An orphan user is a user identity whose relationship to the organization -- typically represented by a user's manager, is not documented. Orphan users are not a part of an org-chart but do have valid identities and may have associated accounts.

Orphan users represent a security risk, since it is not clear whose responsibility it is to review their access rights -- i.e., they may fall outside of the scope of an access certification process and there is no clear manager responsible for approving change requests that pertain to their accounts.

Orphan users are related to, but not the same as, orphan accounts, which are accounts that are not linked to a user identity.

A dormant account is one with no recent login activity. A dormant user profile is one that contains (at most) only dormant accounts. An orphan account is one not attached to a user profile (owner). An orphan user profile is one not linked to the organization, through a supervisor/manager.

Hitachi ID Identity Manager can be used to find orphan and dormant accounts and orphan and dormant user profiles:

  • ID mapping processes (automated, attribute-based or self-service) link accounts to user profiles.

  • Org-chart import (from HR, AD, etc.) and update workflows link users to their managers.

  • The last login time and date can be extracted from each managed system, for each account. Accounts that have not logged in recently can be flagged as dormant.

Reports are provided in Hitachi ID Identity Manager to identify orphan and dormant accounts and user profiles as per the above definitions. Report output can be fed directly into remediation requests (e.g., to disable dormant accounts) or into audit requests (e.g., to request further investigation).

Return to Identity Management Concepts