In SQL, finding rows that DON'T have something is a bit different than the opposite, and I don't think Insight Queries is good at building that type of SQL yet.   It sounds like all your apps build account objects, which in turn link back to identities.  That's good.   I'd suggest a query that does a count of links from identity to accounts (with a left join to get all identities), and then in the where clause only allow count of zero, and specify which app the accounts must be sourced from.   

One way to build this is to use an insight query that looks at identities with accounts, then create a metric on the analysis config menu from that insight query, and it will show you the SQL.  Then copy that over to a SQL tool and add the count, where clause, etc.

If that works, you *could* create a custom report with that query, if you need it to be accessible quickly by folks that aren't going to run SQL queries.

--Jim

The fact that Insight Queries can't do something as simply as what identities don't have accounts in a specific application is a major oversight in the product. However, I do thank you for giving me the hint on the metrics from insight query to get a start on the SQL code, because SQL is not something I know, but with a base to start from I should be able to mush something together.

Thanks,

Bob

This query will use a subquery that generates a list of all accounts in an app (you'll want to replace 'AD' with your app name) and then the main query just shows identities that dont link to anything in the list.    Note that database queries aren't supported by support, and are liable to change with version updates.:)

SELECT
    su.display_name AS user_display_name
FROM
    suser         su

WHERE
    ( ( su.effective = 1
        AND ( su.deleted IS NULL
              OR su.deleted = 0 ) )
    AND su.collected_entity NOT IN 
        (
        select distinct sau.suser
        from 
        saccount_user sau 
        LEFT JOIN saccount      sa ON sa.collected_entity = sau.saccount
        LEFT JOIN data_source   ds ON ds.id = sa.application
        WHERE
        sau.effective = 1
          AND ( sa.id IS NULL
                OR ( ( sa.effective = 1
                       AND ( sa.deleted IS NULL
                             OR sa.deleted = 0 ) )
                     AND ( sa.virtual IS NULL
                           OR sa.virtual = 0 ) ) )
          AND ds.name = 'AD' 
        )
    )