What is the iapprove account?

The iapprove account is the built-in master root account for the application. It cannot be removed and should not be disabled. If you are using SAML auth, you are likely using the root account along with it (you can take a look at the SAML config file). Ideally, the iapprove account should be used for that initial login to the application after installation, and you would create individual administrator accounts for each admin. Then lock down the iapprove account with a password that only a few people know (preferably in a password vault).