Zluri is an identity security platform, and our identity governance and administration (IGA) product governs every identity, human or non-human, across every type of application: SaaS, AI, and on-prem. With the Universal Identity Connector, the same policies, access reviews, and lifecycle workflows that already cover identities in your SaaS stack extend to legacy and custom-built systems too.
There's a perception we run into regularly: Zluri's IGA is built for SaaS environments, and if a meaningful part of your application portfolio runs on-prem, you need a different platform for that half.
That perception has roots. In our early years, our IGA focus centered on identities accessing SaaS apps, and that's still where our depth shows. But IGA's object was always the identity, not the app. And the identities we govern, human and non-human, now span every type of application they touch: SaaS, AI, and on-prem. Our SDK has supported custom connections from the beginning, and in 2026 we launched the Universal Identity Connector (UIC), which turns what used to be a build-it-yourself option into five ready pathways for bringing on-prem and legacy systems under governance.
In this guide, we cover why hybrid environments break identity governance in the first place, what UIC actually connects, and what it looks like to run one set of policies across both halves of your infrastructure.
How Enterprises End Up Hybrid Without Deciding To
Most enterprises didn't choose a hybrid architecture. They accumulated one.
The SaaS stack grew fast because it was easy to adopt. Meanwhile, the systems that run the core of the business stayed where they were: the ERP holding financial data, the custom app engineering built a decade ago, the database-backed tools that never had a reason to move. For mid-market companies with 500 to 5,000 employees, 15 to 25 percent of the application portfolio still runs on-premises, and that share climbs higher for large enterprises.
If one in five of your applications sits outside your governance platform, you don't have an identity governance program. You have an identity governance program for the easy 80 percent.
Identity platforms handled this unevenly. SaaS apps integrate cleanly because they expose modern APIs. On-prem and legacy systems don't, so they get left out, and the gap shows up in predictable ways:
- Manual provisioning and deprovisioning. Access changes in legacy systems happen through tickets and admin consoles, which means errors and delays.
- Orphaned accounts after departures. Offboarding workflows cover the connected apps. The disconnected ones keep accounts alive long after the employee is gone.
- Undetected excessive privileges. Permissions accumulate in systems no one is watching, and there's no automated way to catch it.
- No visibility into access relationships. You can't see who holds what across these systems, let alone spot risky combinations.
- Compliance blind spots. Auditors don't accept "that system isn't integrated" as a reason to exclude it from access reviews.
The uncomfortable part: these ungoverned systems are usually the most critical ones. The ERP with financial data. The internal app with customer records. The exact systems where an orphaned account or excessive privilege does the most damage are the ones sitting outside the governance perimeter.
Policies Don't Enforce Themselves
Here's the framing that matters. Identity governance has two halves: deciding what should happen (policies, review cycles, lifecycle rules) and making it happen inside actual systems (creating accounts, changing permissions, revoking access).
Most platforms handle the first half fine. The second half is where hybrid environments break things, because enforcement requires deep integration with the infrastructure where permissions actually live. A deprovisioning policy that can't reach your ERP isn't a policy. It's a document.
The Universal Identity Connector is our execution layer for that second half. It translates governance decisions into actual access changes across applications, databases, and legacy systems, so the policy you define once gets enforced everywhere, not just in the apps with friendly APIs.
Five Pathways to Connect Any System
Enterprise systems expose identity data in very different ways, so a single connection method was never going to cover them all. UIC takes the opposite approach: five distinct pathways, matched to how each system actually works.
The pathways differ mainly in what they connect to. Directory Integration syncs users, groups, and permissions through identity directories like Active Directory. Enterprise Connectors are pre-built integrations for widely used platforms such as ERP and HR systems. Database Orchestration governs applications that store identity data and permissions directly in databases. The Extensible Connector Framework handles proprietary and custom applications through a flexible integration framework. And Interface Automation executes provisioning actions through the application's own interface when neither APIs nor database access are available.
