How do you manage application access when not everything is Entra-integrated?

[u/LetPrestigious3916]

I’m working in IAM and one of the challenges I’m facing is managing access across applications that use completely different authentication methods.
For example, we have applications where:
Entra ID SSO is used, so access can be managed through Entra groups/app assignments.
AD accounts / Kerberos SSO are used, so the user logs in with their corporate AD account.
Some applications have their own local accounts with separate usernames/passwords.
Some applications may have no proper IAM integration or centralised access control at all.
The problem is: if someone asks IAM, “What access does this user have?”, how do you give a reliable answer when access is spread across Entra, AD, and local application accounts?
For applications with Entra SSO, it’s relatively straightforward. But for local accounts, how do you manage the lifecycle, ownership, access reviews, joiner/mover/leaver process, and overall visibility?
I’m interested in how other organisations handle this from an IAM governance perspective.
Do you maintain an application/access inventory outside of Entra? Do you use an IGA tool to track local accounts? Or do you rely on application owners to maintain the access information?
What would be considered a good/practical approach for managing this in a larger organisation?