Verify access continuously — even after they leave.
Joiner-Mover-Leaver across AD, Azure AD and LDAP, with the ghost-account hunt that traditional IdP-only tools miss.
Leavers keep access to SaaS no one remembers granting.
"Login with Google" hides whether it's a corporate or personal account.
Access reviews are an annual fire drill, not a continuous control.
Three sources, one identity.
Active Directory, standalone LDAP and Azure AD merge into one identity graph — UPN-normalized, lastLogon-MAXed across DCs, with multi-controller drift detected as a finding, not silently masked.
AD + LDAP + IdP into one graph
- · UPN · sAMAccountName
- · memberOf · groups
- · lastLogon (MAX across DCs)
- · DN · uid
- · memberOf
- · custom attributes
- · SSO sessions · MFA
- · OAuth grants · scopes
- · conditional access
The loop closes in hours, not weeks.
HR event → AD update → IdP sync → SaaS deprovision → audit log. Every step instrumented, every latency measured against your SLA.
Access certification
Reviewer-driven keep / revoke / flag campaigns (ISO 27001 A.5.18), audit-immutable once closed.
OAuth & SSPM
Connected-tenant OAuth permission inventory and posture: security defaults, conditional access, admin / guest / MFA coverage.