Should organisations prioritise SaaS cleanup before expanding access controls?

Organisations should clean up SaaS sprawl and expand access controls in parallel, but high-risk entitlements should be first in line. If the estate is full of dormant apps, duplicate licenses, and stale permissions, adding more controls later only locks in the existing mess. Start with inventory, then focus on revocation and certification.

Why This Matters for Security Teams

SaaS cleanup is not just housekeeping. When dormant apps, duplicate tenants, and stale service accounts remain in place, every new access control inherits that clutter and creates more review noise. The practical question is sequencing: revoke what should not exist, then tighten what must remain. That approach aligns with the evidence that NHI exposure is already widespread, including the finding in the Ultimate Guide to NHIs that 97% of NHIs carry excessive privileges, which broadens attack paths before teams even add new controls.

This is why parallel work matters. Discovery, certification, and revocation remove false positives from the estate, while access controls such as RBAC, PAM, and JIT reduce future blast radius. If cleanup waits until after a control rollout, the organisation often ends up codifying inherited risk instead of reducing it. Current guidance from the OWASP Non-Human Identity Top 10 and the PCI DSS v4.0 both point toward least privilege, traceability, and periodic review, which are only effective when the inventory is credible. In practice, many security teams discover their entitlement problem only after an access review fails to explain who still uses the app.

How It Works in Practice

The safest sequence is to treat cleanup and control expansion as one programme with two tracks. Track one removes what should not be there: retired SaaS apps, abandoned API keys, overlapping integrations, and inactive accounts. Track two hardens what remains through scoped roles, shorter-lived credentials, certification workflows, and stronger approval gates. The Ultimate Guide to NHIs — Key Challenges and Risks and the 52 NHI Breaches Analysis both show the same pattern: unaudited identities and lingering secrets are recurring entry points, not edge cases.

A practical workflow usually looks like this:

• Build a complete SaaS and NHI inventory, including shadow apps and machine accounts.
• Classify entitlements by risk, then revoke dormant or duplicate access first.
• Use RBAC for stable human-admin tasks, but prefer JIT and PAM for privileged NHI actions.
• Shorten secret lifetime where possible and remove any credential that has no clear owner.
• Run certification on the remaining high-risk entitlements before expanding to lower-risk ones.

That order matters because cleanup improves the quality of every later decision. Without it, teams spend months approving access that should have been removed on day one. The practical standard is evolving, but most mature programmes now treat inventory accuracy as a prerequisite for meaningful control design, especially where secrets are embedded in SaaS automation or CI/CD flows. These controls tend to break down when decentralised business teams can create apps and tokens faster than security can identify ownership, because entitlement sprawl outpaces review capacity.

Common Variations and Edge Cases

Tighter cleanup often increases operational overhead, so organisations have to balance speed of revocation against business disruption. That tradeoff is most visible in customer-facing integrations, legacy SaaS, and shared service accounts where removal can break workflows if ownership is unclear.

There is no universal standard for this yet, but current guidance suggests a risk-based approach: urgent revocation for orphaned secrets, immediate review for privileged integrations, and staged rationalisation for low-impact apps. In regulated environments, PCI DSS v4.0 reinforces the need for scoped access and evidence of periodic review, while Ultimate Guide to NHIs — Standards supports inventory, rotation, and offboarding as baseline hygiene. The key is to avoid treating cleanup as a one-off project; it is a control-enablement step that keeps access governance honest.

Where organisations go wrong is assuming that more controls can compensate for poor estate hygiene. They usually cannot. A well-designed PAM rollout still fails if stale apps keep issuing secrets, and a strict certification cadence still misses risk if the inventory is incomplete. The practical rule is simple: remove the highest-risk clutter first, then broaden controls across the cleaned-up environment. That sequence prevents teams from spending effort protecting identities that should already have been retired.

Related resources from NHI Mgmt Group

• Should organisations prioritise token controls before expanding SaaS access?
• When do NHI access reviews create more value than a one-time cleanup?
• Should organisations prioritise external exposure or internal credential governance first?
• When should organizations review access controls?