The application appears in the identity provider, employees use the central sign-in button, and the rollout is marked complete. An older local administrator account may still exist behind a different route.
Single sign-on can improve identity management. It is not a complete inventory of every path into an application.
Ask what federation covers
NIST's federation guidance explains relationships between identity providers and relying parties. Your application review needs to establish which accounts and sign-in routes are actually governed by that relationship.
List normal users, service administrators, external collaborators, emergency accounts, and application-specific recovery. Confirm whether each uses central authentication, independent local credentials, or another approved mechanism.
Do not assume a central disablement action covers an account the identity provider does not manage.
Review the exception with its owner
A hypothetical SaaS platform retains a local owner account for emergency access. That can be a deliberate operational choice. It needs a custodian, strong protection, a defined purpose, and monitoring appropriate to the provider.
The right response is not to remove every fallback blindly. It is to distinguish a controlled recovery route from an old convenience account that no one remembers.
Record the provider's supported behavior. Do not generalize one application's local-account settings to another.
Connect an exposure finding to the right route
If a work address appears alongside the service, ask whether the observed record could be relevant to a local account, an older authentication arrangement, or a different account relationship.
The finding alone does not prove that central SSO was bypassed or that a currently valid password exists. Use authorized service administration and activity evidence.
If a current independent account needs action, assign it to the application owner. The identity team can coordinate without assuming it controls the entire lifecycle.
Test departure and recovery scenarios
Use approved test accounts to examine what happens when an employee is disabled centrally, an administrator changes roles, or a user loses an authenticator.
Include application sessions and delegated grants in the review. Authentication and ongoing authorization are separate questions, as discussed in OAuth tokens versus passwords.
A useful completion record names the routes reviewed, the owner of each exception, the verification performed, and any business dependency that remains.
Read emergency-access readiness and offboarding external accounts. SSO coverage becomes meaningful when the organization can explain the paths it governs and the ones it intentionally keeps separate.