> For the complete documentation index, see [llms.txt](https://help.cerby.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.cerby.com/setup-and-admin/business-hubs/idlcm-beta/explore-idlcm.md). # Explore IdLCM This article describes the benefits of using IdLCM to simplify identity and access management by connecting disconnected apps to your identity platform. With Cerby's **Identity Lifecycle Management** (IdLCM) solution, you can connect all your disconnected apps to your identity platform to provide a single place to manage enterprise identities. For the list of identity platforms Cerby currently supports and setup instructions for each, refer to the [Creating and setting up an IdLCM integration](/setup-and-admin/business-hubs/idlcm-beta/creating-and-setting-up-an-idlcm-integration.md) collection. Despite the significant adoption of identity platforms, including identity providers (IdPs) and identity governance and administration (IGA) tools, organizations still face major gaps in identity and access management. Apps are expanding faster than the adoption of standards to simplify identity and access management. Cerby's IdLCM solution helps close this gap by extending the visibility, control, and automation of users and their access to an organization's disconnected apps. IdLCM provides the missing interoperability between your identity platform and disconnected apps by offering SCIM 2.0 and RESTful interfaces. Acting as an intermediary, Cerby receives user provisioning and deprovisioning events from your identity platform, translates them, and sends the appropriate instructions to the external disconnected apps, enabling the automation of joiner-mover-leaver (JML) tasks. Combined with Cerby's credential management capabilities, IdLCM offers IdP-compatible single sign-on (SSO), account discovery, and credential capture functionality to address the challenges of disconnected apps. Furthermore, IdLCM is integrated with the posture management capabilities of Cerby, enabling corporations to enforce password rotation and MFA policies in managed accounts and integrated apps. The following are other benefits of IdLCM: * **Automated user account management**: Streamlines user onboarding and offboarding by automatically creating, updating, and removing accounts in Cerby-integrated apps based on changes in your identity platform. * **Role and permission synchronization:** Ensures user roles and permissions are consistently synchronized and up-to-date across your Cerby-integrated apps. * **Audit trails for governance and compliance:** Maintains detailed logs of all identity lifecycle events, facilitating effective governance and compliance, along with real-time notifications for provisioning and deprovisioning errors. * **Secure access enforcement:** Improves security posture by enforcing policies like MFA and password rotation for Cerby-integrated apps. * **SSO integration:** Enables seamless login experiences for users, even for apps that do not natively support SSO. * **Simplified integration setup:** Ensures reliable provisioning operations across all supported apps. *** ## Key concepts **Table 1** contains the key concepts that are essential for understanding the IdLCM solution: | **Concept** | **Description** | | ------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Asset** | It is a resource, entity, or subproduct associated with and managed by external apps for specific purposes within the app's core functionality. Access to assets is governed by the user's license or seat. In paid social apps, assets are used for advertising and marketing, such as pages, pixels, or ad accounts. In apps with other use cases, assets can be projects, teams, boards, libraries, or workspaces. | | **Authoritative source** | It is the system whose user and group data is considered canonical for downstream apps. After an IdLCM integration is configured, the identity platform becomes the authoritative source; all user management must happen there, not in the external app. | | **Connected account** | It is a Cerby account associated with an integration user. This account corresponds to an individual user who has a license or seat in an external app; therefore, it's not an account meant to be shared with other users. | | **Credential capture** | It is the process of detecting and autosaving user login credentials to enable secure automation and account usage monitoring. | | **Entitlement** | It is a specific permission granted to a user or role to perform actions on a resource. Entitlements dictate what a user can do, for example, read a file, modify a database record, or view customer data. These permissions can be granted or denied. Currently, assets are the only entitlement type supported through Cerby's IdLCM solution. See **Asset** above. | | **External app** | It is a third-party app or service provider that relies on Cerby to manage the lifecycle of enterprise identities. Access to these apps is governed by users' licenses or seats. | | **Group** |

It is a collection of users in identity and access management (IAM) systems with shared characteristics, access rights, or responsibilities. Groups are used to streamline user assignment and provisioning to downstream apps with specific entitlements.
NOTE: Groups are not currently supported; therefore, your identity platform cannot push group changes through the SCIM gateway.

| | **Integration** | It is the entity that represents the SCIM gateway configuration for an external app within Cerby. | | **Provisioning state** | It is the current status of a user within the SCIM gateway lifecycle. Cerby tracks each user through the provisioning, update, and delete stages, each of which can be awaiting, ongoing, or failed. When provisioning completes, the user is **Onboarded**; when deprovisioning completes, the user is **Deleted**. For the full list of states, read the article [View the users of an IdLCM integration](/setup-and-admin/business-hubs/idlcm-beta/managing-your-idlcm-integrations/view-the-users-of-an-idlcm-integration.md). | | **Role** | It is a collection of permissions that typically align with a user's job function or responsibility within an organization. Roles are designed to simplify access management. | | **SCIM gateway** | It is the intermediary that transmits SCIM 2.0 messages between systems, facilitating the exchange of user identity and attribute data. It also exposes a SCIM interface on top of a system that doesn't natively support the SCIM protocol. Cerby's SCIM gateway supports full create, read, update, and delete operations for users. Groups are not currently supported. | | **Service account** | It is a user account intended for managing the external app or service provider. Service accounts are used for machine-to-machine operations. These accounts are added to Cerby and associated with an integration to execute automated user management tasks. | | **Disconnected app** | It is an app or service provider that doesn't integrate with identity management systems or follow standard authentication protocols and security standards. Commonly, these apps lack API integrations for user management. | **Table 1.** IdLCM key concepts *** ## The Integrations page The **Integrations** page in the Cerby web app dashboard, as shown in **Figure 1,** is the centralized view of all the apps you have connected via Cerby's IdLCM solution. It is accessible only to workspace **Admins**, **Super Admins**, and **Owners**.

