JOB J3 · APP COVERAGE
Application coverage tools: finding the apps and accounts your IAM stack misses
Short answer
Two vendors document this job directly: Orchid Security and Saviynt. Six more cover part of it. This job decides whether the other four reach every application or only the ones already connected to your identity provider and governance tool.
What does this job include?
- Discovering applications that are not connected to SSO or SCIM, including on-premises, legacy and custom-built ones.
- Finding local accounts, hardcoded credentials and sign-in paths that bypass the identity provider.
- Bringing those applications under governance, privileged access and audit.
- Producing access evidence for applications reviewed today with spreadsheets or screenshots.
Read the stack as a list
- J5 Identity threat detection and response: 5 documented, 1 partial
- J4 Privileged access: 2 documented, 7 partial
- J3 Application coverage and identity orchestration: 2 documented, 6 partial
- J2 Lifecycle and governance: 7 documented, 4 partial
- J1 Directory and single sign-on: 5 documented, 1 partial
Who documents this job?
Discovers SaaS, cloud, on-premises, legacy and custom-built applications, maps local accounts, hardcoded credentials, shadow authentication paths and privilege drift inside them, and brings them under IAM, IGA, PAM and audit control.
Source: Orchid Security homepage · Read 27 Sep 2026 · Source: Orchid Security platform · Read 27 Sep 2026
No price on its own site (its /pricing page returns 404). AWS Marketplace lists "Orchid Fundamental" (Continuous IAM Assurance, Discovery and Readiness, 30 applications) at $250,000.00 per 12 months on a 12-month contract, with 24- and 36-month options, and custom pricing by private offer.
Application Onboarding for connected, disconnected and custom-built applications; its 2022 release notes mention enhanced application discovery without detail.
Source: Saviynt Identity Governance and Administration · Read 27 Sep 2026 · Source: Saviynt blog: 2022 release wrap-up · Read 11 Oct 2026
Not published.
Who covers part of it?
Monitors shadow app signups and logins to decide whether to bring an app under governance; Baton open-source connectors and C1 Bridge reach on-premises systems. Apps with no connector are not described in detail.
Source: C1: shadow IT · Read 27 Sep 2026 · Source: C1 homepage · Read 27 Sep 2026
Structure published (Platform or Flex; Pro or Advanced; 100 to 20,000 managed identities). No prices.
Identity Analytics surfaces shadow IT and dormant accounts; handling of apps with no API is not detailed.
Source: Lumos Identity Analytics · Read 27 Sep 2026
Not published.
Account discovery shows app users who do not match an Entra ID user. For apps without provisioning, the documented path is a CSV export, matching, an access review and an optional ServiceNow ticket.
Source: Microsoft Learn: governing existing users in an application · Read 27 Sep 2026 · Source: Microsoft Learn: applications that do not support provisioning · Read 27 Sep 2026
Per user per month, paid yearly: Entra ID Free; P1 $7.00; P2 $10.00; ID Governance $7.00 (requires P1 or P2); Entra Suite $12.00 (requires P1); Workload ID $3.00 per workload identity. P1 is included in Microsoft 365 E3 and Business Premium, P2 in Microsoft 365 E5. Defender for Identity needs EMS E5 or A5, Microsoft 365 E5 (E5, A5, G5), Microsoft 365 E5, A5, G5 or F5 Security, Microsoft 365 F5 Security and Compliance, or a standalone Defender for Identity licence; the standalone price is not stated.
Finds shadow SaaS and AI apps and hidden login paths that bypass SSO from the browser; it does not describe bringing those apps under governance.
Source: Push Security homepage · Read 29 Sep 2026
Standard (up to 500 employees): $5 per user per month on an annual contract, or $6 per employee per month billed monthly, both billed in advance. Enterprise (500+ employees): volume pricing on request. Every licence includes the full platform; a trial is available.
The Application Management add-on gives app owners a self-registration portal and integration templates, and the SailPoint Discovery Tool uncovers unmanaged applications, identifies ownership and exposes shadow AI activity. Discovery of accounts inside those apps is not detailed.
