Why it matters
Identity platforms are strong at deciding and routing. They are weaker at finishing the job in apps that do not expose standard connectors. The last mile is that unfinished step: the admin UI click, the thick-client form, the legacy console update that no SCIM call can perform.
If the last mile fails, everything upstream looks fine. The request is approved. The ticket is closed. The dashboard shows green. The application still has the wrong access. That false completion is how privilege drift and orphaned accounts survive inside mature identity programs.
Last-mile work also consumes scarce specialist time. Analysts become human middleware between the IGA and the portfolio it cannot reach.
Example
A joiner request is approved in the IGA for three apps. Two receive SCIM create events within minutes. The third is a claims system with only an admin UI. An analyst logs in later that day, creates the user, assigns a role, and pastes a screenshot into the ticket. That manual step is last-mile provisioning.
How it is typically handled (and where it breaks)
Teams handle the last mile with custom connectors, brittle automation scripts, or people. Connectors cover a fraction of the backlog. Scripts break when screens change. People introduce delay and inconsistent evidence.
The industry often treats last-mile gaps as an implementation phase problem. In practice they become permanent scope exclusions.
How Redblock handles it
Redblock is an agentic last-mile execution layer. It takes approved provisioning and deprovisioning intents from the IGA or IdP and completes them inside applications that lack APIs or SCIM. Agents verify that the change took effect and return step-level audit evidence so governance systems can reconcile real application state.
Redblock is designed to extend platforms such as SailPoint and Saviynt, not replace them. Read more in the SailPoint last-mile identity gap article and on the product page.
Product and security leaders often disagree about the last mile. Product wants faster access for new hires. Security wants verified revocation and least privilege. Both goals fail when execution depends on a person catching up with a ticket queue after the approval already happened.
Last-mile provisioning is also where identity-scoped automation matters. It is not enough to click screens. Execution must respect approvals, produce audit evidence, and reconcile state back to the IGA.
Some teams try to avoid the last mile by narrowing scope: only onboard apps with SCIM, only federate what is easy, only certify what is already connected. That shrinks the program until it no longer matches the real application estate.
Related terms
Frequently Asked Questions
Is last-mile provisioning different from SCIM provisioning?
SCIM provisioning is one way to complete the last mile for apps that support the standard. Last-mile provisioning is the broader need to finish the change in any target app, including those without SCIM.
Why do identity programs stall at the last mile?
Because many apps have no connector path. Each one becomes a services project or a manual runbook, so coverage never reaches the full portfolio.
What evidence should last-mile execution produce?
Verified confirmation that the account or entitlement changed in the application, preferably as structured, step-level records the IGA can store and audit.