The Last Mile of IAM: How to Fully Extend Your Identity Stack So it Reaches Everywhere
Every identity program has a list. The apps that "don't support SAML." The open-source tool nobody wants to touch. The ERP (Enterprise Resource Planning) that predates SCIM by a decade. Somewhere along the way, that list got a polite name: out of scope.
“Out of scope” is where your risk lives. Those applications still hold production data, admin accounts, and payment flows. Your MFA, your access policies, your lifecycle automation, your reviews: none of it reaches them. The industry built strong controls for the apps that were easy to protect and left the hard ones to fend for themselves.
The exception list
Five kinds of applications end up there:
- Legacy systems built before modern identity protocols existed.
- Homegrown applications with no vendor, no roadmap, and one developer who left in 2019.
- Self-hosted software that never shipped an identity interface.
- Apps with schemas so complex or undocumented that no vendor ships a connector.
- SaaS products that lock SSO and SCIM behind the enterprise tier. The SSO tax: paying again for the right to secure what you already bought.
Five different reasons. One identical result: the stack you paid for is never enforced on them.
Why connectors haven't fixed this
The traditional answer is a custom connector. Months of scoping the app's API, if it has one. Hard-coding its schema. Testing provisioning flows by hand. Then the app updates, and the connector breaks silently. Provisioning fails, and nobody notices until an access review or an incident.
Multiply that by every hard app in the estate and you get what most programs actually run on: brittle scripts, a permanent maintenance backlog, and integration debt wearing an identity program's badge. The failure is structural. Hand-built connectors treat integration as a project, and applications change weekly. Anything built by hand is aging from the day it ships.
Connection is the entry ticket. Enforcement is the point.
Getting an app "connected" means little by itself. Governed means the controls hold: SSO in front of every login. MFA and conditional access enforced at authentication. Joiners provisioned on day one, movers adjusted, leavers cut off the same day. Access reviews that reflect live reality instead of a quarterly CSV export.
Hold that bar, and the last mile has three requirements:
- Reverse-engineer the interface, safely. Every application has an interface, whether it's an API, a database, or an admin console. Discovery should be read-only first, writes proven in staging, and production changes gated, rate-limited, and reversible.
- Self-healing, or it doesn't count. A connector has to watch the app it governs: schema drift, authentication-flow changes, permission-model changes, failed provisioning events. It detects the break and repairs it before a control silently lapses. A connector that can't tell you when it's broken is a liability with an SLA.
- Enforce without touching production workflows. Wrap the app externally with standard SAML and SCIM instead of asking its owner to change code. Run in shadow mode first, watch what would happen, then enforce. The app owner's roadmap stays intact; your controls arrive anyway.
Before and after
Take a self-hosted, fifteen-year-old ERP (an illustration, and probably a familiar one).
Before: local passwords, no MFA, leavers deprovisioned by ticket in days or weeks, reviews run on a spreadsheet someone exports quarterly. After wrapping it: every login flows through your IdP with MFA and conditional access enforced, JML runs off your HR source, a leaver's access dies with their HR record, and reviews pull live access data. Same application. Zero code changes. Every control you already own, finally holding.
That's the standard to demand from anyone who claims to solve this, including us.
We built Way as the last mile: making sure the IAM stack you already own gets enforced on every app and any identity. Even the ones you were told to give up on.
Bring us your exception list, see what happens.
