The externalId is the unique identifier that links a user's account in a service provider (like your app) back to their identity in an IdP like Okta, Azure AD, or Google Workspace. When an account is created via SCIM, this ID is automatically populated. If it's missing, it almost always means the account was created manually — outside of your standard, automated process.

This "shadow IT" account won't be deprovisioned when the user leaves the company, because the IdP doesn't know it exists. It won't be included in automated access reviews. It's a ghost in the machine, and during a SOC 2 or ISO 27001 audit, these are exactly the kinds of discrepancies that lead to findings. Scimly Guard flags these immediately, giving you a chance to remediate them before they become an audit headache.

When you run an analysis in Scimly Guard, your user data is never uploaded to a server we control. It's processed locally, in the browser tab, on your machine. This means there is zero risk of a data breach on our end exposing your sensitive information. For access governance, where you're dealing with employee lists, roles, and permissions, that's not a small thing.

This constraint forces us to build simpler, more robust tools. It also means the base editions can't support multi-user collaboration or saved state out of the box. We think that's the right trade-off. For teams that need more, the architecture is designed to be extended with your own backend or database, keeping you in control.

This isn't a budgeting failure; it's a provisioning one. When an employee leaves or changes roles, their access to major platforms is usually revoked automatically via SSO. But smaller, manually-provisioned tools are often forgotten. The license remains active, the credit card keeps getting charged, and nobody notices until the next annual audit.

Scimly Guard's license waste analysis flags these accounts by combining last-login dates with per-seat cost data. It gives you an exact dollar amount for monthly and annualized waste, making it easy to justify the cleanup effort and demonstrate immediate ROI to finance.