Glossary
Orphaned account
An orphaned account is an account that still works but no longer belongs to a person or program that needs it.
How accounts become orphaned
The owner leaves the company. A contractor finishes. A program is retired and its service account is left behind. A company changes its sign-in system and the old accounts stay. Whatever the cause, the account can still sign in and still holds its access, but nobody answers for it.
NIST SP 800-53 Rev. 5, control AC-2(3), says to disable accounts that have expired, are in violation of policy, have been inactive for a set time, or “are no longer associated with a user or individual”. The CIS Critical Security Controls v8, safeguard 5.3, says to delete or disable any dormant account after 45 days of inactivity, where supported. Those are two ideas: an account with no owner, and an account nobody uses. They overlap but they are not the same.
Why it matters in an access review
A review needs a reviewer, and the reviewer is usually found through the account’s owner. No owner means nobody is asked, and the account passes through every review unseen. That is the reason to give every item a default reviewer, and to look for accounts that have no person behind them. An old account is also an attractive target, because nobody is watching it.
How to find them
Compare the system’s list of accounts with a list of current people, such as the company directory. An account with no matching person is a candidate. So is a service account that no team can claim. Last sign-in helps, but only when the system records it. If it does not, the answer is “unknown”, not “never”.
An example
In a Keycloak realm, the user pat is disabled after leaving the company, and still holds the role billing-admin. The account cannot sign in, but the role is still there, and it comes back if someone switches the account on. A second example: a service account named ci-deployer holds the same role, and no one can say which team owns it. The guide on how to run a user access review in Keycloak shows how to find both.
Common mistakes
- Using inactivity alone. An account can be unused but owned, or in daily use and owned by nobody.
- Reading “unknown” last sign-in as “never”.
- Deleting the account before the review records what it held and what was decided.
- Disabling the account and leaving its roles in place.