3-IAM-003Tier 3 · Best PracticesIdentity & Access Management

Fragmented Identity Federation

Applications with local accounts outside the central identity provider.

Remediation SLA: 90 days
Tier: 3 · Best Practices
Domain: Identity
Escalation: Reviewed at quarterly planning; may be formally deferred

What this finding is

Applications maintain their own user directories rather than federating to the central identity provider. Each local directory has its own password policy, its own MFA capability or lack of it, and its own joiner-mover-leaver problem that no central process addresses.

Why it is Tier 3

Every non-federated application is a parallel identity estate that central controls do not reach — MFA policy does not apply, access reviews miss it, and departing employees retain access indefinitely. Consolidating federation is the highest-leverage identity investment available, but it is application-by-application migration work rather than a configuration change, which places it at Tier 3.

Most common misclassification

A non-federated application holding regulated data and lacking MFA is not merely a federation gap — record the MFA deficiency separately at its own tier.

How to detect it

1Inventory applications and record which authenticate through the central identity provider and which do not.
2Cross-reference recent leavers against local application directories to quantify the residual-access problem.
3Identify applications supporting SSO but not configured for it — often the majority of the gap.
4Check for shared local accounts, which defeat attribution entirely.

How to remediate it

Steps are ordered. The first step is the one that reduces exposure fastest, which is not always the one that closes the finding.

1Prioritise by sensitivity and user population; the widely-used sensitive applications deliver most of the benefit.
2Enable SSO on applications that already support it before undertaking any migration project.
3Make SSO support a procurement requirement so the problem stops growing.
4Add federated applications to the access review cycle and the leaver process.
5Eliminate shared local accounts, replacing them with individually-attributable federated identities.

How to verify the fix

The application inventory shows federation for all sensitive applications, a test leaver loses access to federated applications automatically, and no shared local accounts remain on in-scope systems.