The Asterisk on "MFA Everywhere": Your IdP Enforcement Gap

Somewhere in your last board deck there's a slide that says MFA is enforced across the enterprise. It's true, with an asterisk nobody reads aloud: enforced across the enterprise means enforced on every app federated to the IdP. The apps that never got federated, the legacy system with its own login page, the homegrown tool built before SAML was a given, the vendor app that gates SSO behind a premium tier, sit outside every policy you've written. Conditional access, phishing-resistant MFA, session controls: none of it applies to an app your IdP can't see.

So the real coverage number isn't the one on the slide. It's the share of your portfolio the IdP actually enforces. For most complex enterprises, that number would not survive the board meeting. An identity provider does nothing for the apps it never fronts; for those, you own an empty box and a policy document.

The industry scoped out the hard apps and called it done

This isn't an Okta problem or an Entra problem. The IdPs are excellent at what they do; that's why you bought one. The problem is the assumption underneath the whole category: that applications will meet the identity provider halfway by speaking modern auth. When an app doesn't, the industry has three answers, and all of them are bad.

Answer one: wait for the app vendor's roadmap. Your enforcement gap now closes at the pace of someone else's backlog. Answer two: pay the SSO tax. The practice of charging premium-tier prices for SAML support is so established it has its own website, and it means the apps most likely to sit outside your policies are the ones where the vendor made security a line item. Answer three: commission custom integration work per app, which turns a policy decision into an engineering project and turns your team into the integration department.

Notice what all three answers have in common: they accept that the app boundary decides what your IdP can enforce. That's the assumption worth attacking. An access policy that applies where convenient is a preference, and attackers don't respect the scoping document.

Enforcement should not depend on the app's cooperation

Way removes the asterisk. We sit on top of the IdP you already run and enforce it on every app and identity it can't reach today: SaaS, self-hosted, legacy, homegrown. The mechanism is SAML and SCIM extended to any business app; a system that doesn't speak modern auth gets modernized and federated without waiting on the vendor, without the premium license, without a customization project. The outcome is the point: the authentication stack you already own, holding everywhere.

The part that matters: once an app is wrapped, your full IdP applies to it natively. Conditional access policies, MFA requirements, provisioning, session rules; everything you've built in Okta or Entra holds on that app exactly as it holds on your best-behaved SaaS. You don't write parallel policies in a second console. You don't manage a shadow IdP. Way is vendor-agnostic across identity providers, so the stack you standardized on stays the stack, applied to the whole portfolio instead of the compliant half.

What changes when the asterisk goes away

Start with the policy itself. "MFA everywhere" becomes a statement of fact instead of an aspiration with exclusions. The legacy app holding production data sits behind the same conditional access as your email. Local logins, the quiet standing risk on every unfederated app, retire because the IdP now fronts the door.

Then the economics. Every app you would have waited on, licensed up, or custom-integrated becomes the same repeatable motion. The enforcement gap stops being a roadmap item and starts being a closed ticket.

And the accountability question gets a clean answer. When someone asks which applications sit outside your authentication policy, the answer a security leader wants to give is: none. That answer is currently impossible for most enterprises, at any spend level, because the industry decided the hard apps were out of scope. We think that's the whole job.

Your IdP was never the weak point. Its reach was. Way is the last mile: nothing replaced, everything enforced.