How should organisations reduce identity sprawl without creating new user friction?

The most effective approach is to centralize access around single sign-on, then reinforce it with MFA, conditional access, and a modern password manager. That combination reduces the number of separate identities users create, limits credential reuse, and preserves a simpler login experience. Security teams should target unnecessary identity sprawl first, because that is where attack surface and user confusion grow fastest.

Why identity sprawl becomes a user-experience problem

identity sprawl usually starts when employees and contractors accumulate too many separate logins across apps, clouds, and legacy systems. The friction is not just cognitive load. Every extra account invites password reuse, reset fatigue, shadow access paths, and more support tickets. The practical goal is to reduce the number of places users must authenticate without weakening the controls that keep access bounded.

Single sign-on helps because it lets one trusted login front multiple services, while MFA and conditional access keep that convenience from becoming a soft target. A modern password manager also matters because it reduces the need for users to invent and recycle credentials across systems. When those three controls work together, the organisation simplifies day-to-day access without creating a weaker authentication pattern.

A useful way to think about the problem is that user friction and identity sprawl often rise together, but they are not solved by the same shortcut. Adding more passwords, more manual approvals, or more exceptions usually increases both. The better pattern is to centralise authentication and then make access decisions more adaptive, so users see fewer prompts while the organisation still distinguishes between normal and higher-risk access.

How to shrink the identity surface without adding friction

The first reduction step is usually consolidation. If users still need separate accounts for the same person in multiple systems, the identity layer is already carrying unnecessary complexity. Centralised access makes account governance easier too, because provisioning, deprovisioning, and review happen through fewer control points. That is where identity sprawl and visibility gaps tend to show up most clearly, even when the immediate problem looks like a login experience issue.

From there, the control objective is to reduce repeated authentication events, not to remove accountability. SSO lowers the number of credentials a user must manage, MFA reduces the chance that one stolen password is enough, and conditional access helps the organisation ask for stronger proof only when the context warrants it. That balance is the key to preserving usability while still limiting the blast radius of a compromised account.

The second reduction step is credential hygiene. A password manager is not just a convenience tool, it is a way to prevent users from creating their own workaround identity system through reused or stored passwords in insecure places. The same logic appears in OWASP Non-Human Identity Top 10 and NHIMG’s standards overview: fewer unmanaged credentials mean fewer places for drift, reuse, and accidental exposure to accumulate.

What good looks like in practice

Good practice is not “one login for everything” in the abstract. It is a controlled access model where users have one primary identity, strong authentication, and a small number of clearly justified exceptions. The identity team should be able to explain why any second or third account exists, who owns it, and how it will be retired. If that answer is unclear, the organisation has not reduced sprawl, it has only hidden it behind a better front end.

At scale, the main measurement is not just the number of accounts. It is whether the organisation is shrinking duplicate identities, reducing password reset volume, lowering help desk dependency, and keeping access reviews manageable. Those signals show whether the control design is actually reducing friction or just moving it from the user to the operations team.

One practical check is whether access still works cleanly when a user changes role, device, or location. If the answer is no, users will create their own bypasses. Conditional access and centralised provisioning should make the secure path the easiest path, not the hardest one.

Risk and Threat Considerations

Identity sprawl increases the chance of orphaned accounts, stale permissions, and credential reuse, all of which widen the attack surface. The threat is not only direct compromise. It is also the slow build-up of unmanaged access paths that make detection, offboarding, and privilege containment harder over time.

Failure mechanism: Users accumulate parallel identities when access is fragmented across apps and teams, then reuse weak or familiar credentials to cope with the complexity. Attackers benefit because one compromised login can unlock more than one system, and defenders lose visibility into which identities still matter.

Impact: A breach becomes more likely to spread across accounts and services, offboarding becomes unreliable, and the organisation pays more in support effort, audit effort, and incident response time than it would have spent on simpler identity design.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5 provides the primary governance reference for this topic.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	IA-2 — Identification and Authentication (Organizational Users)	Centralized user login and MFA directly depend on organizational authentication controls.
	IA-5 — Authenticator Management	Password managers and reduced credential reuse map to managing authenticators across the lifecycle.
	AC-2 — Account Management	Identity sprawl is an account lifecycle problem involving provisioning, review, and deprovisioning.
Recommendation — Enforce strong centralized authentication for workforce identities and reduce duplicate login paths. Manage authenticators centrally and rotate or revoke credentials that support duplicate identities. Inventory, approve, review, and remove unnecessary accounts to shrink the identity surface.

Practitioner Guidance

What to prioritise: Start by removing duplicate user identities and legacy login paths before tuning conditional access rules. If a user still needs multiple accounts for the same job, policy complexity will not compensate for the underlying sprawl.

Decision rule: If a system can join the central identity plane, make that the default. Keep exceptions only for systems with a documented technical or regulatory constraint, and require a clear retirement plan for every exception.

What to verify: Confirm that SSO coverage, MFA enrollment, password-manager adoption, and deprovisioning workflows are measured together. A high MFA rate alone does not mean identity sprawl is under control if shadow accounts remain active.

Practitioner takeaway: The best friction reduction strategy is to make the secure login path feel normal. If users need workarounds to get work done, the organisation has not simplified access, it has redistributed the risk.