password rotation

How do you govern credentials that fall outside SSO?

I'm working on credential governance and trying to understand how teams manage accounts that never enter the usual identity lifecycle. This includes break-glass accounts, contractor logins, shared credentials,…