Why it matters
Every unonboarded application is a pocket of unmanaged access. Onboarding is how identity teams expand coverage: map accounts and entitlements, wire lifecycle events, enroll the app in certifications, and retire the spreadsheet process.
The bottleneck is famous. Standard SaaS apps onboard quickly. Custom, legacy, and no-API apps wait in a connector backlog measured in quarters. Business owners keep using those apps regardless, so risk accumulates while the queue sits still.
Onboarding speed determines whether an identity program governs the portfolio it claims to protect.
Example
An IGA program lists 40 priority applications for year-one onboarding. Twenty SCIM-friendly SaaS tools go live. The remaining twenty need custom connectors or manual runbooks. Eighteen months later several of those twenty are still "planned," including systems that hold customer records.
How it is typically handled (and where it breaks)
Traditional onboarding means connector configuration, schema mapping, test cycles, and often professional services. For apps without APIs, teams build brittle integrations or accept partial onboarding (SSO only, with manual provisioning forever).
Partial onboarding improves login control but leaves JML and certifications incomplete.
How Redblock handles it
Redblock is built to shrink onboarding time for disconnected applications. Teams can bring apps into aggregation and lifecycle execution without waiting on a classic connector build. Approved changes are executed in the application interface, and account data can flow back into the IGA.
See the 1-day disconnected app onboarding use case and why Redblock.
Onboarding is also a prioritization fight. Security wants the riskiest systems first. Business units want the tools they use daily. IAM teams want apps with clean APIs so the roadmap stays predictable. Disconnected applications lose that fight repeatedly, even when they store sensitive data.
A healthy intake process scores apps on data sensitivity, user population, privilege model, and integration difficulty. Difficulty should not be a silent veto. It should trigger a different onboarding method.
Documentation debt makes onboarding worse. Many internal apps have no current entitlement dictionary. Schema discovery becomes a project of its own. Teams that wait for perfect documentation never clear the backlog. Faster methods that do not depend on a classic connector change the economics of coverage.
Related terms
- Disconnected Applications
- Account Aggregation
- SCIM
- Identity Governance and Administration (IGA)
- Last-Mile Provisioning
Frequently Asked Questions
What is an identity connector backlog?
It is the queue of applications waiting to be integrated with the IGA or IdP. Nonstandard apps often sit there for months because each one needs custom work.
Is SSO onboarding enough?
SSO helps with authentication. Full onboarding also includes provisioning, deprovisioning, account aggregation, and review enrollment.
How does Redblock change onboarding for disconnected apps?
Redblock reduces dependence on custom API connectors by using agents to aggregate access and execute lifecycle changes through the application interface.