Managing User Accounts on Third-Party Sites Without SSO

Creating a comprehensive list of all third-party apps used and performing quarterly audits can be super helpful. It keeps everything in check and ensures you aren't missing any accounts that need deactivation.

It's crucial to have documented processes in place. If you can't use SSO, then a thorough checklist for account management becomes your best friend. When users leave, run through the list and deactivate their accounts manually, even though it can be a hassle.

If managing accounts becomes too cumbersome, consider investing in SaaS management tools like Flexara or Corma. These can help identify applications without SSO and streamline the deprovisioning process.

Take the time to map out the applications and their owners. When someone leaves, just reach out to the owner to get them to remove access. If you can track this in a configuration management database, it’ll help automate the process and maintain accurate user counts.

Don't forget to clarify whether IT is even responsible for managing access to these third-party sites. Sometimes the business side handles it. Just make sure to communicate this clearly to avoid any potential issues down the line.