Source: SailPoint blog: Application Management · Read 27 Sep 2026 · Source: SailPoint Discovery Tool · Read 27 Sep 2026
Suites listed (Standard, Agentic Business, Agentic Business Plus) without prices.
Reveals accounts even if they exist outside your identity platforms; the Open Authorization API imports authorization data from any system, including custom and on-premises applications.
Source: Veza Access Reviews · Read 27 Sep 2026 · Source: Veza Lifecycle Management · Read 27 Sep 2026 · Source: Veza Open Authorization API · Read 11 Oct 2026
Not published.
How do all 16 vendors read for this job?
| Vendor | J3App coverage |
|---|---|
| Apono | Not in our sources |
| C1 (formerly ConductorOne) | Partial |
| CyberArk (Idira, Palo Alto Networks) | Not in our sources |
| Google Cloud Identity | Not in our sources |
| JumpCloud | Not in our sources |
| Lumos | Partial |
| Microsoft Entra | Partial |
| Okta | Not in our sources |
| Orchid Security | Documented |
| Ping Identity | Not in our sources |
| Push Security | Partial |
| SailPoint | Partial |
| Saviynt | Documented |
| Semperis | Not in our sources |
| Silverfort | Not in our sources |
| Veza | Partial |
What are the two ways to cover more applications?
Inside one governance platform: Saviynt describes onboarding connected, disconnected and custom-built applications into its own IGA. Beside the tools you already run: Orchid Security describes discovering applications, mapping how identity works inside them and feeding that to IAM, IGA, PAM and ITSM tools; it joined SailPoint's Technology Alliance Partner program in August 2026. The first route suits a team choosing a new IGA; the second suits a team that wants its current IGA to reach further.
Source: Saviynt Identity Governance and Administration · Read 27 Sep 2026 · Source: Orchid Security homepage · Read 27 Sep 2026 · Source: Orchid Security blog: SailPoint partnership · Read 27 Sep 2026
What do the partial approaches cover?
Veza reveals accounts that exist outside identity platforms and connects custom systems through its Open Authorization API. C1 watches shadow app signups and logins. Lumos surfaces shadow IT and dormant accounts. SailPoint gives application owners a self-registration portal and integration templates. Microsoft documents account discovery and a manual CSV path for apps without provisioning. Palo Alto Networks describes robotic process automation in Idira for applications that lack APIs; it is not profiled here because we have only one page on it.
Source: Veza homepage · Read 27 Sep 2026 · Source: C1: shadow IT · Read 27 Sep 2026 · Source: Lumos Identity Analytics · Read 27 Sep 2026 · Source: SailPoint blog: Application Management · Read 27 Sep 2026 · Source: Microsoft Learn: governing existing users in an application · Read 27 Sep 2026 · Source: Palo Alto Networks: Idira Identity Governance · Read 27 Sep 2026
How do you know you need this job?
Four signs: your list of applications is longer than the list connected to your identity provider; auditors ask for access evidence on applications reviewed by spreadsheet; leavers are disabled in the directory but keep local accounts inside applications; or you have acquired a company that brings its own applications and accounts. Orchid lists M&A and growth events among its use cases for that last reason.
Source: Orchid Security homepage · Read 27 Sep 2026
Frequently asked questions
Is application coverage the same as SaaS management?
They overlap. Shadow SaaS detection finds applications people sign up for. Application coverage also includes on-premises, legacy and custom-built applications and the accounts inside them, which leave no SaaS signup to detect.
Does Orchid Security replace an IGA?
No. Orchid's pages describe feeding identity context into IAM, IGA and ITSM tools; joiner, mover and leaver actions and access reviews run in those tools.
Why is Okta not listed for this job?
Governance of applications outside Okta's integration catalog is not described on the pages we read. The catalog lists 8,000+ pre-built integrations, which covers many SaaS applications but not custom-built ones.
Read next