Figure 1. Integrations page in the Cerby web app dashboard

In the **Integrations** page, you can view the list of your Cerby-integrated apps along with the following information: * **App or service** : It is the name of the disconnected app for which an integration is added to Cerby. * **Integration name** : It is the name assigned to the integration when adding it to Cerby. * **SCIM Gateway ID** : It is a unique identifier assigned to SCIM gateways created for the integrated app. * **Last synced:** It is the date and time of the last sync attempt. * **Status:** It is the current status of the SCIM gateways. From this page, you can navigate to the integrations details page to explore more information, such as the integration settings, users, and activity events. *** ## How IdLCM works As mentioned previously, the purpose of the IdLCM solution is to enable disconnected apps to function like standard apps. Cerby achieves this functionality by integrating a SCIM gateway into apps that lack native SCIM support. **Figure 2** shows a high-level architecture of the IdLCM solution for disconnected apps connected to identity platforms through Cerby.

Figure 2. High-level architecture of the IdLCM solution

When you add and set up an integration, Cerby automatically generates a SCIM gateway that connects to the disconnected app. This gateway provides SCIM 2.0 endpoint capabilities to the app, enabling it to receive notifications from your identity platform whenever user provisioning and deprovisioning events are detected. The gateway goes through a validation step during setup: it moves from an uninitialized state to validated after Cerby confirms connectivity to the downstream external app. Upon receiving a notification from your identity platform, the SCIM gateway authenticates the request, parses the payload, verifies that the operation can be performed by the requesting party, and processes the operation. Roles and entitlements are transmitted using Cerby's custom SCIM namespace rather than the standard SCIM `roles` or `entitlements` fields, which avoids triggering specialized governance processing in identity platforms that handle those fields differently. Then, Cerby initiates automation jobs to implement provisioning actions within the integrated app. For disconnected apps, it's essential to establish a dedicated service account or token and configure the app details. This configuration enables Cerby to securely access the app using the associated service account credentials, facilitating the execution of user and access management tasks through automation jobs or API calls. The main functionalities of an IdLCM integration are the following: * [User and access management tasks](#user-and-access-management-tasks) * [Audit trail](#audit-trail) * [Posture management](#posture-management) * [IdP-compatible SSO](#idp-compatible-sso) The following sections describe each functionality. ### User and access management tasks The following are the user and access management tasks you can perform from your identity platform and extend to your external apps through Cerby's IdLCM solution: * **Joiner (provision user)**: The SCIM gateway detects the provisioning events coming from your identity platform and triggers the automation job to create the user accounts in your Cerby-integrated app with the specified roles, including entitlements (if supported), triggering the corresponding invites through email. The user's provisioning state moves from **Provisioning awaiting** to **Onboarded** when the automation job completes successfully. * **Mover (update user):** The SCIM gateway detects update events from your identity platform and triggers the task to propagate the changes into the Cerby-integrated app. * **Leaver (deprovision user)**: The SCIM gateway detects the deprovisioning events from your identity platform and triggers tasks to remove the user accounts from your Cerby-integrated app, including entitlements (if supported). The user's provisioning state transitions to **Deleted** when the operation completes. {% hint style="info" %} **NOTE:** The available management tasks vary from app to app. For example, for some apps it is not possible to update roles because they only support one role natively. {% endhint %} ### Audit trail For each integration, Cerby offers a detailed, read-only record of all lifecycle management actions, such as provisioning, role updates, deprovisioning, and related events, helping you ensure compliance, maintain security, and quickly troubleshoot access issues. The **Activity** tab in the integration details page displays the following data organized in the following columns: * The time when each event was registered * The entities that triggered the event * The event type * The entities affected by the event Having a detailed audit trail enables you to track events in real time, providing the transparency and accountability needed for effective governance. ### Posture management An essential component of a complete identity lifecycle management solution is posture management. The goal is to help organizations implement and enforce their security policies and ensure users can't use apps when permissions are unassigned. At Cerby, posture management goes beyond simply provisioning and deprovisioning accounts for disconnected apps. You can leverage the following features of our platform to enhance your security posture and complement IdLCM: * **Account security hygiene:** When access to external apps is managed by IdLCM, integration managers can trigger automation jobs for rotating passwords and turning on MFA. * **RBAC efficacy:** Cerby's role-based access control (RBAC) system is designed to maintain data security, streamline access management, and offer transparency in access control, making it clear who has access to what resources and why. * **Error handling and logging:** Our platform provides information about all relevant events and automation errors, as well as the list of users and integration managers with their app roles and their activity, to support auditing and incident response. ### IdP-compatible SSO Disconnected apps don't natively support standard SSO protocols, such as SAML or OIDC. Therefore, offering IdP-compatible SSO bridges a crucial gap between modern identity management and legacy or uncooperative applications. By connecting external apps to your identity platform through a SCIM gateway, the identity platform dashboard becomes the centralized access point for users. With the IdLCM and credential capture capabilities, Cerby matches all app accounts to the corresponding integration and identity platform users, and extends the corporate SSO experience to all users. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://help.cerby.com/setup-and-admin/business-hubs/idlcm-beta/explore-idlcm.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.