IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Reconciliation & joiner-mover-leaver drift
Priya left the company 3 months ago. Yet last week someone signed in to a forgotten expenses app as Priya, and it worked. Your goal: explain how accounts drift out of sync and how reconciliation fixes it.
- Drift means an app no longer matches the directory.
- Reconciliation compares the two and names each difference.
- Orphans are dangerous: no owner, no reviews, weak protection.
- Fix every finding automatically, or with a ticket that must be closed.
How Priya's ghost survived
Your source of truth is the HR directory that feeds your IdP. It knows Priya is gone. Most apps know too, because an offboarding message reached them. But over time, an app and the source of truth can stop agreeing. This is identity drift. The reasons are ordinary. An event was missed. Someone set up an app by hand, so it never gets leaver events. Or a SCIM push failed with a server error, the retries gave up and nobody was watching. Across hundreds of apps, some accounts always slip through. You fight drift forever. It is the messy end of the Joiner–Mover–Leaver lifecycle.
Compare the directory with reality
Reconciliation is the cure. On a schedule, compare the official directory with each app's real list of accounts. Then fix every difference. It is a diff between "who should have access" and "who really does". Each difference has a name and a fix.
A teacher's roll call. The teacher compares the attendance register with the children who are really in the room. Someone sitting in class who is not on the register is a problem. That is Priya's ghost.
| Finding | What it is | Fix |
|---|---|---|
| Orphaned account | Its owner is gone from the directory, like Priya's login | Disable it |
| Duplicate | Two accounts for one person, so two doors | Merge into one |
| Unowned account | No accountable owner, often a machine account | Assign an owner |
| Entitlement drift | An old permission kept after a role change | Cut it to what the job needs |
Why an orphan is dangerous
An orphaned account is an easy target. Nobody owns it, so a strange login raises no alarm. It missed the last MFA re-enrollment and password rotation, because those chase current employees. It is also invisible to access reviews. Reviews ask managers about the people they manage, and Priya has no manager now. Non-human orphans are worse. When the app that owned svc-bot was shut down, the service account lived on. So every non-human identity needs a named human owner.
A closed loop, not a one-off
A weekend clean-up drifts back within a quarter. Good reconciliation runs all the time, nightly or weekly. It alerts as soon as the counts differ. Every finding gets closed-loop remediation. The fix flows back as an automatic disable, or as a ticket that must be closed. A report that is filed and forgotten is not a fix. "Noticed but not fixed" is how Priya's ghost lasted 3 months.
Auditors ask: prove that every account in this app maps to a current, authorized person. Reconciliation logs are that proof. See the rules of the game.
🧪 Interactive lab — enable JavaScript to play with this one.
Setting up automated reconciliation for a real directory and its apps? Talk to our team about drift detection, account ownership and closed-loop deprovisioning.