Use Case: Identity
Orphaned account detection
3 years after an acquisition, 47 accounts from the acquired company still had active access to production systems. Nobody knew whose they were. ManySignal found them in the first cross-directory scan.
The accounts nobody owns
Every organization accumulates orphaned accounts over time. Contractor accounts created outside the standard HR process. Accounts for employees who were terminated quickly and whose SaaS access wasn't fully revoked. Shared team accounts from before SSO was enforced. Vendor accounts from expired relationships. The problem compounds with acquisitions, reorgs, and SaaS proliferation.
From a security perspective, orphaned accounts are a dormant risk with active permissions. An attacker with a compromised credential list from any breach or LinkedIn data can attempt to use these accounts — and since there's no owner getting suspicious login notifications, access can persist indefinitely.
detection: orphaned_account_discovery
type: cross_system_correlation
sources:
- hr_system (workday, bamboohr, adp)
- active_directory
- okta / entra_id
- saas_apps (salesforce, jira, github, snowflake, etc.)
process:
- normalize: email, employee_id, name across all systems
- match: each_system_account TO hr_active_employees
- flag: accounts WHERE no_hr_match OR hr_status == "terminated"
- classify: high_risk (admin access) vs standard
- action: disable (auto) OR review (schedule)
output:
- orphaned_account_report: count by system, risk level
- license_reclaim_estimate: cost savings opportunityMITRE ATT&CK mapping
Orphaned accounts FAQ
What is an orphaned account?
An orphaned account is an identity in any system (AD, SaaS, cloud IAM) whose owner no longer exists in the HR system — because the person left, was terminated, or the account was created for a contractor who never had an HR record. Orphaned accounts retain all their permissions indefinitely because there's no owner to review or revoke them during access certification.
How does ManySignal discover orphaned accounts across SaaS applications?
ManySignal correlates user accounts in each connected SaaS app against the authoritative HR directory. Accounts in Salesforce, Jira, GitHub, or Snowflake that have no matching active employee in the HR system are flagged as orphaned. The matching uses email address, name normalization, and employee ID when available.
Can ManySignal automatically disable orphaned accounts?
Yes, with configurable automation. The typical policy disables orphaned accounts immediately for high-risk systems (admin access, financial systems) and after a 30-day grace period for lower-risk systems. Disablement is executed via the application's API — ManySignal doesn't require manual intervention for each application.
How does this relate to SaaS license compliance?
Orphaned accounts represent wasted SaaS licenses — paying for seats used by people who have left. ManySignal's orphaned account discovery doubles as license optimization: the number of licenses that can be reclaimed is calculated automatically and included in the posture report.
Find every account with no active owner
Cross-directory orphan discovery across all connected SaaS, cloud, and on-premises systems.