# Uncorrelated accounts - How to detect incorrectly correlated accounts - Theoretical scenario **URL:** \ **Category:** Administration & Troubleshooting\ **Tags:** identityiq, identityiq-8.3, compliance, identityiq-8.4, accounts-entitlements, certifications, event-triggers-workflows, audit\ **Created:** [June 18, 2025, 6:17am UTC](https://community.sailpoint.com/discuss/t/uncorrelated-accounts-how-to-detect-incorrectly-correlated-accounts-theoretical-scenario/36369 "2025-06-18T06:17:31Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![InJhong](https://avatars.discourse-cdn.com/v4/letter/i/a6a055/32.png) [@InJhong](https://community.sailpoint.com/discuss/u/InJhong)\ **Post date:** [June 18, 2025, 6:17am UTC](https://community.sailpoint.com/discuss/t/uncorrelated-accounts-how-to-detect-incorrectly-correlated-accounts-theoretical-scenario/36369/1 "2025-06-18T06:17:31Z")
Hello Everyone, I have a scenario(s) that I’d like to discuss options/thoughts on: Tightening existing controls and SLAs is one thing but I need to balance security and reasonable controls. Note: this might be an environment that has 2000+ applications, 30,000+ users (this stat is useful as not all small environment solutions can be applied to larger organisations) #### Scenario: - **Disgruntled Admin Employee: An employee with access to a web application that lacks SSO (Single Sign-On).** - **Correlation Rule and Configuration: In IIQ, the correlation rule is based on the ‘email address’.** - NCD is not applied on this application. #### Investigation: - Once the uncorrelated account is discovered, an investigation begins. - Often, the account is simply correlated to an existing old identity cube without checking the lifecycle status. In this scenario, they would delete the account as there is no HR record to link it to. - We have a UAM process removes old access linked to identity cubes it finds. - There is a window of a few days or potentially weeks where unauthorised access and malicious activities could continue. ---
**Author:** ![sanjaysutarc](https://avatars.discourse-cdn.com/v4/letter/s/ea5d25/32.png) [@sanjaysutarc](https://community.sailpoint.com/discuss/u/sanjaysutarc)\ **Post date:** [June 19, 2025, 2:55pm UTC](https://community.sailpoint.com/discuss/t/uncorrelated-accounts-how-to-detect-incorrectly-correlated-accounts-theoretical-scenario/36369/2 "2025-06-19T14:55:22Z")
Such a critical application exposed to internet without basic SSO - don’t you see big red flag here. I am not talking about MFA again for admin with highest privileges to the application. Even after assuming Sailpoint had all the features you needed like NCD Sailpoint is not right tool to detect fraud in real time. ---
**Author:** ![InJhong](https://avatars.discourse-cdn.com/v4/letter/i/a6a055/32.png) [@InJhong](https://community.sailpoint.com/discuss/u/InJhong)\ **Post date:** [July 10, 2025, 1:53am UTC](https://community.sailpoint.com/discuss/t/uncorrelated-accounts-how-to-detect-incorrectly-correlated-accounts-theoretical-scenario/36369/3 "2025-07-10T01:53:30Z")
Hello @sanjaysutarc  , of course there is a big problem with not having SSO enabled however, there are definitely assets out there that do not have it enabled. The scenarios are specifically for assets that do not have SSO enabled. The main question is, how do we promptly identify and pick up incorrectly manually correlated accounts. Even if the asset is not critical and used for money movement, fraud, it can still cause damage to organisations. Many companies approach IAM from a risk priority perspective. Targeting high risk assets first and then working towards the lower risk assets. I am also referring to an environment with 6000+ applications. It is unlikely all of these will have SSO enabled (even if that is a desirable outcome) ---
**Author:** ![phodgdon](https://sea3.discourse-cdn.com/sailpoint2/discuss/user_avatar/community.sailpoint.com/phodgdon/32/18873_2.png) [@phodgdon](https://community.sailpoint.com/discuss/u/phodgdon)\ **Post date:** [July 10, 2025, 11:34am UTC](https://community.sailpoint.com/discuss/t/uncorrelated-accounts-how-to-detect-incorrectly-correlated-accounts-theoretical-scenario/36369/4 "2025-07-10T11:34:17Z")
You can likely create reports or access reviews that app owners could review of all their uncorrelated accounts or create work items for them. As far as newly correlated accounts on inactive users, also something you could do with and identify certification using a trigger event, run reports on or create widgets to monitor in real-time. ---
**Author:** ![lennoz](https://avatars.discourse-cdn.com/v4/letter/l/d9b06d/32.png) [@lennoz](https://community.sailpoint.com/discuss/u/lennoz)\ **Post date:** [July 10, 2025, 12:54pm UTC](https://community.sailpoint.com/discuss/t/uncorrelated-accounts-how-to-detect-incorrectly-correlated-accounts-theoretical-scenario/36369/5 "2025-07-10T12:54:13Z")
Some many red flags here why is the org against SSO, or jump host or some other methods (IP restriction), why NCD not turned on. SailPoint is not SIEM solution never is and never will be, but if you want to track build a report and have 1 person in operation area doing this on weekly basis as a control if that’s acceptable. you can’t fix this w/ SP as bad data not matter what IGA tool will not help you identify who that person is if you don’t have any other unique identifier numerical number keys. ---
**Author:** ![InJhong](https://avatars.discourse-cdn.com/v4/letter/i/a6a055/32.png) [@InJhong](https://community.sailpoint.com/discuss/u/InJhong)\ **Post date:** [July 28, 2025, 12:49am UTC](https://community.sailpoint.com/discuss/t/uncorrelated-accounts-how-to-detect-incorrectly-correlated-accounts-theoretical-scenario/36369/6 "2025-07-28T00:49:43Z")
Hello @lennoz  , I understand that an organisation without SSO and NCD enabled for all their applications is a concern however, it’s a reality for some organisations hence the theoretical scenario to figure out whether or not this can be managed within SailPoint IdentityIQ. Based on what you’re saying, it seems like an IGA tool is not the appropriate platform. Either pay for a tool that does handle this or add it as a regular operational task as a basic control until NCD and SSO is enabled. I guess there isn’t a straight forward process to avoid these types of issues where SSO and NCD is not enabled. Guess that’s the purpose of SSO and NCD haha