ConductorOne alternatives expose the limits of SSO-led IGA

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Zluri's blog post: SSO-led IGA can only govern what SSO already knows, leaving shadow IT, stale review campaigns, and unmonitored privilege accumulation outside the control plane.

Why it matters: For IAM and IGA teams, the issue is whether governance is truly covering the full access surface across NHI, SaaS, and human lifecycle events, or only certifying a partial inventory.

Context

The core governance problem is not whether an IGA platform can certify access, but whether it can see the whole access surface before the review begins. In environments where employees, service accounts, AI agents, and informal SaaS access all coexist, SSO-only discovery creates blind spots that certification workflows cannot repair after the fact.

Zluri frames ConductorOne’s limits as structural rather than operational: if discovery starts with SSO, then anything outside SSO is invisible to downstream offboarding, review, and SoD logic. That makes the article a useful case study in how identity governance breaks when discovery scope is narrower than the actual application estate.

Key questions

Q: What breaks when access governance stops at SSO-connected apps?

A: Coverage breaks first, then accountability. Access reviews and lifecycle controls can look complete while legacy systems, shadow IT, and niche SaaS still hold unmanaged entitlements. That leaves orphaned access, inconsistent evidence, and weak revocation assurance across the long tail of applications that most IAM programmes do not govern well.

Q: Why do stale HR and IdP updates weaken access reviews?

A: Because reviewers certify a snapshot, not the current access state. If role changes or terminations have not synchronised into the review campaign, the output may be cleanly documented but operationally inaccurate. That creates compliance evidence without real-time governance.

Q: What are the signs that an IGA programme is missing privilege drift?

A: Frequent mover events, temporary access that becomes permanent, and access reviews that keep finding the same issues are strong indicators. If risk only appears during certification, the programme is probably not seeing accumulation between cycles.

Q: How should teams govern shadow IT discovered through OAuth-connected apps?

A: Treat it as an access governance issue, not only a software inventory issue. Identify which users connected the app, what data or permissions it can reach, who owns the business need, and whether the app is already covered by approved lifecycle and review processes. Then decide whether to sanction, restrict, or remove it.

Technical breakdown

Why SSO-dependent discovery creates a governance ceiling

SSO-dependent discovery only finds applications that already passed through the identity provider, so the platform’s inventory is bounded by prior registration. In practice, that means shadow IT, personal credential use, direct API access, and informal tool sharing can remain outside the governed set. The technical problem is not simply missing data. It is that every downstream control, including reviews and offboarding, inherits the same incomplete system of record. Once discovery is partial, governance becomes partial by design.

Practical implication: evaluate whether discovery can find apps and access paths that never touched SSO, not just whether the review workflow is polished.

Why stale identity data undermines access reviews

Access reviews depend on the accuracy of the identity and HR data at the moment certification runs. If role changes, terminations, or account status updates lag behind reality, reviewers certify a snapshot rather than the current access state. That weakens the control even when the workflow is formally completed. The issue is temporal integrity: the review is not wrong because it exists, but because the underlying state it certifies is already out of date.

Practical implication: measure sync latency between HRMS, IdP, and review campaigns before trusting certification as evidence of governance coverage.

Why continuous posture monitoring matters between certification cycles

Point-in-time IGA assumes risk appears and is resolved during scheduled campaigns. In reality, privilege creep accumulates continuously through mover events, temporary access, and informal permission grants. A continuous posture layer changes the control model from episodic review to ongoing detection of over-privilege and dormant access. That is especially important in mixed estates where SaaS, NHI, and human access patterns drift at different speeds. Without continuous monitoring, the next review is always late to the problem.

Practical implication: look for monitoring that flags privilege drift as it emerges, not only during quarterly or annual certification runs.

NHI Mgmt Group analysis

SSO-first discovery creates an identity visibility debt: the governance model only knows what the IdP has already recorded, so every unknown app or access path becomes unmanaged by default. That is not a tooling inconvenience. It is a structural limit on what the programme can certify, revoke, or prove to auditors. The practitioner conclusion is simple: if discovery starts too late, governance starts too late.

Access reviews are only as defensible as the data freshness behind them: when HRMS and IdP updates lag, certification becomes a compliance exercise over stale truth. The control may still generate evidence, but it no longer demonstrates current-state governance. The implication for practitioners is that review cadence alone cannot compensate for delayed identity synchronisation.

Identity blast radius: the real issue is not how many workflows a platform can run, but how much of the live access surface those workflows can actually reach. Shadow apps, informal sharing, and direct API access expand blast radius beyond the scope of traditional IGA inventories. Practitioners should treat discovery coverage as a control boundary, not a feature checklist.

Continuous posture monitoring is the missing control plane for privilege drift: point-in-time governance assumes access changes are discrete and reviewable in batches, but mover events and informal permission grants accumulate continuously. The article shows why certification cannot be the only control for environments where access mutates between campaigns. The practitioner conclusion is to govern drift as an always-on state, not a periodic exception.

From our research library:

• Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
• Read next: Ultimate Guide to NHIs — Key Challenges and Risks

What this signals

Identity blast radius: the useful unit of analysis is no longer the certified app list, but the broader set of access paths that can create governance exposure outside SSO. When discovery stops at the IdP, blast radius grows in the blind spot rather than in the dashboard, and the programme loses provable control over what users can actually reach.

Platforms that cannot reconcile discovery, review freshness, and ongoing posture drift will keep producing governance artefacts while missing operational reality. For practitioners, the next phase of IGA is less about better paperwork and more about better boundary definition: what is visible, what is revocable, and what changes between review cycles.

For practitioners

• Map the full access surface beyond SSO Inventory apps discovered through finance systems, HRMS, MDM, browser activity, and direct integrations so governance is not limited to what the IdP already knows.
• Validate offboarding against actual discovered access Compare leaver workflows against real app usage and account data, not role templates, so shadow apps and manually shared access are revoked.
• Shorten review data latency Check how long HRMS and IdP changes take to reach certification workflows, and flag any review process that runs on stale identity state.
• Add continuous posture signals between campaigns Use ongoing detection for over-privilege, dormant accounts, and permission creep so governance does not depend on the next scheduled certification.

Key takeaways

• SSO-led IGA can certify only the access it can already see, which leaves shadow IT and direct access paths outside governance.
• Stale identity data weakens access reviews because reviewers certify yesterday's state, not the current one.
• Continuous posture monitoring matters because privilege creep and mover-event risk accumulate between certification cycles.

Key terms

• SSO-dependent discovery: A discovery model that only inventories applications and access paths already visible through single sign-on. It is useful for known SaaS, but it systematically misses shadow IT, direct API use, and informal access that never touched the identity provider.
• Identity Security Posture Management: Identity security posture management is the continuous assessment of identity configuration, privilege, and exposure across an environment. It focuses on drift, overprivilege, and control gaps so teams can see where IAM, PAM, and NHI governance are failing before those gaps become incidents.
• Shadow IT: Shadow IT is the use of applications or services outside formal enterprise approval or visibility. In SaaS environments, it often includes department-purchased tools and unsanctioned integrations that create hidden identity, data, and access paths the security team cannot readily govern.
• Privilege Drift: Privilege drift is the gradual gap between the permissions an identity was meant to have and the permissions it actually retains. In AI agent environments, drift grows quickly because roles are reused, tasks change, and lifecycle reviews often lag behind deployment velocity.

Deepen your knowledge

NHI governance, identity lifecycle, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or IGA programme, it is worth exploring.