IT Glossary
Identity reconciliation matches accounts across systems to the real person behind them. Learn how correlation works and why orphans hide in the gaps.
August 7, 2026
Identity reconciliation is the process of matching the accounts found across every system to the actual people supposed to hold them, and resolving whatever does not match. It answers a question no single application can: does this account belong to a current, known person with a legitimate reason to hold it. Everything that fails to match is an orphan, a duplicate, or a service account nobody has claimed.
The matching key is the whole difficulty. People sign up with a personal address, contractors use their agency email, names change, and service accounts have no human behind them at all. In practice a first reconciliation pass matches most accounts cleanly and leaves a stubborn residue of 5 to 15 percent needing a decision. That residue is exactly where orphaned accounts live, which is why the exercise is worth running.
A company reconciles 3,100 accounts across 94 applications against 240 employees and contractors. Roughly 2,700 match immediately. Of the remainder, 180 turn out to be service accounts and integrations, 90 are duplicates from people who signed up twice, and 41 belong to nobody currently working there. Those 41 are the finding that matters, and no directory export would have surfaced them. Corma performs that correlation continuously rather than as a one-off audit exercise.
An account that cannot be matched to a current, accountable person, usually left behind after a departure, a closed project, or a tool that changed owner.
An immutable employee identifier is the most reliable. Email addresses work until someone changes name, uses a personal address, or holds two accounts in the same tool.
They are classified separately and assigned a human owner, since an account with no owner cannot be reviewed or revoked by anybody.
Continuously where the connection allows it, and at minimum before every access review campaign, since a review built on incomplete account data proves nothing.
