These accounts exist in every enterprise environment. They accumulate faster than identity governance programs discover and remove them. They represent access that has no current legitimate purpose but retains the permissions of the purpose that created it. And they are, for an attacker who finds one, a gift: access that is not being monitored because no one is using it, with permissions that were assigned based on a role that may have been significantly more privileged than the account's quiet persistence suggests.
How They Accumulate
Orphaned accounts are created at the boundary of identity lifecycle processes. The joiner process creates accounts when employees join. The mover process is supposed to modify accounts when employees change roles. The leaver process is supposed to deactivate accounts when employees leave. The process fails at every boundary: the new employee whose accounts were not fully provisioned through the formal process and whose prior test accounts were never cleaned up. The contractor whose engagement ended without triggering a formal offboarding that would have deactivated their accounts. The service account created for a project that was cancelled, whose decommissioning was not tracked.
The velocity of account creation in modern enterprises outpaces the velocity of account lifecycle management. Cloud identities are provisioned continuously. SaaS application accounts are created by users without going through the formal provisioning workflow. API credentials are issued by development teams outside the IAM program's visibility. Service accounts accumulate across systems as integrations are built. Each of these creates an account that requires lifecycle management. The proportion that receives adequate lifecycle management decreases as the population grows.
Orphaned accounts accumulate at the rate of organizational change. Organizations that are changing fast — through growth, acquisition, technology adoption, and restructuring — accumulate orphaned accounts faster than any periodic discovery and remediation process can address.
Why Discovery Alone Does Not Solve It
Access review programs that include orphaned account discovery identify accounts without active owners and remove them. The next quarter's discovery produces a similar number of newly orphaned accounts. Discovery-and-remediate is a treatment for the symptom rather than for the cause. The cause is the identity lifecycle process that fails to deactivate accounts when the condition that created them ends.
The structural gap in most joiner-mover-leaver processes is coverage: the process covers accounts in the systems that are in scope for the formal IAM program. It does not cover the SaaS application accounts that were created outside the formal provisioning workflow, the cloud identities that were provisioned by engineering teams, or the API credentials that were issued by application teams. The accounts outside the formal process are outside the formal lifecycle management. They orphan silently.
What Reduces the Population Without Fully Solving It
No identity governance program fully solves the orphaned account problem in a dynamic enterprise environment. The goal is to minimize the population and minimize the risk it represents through a combination of prevention and detection.
The orphaned account problem is not solved. It is managed. Manage it well.
Automate the lifecycle processes. Expand the coverage. Prioritize by risk. Monitor for activation. That is the operational discipline that keeps the population manageable.
Enterprise practitioner perspective. Not legal advice. Part of the Deep Trust Governance Series by Verisq. Get the free weekly Breach Digest.