At one job, we did a quarterly access review the usual way. Exported from Okta, exported from Slack, opened both in Excel, and ran VLOOKUPs to match rows.
We found an account that had been deprovisioned in Okta four months earlier. Still had an active Slack member account, a Zoom account nobody touched, and a live OAuth token in a third-party app that was provisioned directly - never went through Okta to begin with.