A computing system comprising: persistent storage configured to store data on behalf of a managed network , wherein a remote computing system provides a plurality of computing resources on behalf of the managed network ; and a discovery application configured to perform operations comprising: obtaining, from the remote computing system , first attributes of a first computing resource of the plurality of computing resources, wherein the first attributes indicate a first unique resource identifier associated with an authentication system provided by the remote computing system and utilized by the first computing resource; based on, or in response to, said obtaining the first attributes which indicate the first unique resource identifier, obtaining, from the remote computing system , second attributes of the authentication system, wherein the second attributes indicate a second unique resource identifier used by the authentication system ; determining that the first unique resource identifier matches the second unique resource identifier; based on the first unique resource identifier matching the second unique resource identifier, generating a mapping between the first computing resource and the authentication system to indicate that access to the first computing resource is controlled by the authentication system ; and storing, in the persistent storage , the mapping as one or more configuration items. persistent storage configured to store data on behalf of a managed network , wherein a remote computing system provides a plurality of computing resources on behalf of the managed network ; and a discovery application configured to perform operations comprising: obtaining, from the remote computing system , first attributes of a first computing resource of the plurality of computing resources, wherein the first attributes indicate a first unique resource identifier associated with an authentication system provided by the remote computing system and utilized by the first computing resource; based on, or in response to, said obtaining the first attributes which indicate the first unique resource identifier, obtaining, from the remote computing system , second attributes of the authentication system, wherein the second attributes indicate a second unique resource identifier used by the authentication system ; determining that the first unique resource identifier matches the second unique resource identifier; based on the first unique resource identifier matching the second unique resource identifier, generating a mapping between the first computing resource and the authentication system to indicate that access to the first computing resource is controlled by the authentication system ; and storing, in the persistent storage , the mapping as one or more configuration items. obtaining, from the remote computing system , first attributes of a first computing resource of the plurality of computing resources, wherein the first attributes indicate a first unique resource identifier associated with an authentication system provided by the remote computing system and utilized by the first computing resource; based on, or in response to, said obtaining the first attributes which indicate the first unique resource identifier, obtaining, from the remote computing system , second attributes of the authentication system, wherein the second attributes indicate a second unique resource identifier used by the authentication system ; determining that the first unique resource identifier matches the second unique resource identifier; based on the first unique resource identifier matching the second unique resource identifier, generating a mapping between the first computing resource and the authentication system to indicate that access to the first computing resource is controlled by the authentication system ; and storing, in the persistent storage , the mapping as one or more configuration items. <EOS>