Unverified50% confidenceOpinionExact time
In B2B account takeover defense, the value of SCIM lies in eliminating 'orphan accounts'—if an employee leaves or changes roles but an active account remains on the SaaS side, attackers can lurk for a long time using leaked old credentials.
1
Sources
50%
Confidence
Long-term
Relevance
11/2/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedIn B2B SaaS scenarios, a single hijacked account can jeopardize the data and operational security of an entire customer organization.70% similarUnverifiedIn B2B identity federation scenarios, when SSO configuration fails or is not enforced, systems often retain local accounts or password login as a fallback path, and attackers exploit this gap to bypass the IdP's multi-factor authentication and conditional access policies.70% similarUnverifiedSCIM's `active` attribute is the key switch for deprovisioning on departure; setting it to false triggers account disabling on the application side.68% similarUnverified攻击者获取访问权限后可能立即绑定自己的2FA设备将原账号主人锁出，此操作被称为账号接管（Account Takeover，ATO）63% similarUnverifiedCompared to logical isolation within the same account using tags or resource policies, account-level isolation provides a more limited blast radius in the event of a privilege leak, as attackers would need to break through cross-account trust configurations to move laterally.63% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1127403API
curl https://kongchang.com/api/v1/knowledge/claims/1127403MCP
get_claim(id=1127403)