Enterprise IT
Identity automation past the SCIM boundary.
acquired-app admin consoles, SAP GUI, and mainframe sessions have no API. StitchOps still runs them.
What teams here run first.
The identity program stalls at the apps without SCIM.
Joiner, mover, leaver in no-SCIM apps
The directory change made in each closed app, with evidence.
Orphan account cleanup
Bulk remediation from a spreadsheet, gated per account.
Access review evidence
User lists pulled and compared on a schedule, differences filed.
Privileged access with auto-revoke
Elevated access granted for a window, then removed.
How it runs
One worker VM. Every system.
The agent on a worker VM inside your network logs into acquired-app admin consoles, SAP GUI, and mainframe sessions with vaulted credentials, does the task the way IT ops and identity teams would, and logs every step.
See the platform →Worker
worker-01 · connected
- Windows Server 2022 · signed installer
- outbound only · TLS 1.3 · 0 inbound ports
- unattended session · dedicated VM
Capabilities
- browser
- desktop
- terminal
- file
- ldap / ad
Systems reached today
- acquired-app admin consolesbrowser14
- SAP GUIdesktop9
- mainframe sessionsterminal6
- vendor portalsbrowser22
- on-prem ADldap3
Secrets
31 references resolved on worker · 0 values sent to control plane
Evidence
Every run, on the record.
Status, timing and redacted results for each step, with the evidence a reviewer asks for attached to the run rather than reconstructed from screenshots later.
How security reviews go →| Run | Workflow | Time | Status |
|---|---|---|---|
| run_01j8k | offboard-closed-apps | 5.2s | ok |
| run_01j8h | rotate-portal-password | 12.4s | ok |
| run_01j8f | access-review-monthly | 188s | ok |
| run_01j8c | orphan-cleanup | 41.0s | failed |
| run_01j89 | oem-report-pull | 58.3s | ok |
Why IT ops and identity teams trust it.
Credentials stay yours
Referenced from your vault or ours, resolved on the worker. The model never sees a value.
Runs in your environment
An outbound-only agent on a dedicated worker VM. Screen content never leaves it.
Compliance
SOC 2 Type 2, ISO 27001 certified, third party penetration tested. Tenant isolation on every API route.
The SCIM tax
Many SaaS vendors include SCIM provisioning only on their top plan, for every seat. The SCIM tax calculator models it department by department, and SCIM pricing by app shows the plans and sources.
Start with one workflow that never had an API.
Fifteen minutes on your top three manual processes. We tell you which one to run first.