Compliance gaps in extended access management now expose IAM blind spots

At a glance

What this is: This is a 1Password summary of Omdia’s argument that extended access management is now a compliance problem, because unmanaged access breaks the assumptions behind IAM, auditability, and cyber insurance questionnaires.

Why it matters: It matters because IAM, IGA, PAM, and security architects can no longer treat unmanaged apps and devices as edge cases when auditors and insurers expect evidence across the full access estate.

Context

Extended access management is the governance problem that appears when access is no longer confined to company-managed devices, sanctioned applications, or centrally issued accounts. In that environment, legacy IAM and MDM controls can prove only a partial picture, because they were built for estates IT could fully enumerate and govern.

The compliance issue is therefore not just about policy wording. If unmanaged endpoints, SaaS apps, shadow IT, or third-party access can reach company data, then RBAC, MFA, and audit evidence all become harder to attest with confidence. That turns compliance from a documentation exercise into an identity control problem.

Omdia’s report, as summarized by 1Password, frames this shift as a practical mismatch between older control assumptions and the modern access surface. That mismatch is typical of current enterprise environments, not a fringe case.

Key questions

Q: What breaks when non-human access is left outside IAM controls?

A: Healthcare teams lose visibility into who or what changed data, touched records, or moved through administrative workflows. That creates blind spots in compliance, patient safety, and incident response because the organisation cannot prove whether the access was expected, excessive, or still needed.

Q: Why do auditors and cyber insurers ask similar identity questions?

A: Both are testing whether access is controlled well enough to limit loss, prove accountability, and reduce exposure. If the organisation cannot evidence device governance, third-party access controls, and authentication coverage, it will struggle with both audit readiness and insurance underwriting.

Q: What are the signs that compliance controls are missing unmanaged access?

A: Common signals include incomplete access logs, unclear ownership of third-party accounts, unmanaged devices reaching sensitive apps, and audit questions that cannot be answered without manual exception handling. Those symptoms usually mean the identity programme is only covering the managed core.

Q: Should organisations treat shadow IT access as an identity risk or a compliance risk?

A: Both, but the governance response should start with identity. Shadow IT becomes a compliance problem when it creates access paths that the organisation cannot authenticate, authorize, or evidence consistently across audits, insurers, and internal reviews.

Technical breakdown

Why legacy IAM and MDM stop short in unmanaged estates

Legacy IAM and MDM assume IT can enumerate the devices, apps, and identities in use, then enforce policy from that known perimeter. Extended access management appears when employees choose their own tools, devices, and services, creating access paths that are real but not centrally governed. That matters because compliance checks depend on evidence, and evidence depends on control boundaries. If the access path sits outside managed endpoints or sanctioned applications, then policy enforcement, attestation, and audit trails all fragment across systems the organisation does not fully own.

Practical implication: map where access exists without a managed device, managed app, or owned identity lifecycle before relying on your compliance evidence.

Why auditability breaks when unmanaged access reaches company data

Auditability depends on being able to answer who accessed what, from where, under which control conditions, and with which authentication method. When access comes from unmanaged devices or shadow applications, those questions become harder to answer consistently because the evidence is scattered across IdPs, endpoint tooling, SaaS logs, and third-party systems. RBAC and MFA still matter, but they are not enough if you cannot prove device state, vendor access posture, or session context at the time of access. In practice, the audit problem is an identity provenance problem.

Practical implication: require access records that join identity, device posture, and application context before you treat an audit trail as complete.

How compliance and cyber insurance converge on the same control questions

The article highlights that insurers and auditors ask many of the same questions about access control, third-party vendors, MFA, and role restrictions. That convergence is important because it means the control set is no longer just a governance preference. It becomes a prerequisite for both audit readiness and insurability. In this model, the organisation must show consistent enforcement across managed and unmanaged access paths, not just policy statements on paper. The real issue is whether identity controls can be evidenced in the environments where people actually work.

Practical implication: treat cyber insurance questionnaires as a stress test for your identity governance evidence, not a separate paperwork exercise.

