What breaks when organisations rely on SSO and password managers as their main identity controls?

The control model breaks when major parts of the application estate sit outside federation and the vault only stores secrets instead of enforcing policy. Teams lose visibility, cannot prove revocation at the target app, and often miss shared or residual access. That leaves the organisation with better convenience, but not better governance.

Why This Matters for Security Teams

SSO and password managers solve convenience problems, but they do not automatically solve identity governance. When they are treated as the primary control plane, teams often assume federation equals control and vaulting equals revocation. That assumption fails whenever apps sit outside SSO, service accounts persist, or shared credentials survive after a user change. The result is weaker assurance, not stronger security, even if login friction drops.

NHI Management Group sees this pattern repeatedly in the same places discussed in the Top 10 NHI Issues and the Ultimate Guide to NHIs: control breaks at the edges of the estate, where vaulting stores secrets but does not enforce policy at the target application. That is why security teams need to separate credential storage from identity governance and from authorization enforcement. Guidance from the NIST Cybersecurity Framework 2.0 is clear that identity controls must support ongoing access assurance, not just initial authentication. In practice, many security teams discover this only after a former employee, contractor, or shadow integration still has a working path into a system that SSO never covered.

How It Works in Practice

The failure mode usually starts with a split control model. Human users authenticate through SSO, while application passwords, API keys, and service credentials live in a vault. That looks centralized, but a vault is not an enforcement layer. It can reduce exposure of secrets, yet it does not prove whether the downstream app accepted revocation, whether access was inherited through a group, or whether a cloned credential was already copied elsewhere.

In mature environments, effective governance requires three separate functions:

• Authentication through federation or strong identity proofing
• Authorization at the target application, not just in the IdP
• Lifecycle control for secrets and non-human identities, including rotation, revocation, and owner assignment

That distinction matters because SSO coverage is rarely universal. Legacy SaaS, internal admin consoles, build pipelines, and machine-to-machine integrations often bypass federation entirely. Password managers can help reduce reuse, but they do not tell security teams whether an account is shared, whether a token was copied into code, or whether access continues after role changes. The better control pattern is to pair vaulting with continuous inventory, app-level enforcement, and explicit lifecycle management as described in NHIMG research such as the NHI Lifecycle Management Guide. For secrets-specific exposure trends, the State of Secrets in AppSec shows how fragmentation and delayed remediation undermine confidence in centralized tooling.

Best practice is to treat SSO as one input to access control, not the control itself, and to require revocation checks at the application boundary wherever possible. These controls tend to break down in hybrid estates with unmanaged SaaS and long-lived service credentials because the target systems, not the vault, ultimately decide whether access still exists.

Common Variations and Edge Cases

Tighter identity control often increases operational overhead, requiring organisations to balance convenience against coverage. That tradeoff is especially visible when teams inherit older systems or developer-owned tooling that was never designed for federation. Current guidance suggests that there is no universal standard for replacing every password with SSO, because some environments still rely on local accounts, break-glass access, or embedded service credentials that cannot be removed without redesign.

The most common edge cases are shared admin accounts, third-party integrations, and automation jobs. A password manager may reduce password reuse, but it does not solve accountability if several people can pull the same credential. Likewise, federation does not help when an app supports SSO for users but still depends on static API keys for backend actions. In those cases, organisations need compensating controls such as privileged access management, short-lived credentials, and clear ownership for every secret. NHIMG’s 52 NHI Breaches Analysis is a useful reminder that incidents often begin with overlooked non-human access rather than stolen human passwords.

The practical rule is simple: if a control cannot prove who has access, where that access exists, and how fast it is removed, it is only part of the answer. In real environments, the gap is usually found not in the vault itself, but in the unmanaged systems that never depended on it.

Related resources from NHI Mgmt Group

• Should organisations rely on SSO and MFA as their main identity controls?
• What breaks when organisations rely on password vaults for every privileged identity?
• What breaks when organisations rely only on native AI safety controls?
• What breaks when organisations rely on spreadsheets for machine identity management?