Another year, another CRM. Or, in this case, another identity provider. The migration from our old on-premises behemoth to PingOne is mostly complete, and the usual post-deployment dust has settled. And what do you find in the corners once the dust settles? Orphans. Digital ghosts. Accounts that shouldn't exist, clinging to life in your shiny new cloud directory because some process hiccuped, a script failed, or someone just didn't follow the playbook.
I promised myself this time I wouldn't just rely on the vendor's dashboard health metrics. They're great for telling you everything is fine right up until the compliance audit hits. So I spent the last week building an automated report that actually digs into the graveyard. The goal: find every PingOne identity that isn't properly tied to an active, authoritative source in our HR system. The usual suspects:
* Departed employees whose deprovisioning workflow timed out.
* External "partner" accounts created for a project three years ago that never got a sunset date.
* Test accounts from the migration phase that everyone swore they deleted.
* The mysterious service accounts that no one wants to claim ownership of, but which have alarming permission sets.
The process isn't terribly complex, but it requires stitching together systems with the kind of brittle optimism that defines modern IT. You pull a canonical list from Workday, compare it against the PingOne directory via their API, and then cross-reference that with last login timestamps, group membership, and application assignments. The delta is your problem set. The real trick is weighting the findings—a test account with no logins and no app access is a low-priority cleanup. An "orphaned" identity with active MFA registration and access to the financial system is a five-alarm fire.
Initial results were, predictably, sobering. Out of a few thousand identities, we found just over a hundred orphans. About 60% were low-risk cruft. The remaining 40%, however, fell into categories that should keep any security or RevOps person awake at night:
* Seventeen identities with active administrative roles in secondary applications, but no corresponding HR record.
* Eight "contractor" accounts from a firm we haven't engaged with since 2024, still enabled.
* Five accounts that appear to have been created via a misconfigured SCIM sync, duplicating active users but with slightly different usernames.
The report now runs weekly, dumping a CSV into a secured channel for the IAM team. It’s already flagged two attempts at privilege persistence by departing staff (the classic "forgot to offboard my alternate account" maneuver). I'm left wondering, not for the first time, why this isn't a core, out-of-the-box report from Ping. You sell yourself on governance and lifecycle, but then leave the critical forensic work to the customer's own scripting skills. It feels like buying a high-end security system that can detect a window break but can't tell you if the back door has been left unlocked for a year.
Has anyone else built similar tooling around PingOne or another IdP? I'm particularly curious about how you're handling the correlation of identity data with SaaS application usage logs (like from Okta Access Insights or similar) to add a layer of behavioral context beyond simple "last login." I have a nagging suspicion my current method is still too reliant on the HR system of record being, well, perfect.