A computing system comprising: persistent storage configured to store data on behalf of a managed network, wherein a remote computing system provides a plurality of computing resources on behalf of the managed network; and a discovery application configured to perform operations comprising: obtaining, from the remote computing system, first attributes of a first computing resource of the plurality of computing resources, wherein the first attributes indicate a first unique resource identifier associated with an authentication system provided by the remote computing system and utilized by the first computing resource; based on, or in response to, said obtaining the first attributes which indicate the first unique resource identifier, obtaining, from the remote computing system, second attributes of the authentication system, wherein the second attributes indicate a second unique resource identifier used by the authentication system; determining that the first unique resource identifier matches the second unique resource identifier; based on the first unique resource identifier matching the second unique resource identifier, generating a mapping between the first computing resource and the authentication system to indicate that access to the first computing resource is controlled by the authentication system; and storing, in the persistent storage, the mapping as one or more configuration items. persistent storage configured to store data on behalf of a managed network, wherein a remote computing system provides a plurality of computing resources on behalf of the managed network; and a discovery application configured to perform operations comprising: obtaining, from the remote computing system, first attributes of a first computing resource of the plurality of computing resources, wherein the first attributes indicate a first unique resource identifier associated with an authentication system provided by the remote computing system and utilized by the first computing resource; based on, or in response to, said obtaining the first attributes which indicate the first unique resource identifier, obtaining, from the remote computing system, second attributes of the authentication system, wherein the second attributes indicate a second unique resource identifier used by the authentication system; determining that the first unique resource identifier matches the second unique resource identifier; based on the first unique resource identifier matching the second unique resource identifier, generating a mapping between the first computing resource and the authentication system to indicate that access to the first computing resource is controlled by the authentication system; and storing, in the persistent storage, the mapping as one or more configuration items. obtaining, from the remote computing system, first attributes of a first computing resource of the plurality of computing resources, wherein the first attributes indicate a first unique resource identifier associated with an authentication system provided by the remote computing system and utilized by the first computing resource; based on, or in response to, said obtaining the first attributes which indicate the first unique resource identifier, obtaining, from the remote computing system, second attributes of the authentication system, wherein the second attributes indicate a second unique resource identifier used by the authentication system; determining that the first unique resource identifier matches the second unique resource identifier; based on the first unique resource identifier matching the second unique resource identifier, generating a mapping between the first computing resource and the authentication system to indicate that access to the first computing resource is controlled by the authentication system; and storing, in the persistent storage, the mapping as one or more configuration items.