Why it matters
Governance without aggregation is guesswork. You cannot certify what you cannot see. You cannot find orphans if the IGA never received the user list. You cannot measure privilege drift if entitlements stay trapped in application silos.
Connected apps aggregate through connectors or SCIM. Disconnected apps often contribute nothing, or they contribute a quarterly CSV that is wrong the day after export. That blind spot is where rogue admins, stale contractor accounts, and toxic entitlement combinations hide.
Fresh aggregation is also what makes mover and leaver decisions accurate. If the IGA's view of an app is stale, automation acts on fiction.
Example
Before a healthcare access review, an analyst downloads user exports from five clinical systems that have no IGA connector, cleans the files, and uploads them. Two systems were exported the week prior. One export missed a local admin group. Reviewers certify incomplete data. That is broken account aggregation.
How it is typically handled (and where it breaks)
IGA platforms aggregate well where connectors exist. Elsewhere, teams schedule manual extracts, build one-off scripts, or skip the app. Scripts need maintenance. Manual extracts do not keep up with joiners and leavers. Skipped apps remain permanently dark.
Some programs accept "authoritative source only" views and ignore local accounts outside SSO. Attackers and auditors do not ignore them.
How Redblock handles it
Redblock retrieves accounts, roles, entitlements, and status from disconnected applications and feeds that data into the IGA so identity records stay current without CSV fire drills. The same channel supports enforcement: once visibility exists, approved changes and certification revokes can be executed and verified in the app.
This is central to bringing every application under control. Start with the product overview and the orphan-account cleanup use case.
Aggregation quality shows up everywhere downstream. Joiner fulfillment needs to know whether an account already exists. Mover logic needs current roles. Certification needs a trustworthy inventory. Orphan detection is a comparison between aggregated accounts and authoritative identity records.
If aggregation is wrong, automation amplifies the error. That is why many teams are cautious about fully automating disconnected apps. The answer is better aggregation and verified execution, not permanent manual exceptions.
Event-driven aggregation beats quarterly dumps. Whenever possible, identity platforms should refresh application state continuously or on a short schedule. For apps with no API, that historically meant someone logged in and exported a file. That pattern does not survive enterprise scale.
Related terms
- Orphaned Accounts
- Access Certification
- Disconnected Applications
- Identity Governance and Administration (IGA)
- Application Onboarding
Frequently Asked Questions
How is account aggregation different from provisioning?
Aggregation reads who has access today. Provisioning writes changes to create, update, or remove access. Strong IGA programs need both.
Why do disconnected apps break aggregation?
Without connectors or APIs, the IGA cannot pull account inventories automatically, so teams rely on infrequent manual exports.
What does Redblock return from aggregation?
Account and entitlement data from applications your stack cannot reach, so governance systems can review and act on real access.