The practical effect: there's no longer a class of application that's simply "unsupported." If a system holds identity data anywhere, one of these pathways reaches it.
What This Looks Like in Practice
The systems that benefit most from UIC are the ones traditional identity tools have struggled with for years:
- ERP platforms. Govern access to systems holding financial and operational data, where segregation of duties and audit scrutiny are highest.
- Internal applications. Automate the full access lifecycle for custom-built business apps that never had a governance story.
- Database-backed systems. Control permissions that live directly inside application databases, invisible to API-based tools.
- Legacy infrastructure. Bring older systems without modern APIs into the same framework as everything else.
Once connected, these systems stop being special cases. The same access reviews, the same provisioning and deprovisioning workflows, the same policy enforcement that already covers your SaaS stack now covers them too. One review cycle, one set of lifecycle rules, one audit trail, across both halves of the environment.
The goal isn't "on-prem governance" as a separate capability. It's making the on-prem question disappear, so a reviewer certifying access doesn't need to know or care where the application runs.
Weeks, Not Quarters
The historical objection to governing legacy systems wasn't that it was impossible. It was that it took forever. Custom integration projects for on-prem systems were the kind of work that consumed quarters and services budgets.
UIC compresses that meaningfully. Standard integrations connect in 2 to 4 weeks. Enterprise connectors for larger platforms take 4 to 8 weeks. Fully custom integrations vary with system complexity, but they run through the connector framework rather than a from-scratch engineering project.
For teams that wrote off on-prem governance as a someday project, that timeline changes the calculus. The systems that have sat outside the perimeter for years can come inside within a quarter.
Governing Identities, Wherever Their Apps Run
None of this changes where our depth runs deepest: identities accessing SaaS and AI applications, backed by a 240,000+ app library, direct integrations, and usage-level visibility. That's what most customers come to us for.
What changes is the ceiling. If your identities live entirely in SaaS, we govern all of them. If a fifth of the applications they access run on-prem, we still govern every identity, through the pathway that fits each system. The governance boundary is no longer drawn at "does this app have a modern API."
For the browser-based SaaS apps that lack APIs entirely, there's a related capability worth knowing: AI-powered integrations automate governance actions through the application interface itself, closing the same kind of gap on the SaaS side that UIC closes for on-prem.
If you're evaluating how much of your current portfolio could come under one governance layer, the Universal Identity Connector page covers the pathways in more detail, or you can walk through your specific systems in a demo.
Frequently Asked Questions
Is Zluri only for SaaS applications?
No. Zluri is an identity security platform, and our IGA product governs all identities, human and non-human, across all types of applications: SaaS, AI, and on-prem. Our capabilities run deepest for identities accessing SaaS and AI apps, and the Universal Identity Connector extends the same policies, access reviews, and lifecycle workflows to on-prem, legacy, database-backed, and custom-built systems.
What is the Universal Identity Connector?
UIC is our execution layer for systems that don't integrate through standard APIs. It provides five connection pathways (directory integration, enterprise connectors, database orchestration, an extensible connector framework, and interface automation) so that governance decisions get enforced inside any system where permissions live.
Did Zluri support custom integrations before UIC?
Yes. Our SDK has supported custom connections from the beginning. UIC, launched in 2026, packages that extensibility into ready pathways so teams no longer need to build connections themselves.
How long does it take to connect an on-prem system?
Standard integrations typically take 2 to 4 weeks. Enterprise connectors for major platforms take 4 to 8 weeks. Custom integrations vary based on system complexity.
Do on-prem systems get the same governance features as SaaS apps?
Yes. Once connected through UIC, a system participates in the same access reviews, provisioning and deprovisioning workflows, and policy enforcement as any API-integrated SaaS application. There's no separate, reduced feature set for on-prem.
What kinds of systems does UIC typically connect?
The most common cases are ERP platforms, custom-built internal applications, systems that store permissions directly in databases, and older infrastructure without modern APIs.
.svg)