NHI Mgmt Group analysis

Compliance gaps in extended access management are really governance gaps in the access estate. The problem is not that enterprises lack IAM policies, but that those policies were designed for a controlled environment where IT could see and manage every endpoint, app, and vendor connection. Once access extends into SaaS, BYOD, and shadow IT, the compliance model stops being comprehensive. Practitioners should read this as a signal that auditability now depends on coverage across the full access estate, not just the managed core.

Extended access management exposes an identity provenance gap. Compliance asks whether access can be explained after the fact, but unmanaged devices and applications weaken the chain of evidence needed to answer that question. That is why RBAC, MFA, and logging are necessary but insufficient when the device or app itself is outside governance. The implication for the field is that identity assurance has to include proof of control over the access path, not only over the account.

Cyber insurance is becoming an external forcing function for identity governance. The article shows that insurers now ask the same core questions auditors do about third-party access, device control, and authentication. That convergence means identity teams can no longer separate security policy from financial risk transfer. Practitioners should expect access governance to be measured by its ability to satisfy both audit and underwriting evidence demands.

Extended access management is best understood as a control consolidation problem, not a point solution problem. The underlying issue spans access, device trust, application governance, and compliance reporting. Point controls can each solve part of the picture, but the programme fails if no single governance model can explain all of them together. IAM and IGA teams should therefore evaluate whether their current operating model can produce unified evidence across managed and unmanaged access.

Shadow access now changes the compliance baseline for every identity programme. If unmanaged access is allowed to reach sensitive data, then the default assumption that access is visible, reviewable, and enforceable no longer holds. That shifts the burden from exception handling to continuous coverage. The practical conclusion is that compliance design must start with where access escapes governance, then work backward to the identity controls that close that gap.

What this signals

Identity governance now has to cover the unmanaged edge. When employees freely adopt apps and devices, the old boundary between managed and unmanaged access stops being a reliable control line. That means teams need to design for evidence across the whole access path, not just the systems they issue themselves.

Compliance and insurance are converging on the same proof problem. If the organisation cannot demonstrate device governance, third-party access oversight, and consistent authentication, then both audit readiness and underwriting confidence weaken. The practical response is to treat evidence quality as a governance control, not a reporting afterthought.

For practitioners

• Audit unmanaged access paths Inventory SaaS, BYOD, shadow IT, and contractor workflows that can reach company data without passing through a managed device or sanctioned application.
• Test your audit evidence chain Verify that your logs can join identity, device posture, authentication method, and application context for the same access event across IdP and endpoint sources.
• Reconcile insurer and auditor questions Use the questions in cyber insurance assessments to identify gaps in MFA enforcement, RBAC coverage, and third-party access governance.
• Extend governance to unmanaged endpoints Define which access decisions require device compliance signals, vendor oversight, and event logging even when the endpoint is personally owned or outside MDM.

Key takeaways

• Extended access management reveals that compliance failures often begin as visibility failures in identity governance.
• The core issue is not only unmanaged devices and apps, but the loss of evidence needed to prove access was controlled.
• IAM teams should evaluate whether their governance model can explain access across managed and unmanaged environments before auditors or insurers ask.

Key terms

• Extended access management: Extended access management is a control model that covers access beyond traditional employee login, including SaaS, service identities, and AI agents. It tries to unify trust, entitlement, and device context so organisations can govern access wherever work actually happens.
• Auditability: Auditability is the ability to reconstruct who or what acted, what permissions were used, and what data or tools were touched. For AI and NHI governance, it is the minimum evidence needed to investigate incidents, validate controls, and prove that autonomous actions stayed within approved scope.
• Identity Provenance: Identity provenance is the record of how an agent was created, what authority it received, and what actions it performed over time. It turns agent activity into an auditable chain of trust that supports compliance, incident response, and post-event accountability.
• Managed Access Estate: The set of devices, applications, identities, and workflows that an organisation can directly govern through its security stack. When access moves outside that estate, compliance and monitoring controls lose completeness unless alternate evidence is introduced.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.