Account reconciliation: matching application accounts to people

1. Extract the account list from the application: from its admin console, its database or its API. Record the extraction date and who ran it.
2. Normalize the matching fields. Lower-case email addresses, strip domain suffixes if the application uses short names, and keep the employee ID if the application stores one.
3. Match each account to the HR system on the strongest key available: employee ID first, then work email, then a name match that a person confirms.
4. Classify every account into one of the four groups below.
5. Act and record. Assign owners, disable orphans or flag them for the next review, and keep the classified list as evidence.

Where an application is connected, the governance platform does most of this for you. Microsoft Entra ID Governance documents an account discovery report showing application users that do not match any Entra ID user, and for applications that do not support provisioning it documents exporting the users to CSV, matching them to Entra users and creating role assignments before a review. Discovery tools such as Orchid Security state that they map the accounts inside applications, including local and orphaned accounts, and feed that to the IGA. Veza reveals local, machine and service accounts in the systems it integrates with.

• Matching on display names. Two people with the same name, or one person whose name changed, produce false matches.
• Deleting unmatched accounts before anyone checks them. Some are service accounts that production depends on. Flag first, disable after the owner confirms.
• Reconciling once. Accounts are created every week; reconciliation belongs before every review and after every major leaver wave.

The orphan accounts guide covers removal safely, and the account states lesson defines each outcome.