Identity-first security still breaks down where SaaS resists SSO

At a glance

What this is: This is an analysis of why identity-first security is harder to execute in SaaS-heavy environments, with the key finding that fragmented application identity undermines consistent SSO and governance.

Why it matters: It matters because IAM, IGA, and PAM teams cannot enforce least privilege or zero trust consistently when large parts of the SaaS estate sit outside central identity control.

By the numbers:

• 97% of organizations had zero trust or were planning to put the framework to use in 2022.
• The average organization now uses 130 SaaS apps, creating a large integration burden for identity teams.
• Unixi’s field experience suggests many enterprises now run 150+ SaaS apps.

👉 Read Unixi's analysis of identity-first security and universal SSO for SaaS

Context

Identity-first security is the idea that identity, not the network perimeter, becomes the primary control point for access decisions. That model depends on strong authentication, authorization, and context-aware policy enforcement, which is why SaaS fragmentation becomes a governance problem rather than just an integration inconvenience.

The challenge is practical: many SaaS applications maintain their own identity stores, do not integrate cleanly with SSO, and encourage shadow SaaS when users create accounts outside central oversight. In a perimeterless environment, that leaves identity teams trying to govern access across systems that were never designed to behave like a single control plane.

For practitioners, the question is not whether identity-first security is still valid. It is whether the enterprise can make its SaaS estate participate in the same lifecycle, monitoring, and access review model that identity-first security assumes.

Key questions

Q: How should security teams govern SaaS applications that rely on integrations and shared data?

A: Treat SaaS governance as a combined identity, data, and integration problem. Start with a complete inventory of users, local accounts, OAuth grants, and service connections, then enforce least privilege, periodic access review, and rapid revocation for stale permissions. Continuous monitoring only works when findings trigger concrete entitlement changes.

Q: Why does shadow SaaS weaken identity-first security?

A: Because accounts created outside approved processes bypass joiner-mover-leaver controls, access reviews, and deprovisioning. That leaves the organisation with identities it cannot reliably govern, which undermines least privilege and increases the chance of stale or unowned access persisting unnoticed.

Q: When should organisations prioritise universal SSO over other IAM improvements?

A: When a large share of users still authenticate directly to SaaS apps and the enterprise cannot enforce consistent access policy, visibility, or revocation. In that situation, SSO coverage becomes a prerequisite for dependable governance rather than a usability enhancement.

Q: What is the difference between central identity governance and local SaaS account management?

A: Central governance gives the organisation one policy and one audit trail across applications, while local SaaS account management leaves each app to enforce its own rules. The first supports consistent lifecycle control, the second creates fragmented enforcement and weaker offboarding.

Technical breakdown

Why SaaS identity stores weaken identity-first security

Identity-first security depends on a central identity provider being able to authenticate, authorize, and observe access across the application estate. SaaS platforms often break that assumption by maintaining separate identity stores or by limiting SSO integration, which splits policy enforcement across multiple control planes. That creates inconsistent session assurance, weaker revocation paths, and incomplete logging for access governance. In practice, the identity team loses the ability to treat the SaaS estate as one governed surface.

Practical implication: map which SaaS applications still authenticate outside the enterprise IdP and prioritise them for governance consolidation.

How universal SSO changes the SaaS access model

Universal SSO approaches try to remove the dependency on native SaaS SSO integration by mediating authentication in the browser. The technical value is not the browser extension itself, but the way it re-establishes a central identity control point for applications that would otherwise remain outside it. That can improve policy consistency, session visibility, and user experience across large SaaS estates. The trade-off is that governance now depends on the reliability of the mediation layer and the coverage of the applications it can reach.

Practical implication: verify which SaaS applications are covered by mediated SSO and treat uncovered apps as exceptions requiring separate controls.

Why shadow SaaS creates identity governance debt

Shadow SaaS is not only an access risk. It is a lifecycle problem because accounts created outside approved onboarding and offboarding workflows accumulate without the normal review, entitlement, and deprovisioning logic. Once that happens, IAM, PAM, and access review processes lose completeness, and security teams inherit blind spots that are hard to detect from the IdP alone. The result is identity governance debt: accounts exist, but the organisation no longer has reliable control over why they exist or who still uses them.

Practical implication: reconcile discovered SaaS accounts against joiner-mover-leaver records and revoke orphaned access paths immediately.

NHI Mgmt Group analysis

Identity-first security fails when the control plane is fragmented. The model assumes authentication and authorization can be centred on a shared identity layer, but many SaaS environments still route users through local identity stores or partial SSO coverage. That breaks the premise that access can be governed consistently from one place. Practitioners should treat fragmented application identity as a structural governance failure, not a convenience issue.

Universal SSO is really a response to identity boundary drift. The problem is not just integration effort. The problem is that the enterprise identity boundary no longer matches the application boundary, so access control, monitoring, and revocation become uneven across the estate. The practitioner takeaway is to measure where the identity boundary has already drifted out of alignment with the SaaS estate.

Shadow SaaS is lifecycle debt, not just shadow IT. When users create accounts outside approved processes, those identities fall outside standard joiner-mover-leaver and access review workflows. That means the enterprise loses visibility into who owns the account, how it was provisioned, and when it should be removed. The practical conclusion is that SaaS discovery and lifecycle governance must be treated as one problem.

Identity-first programmes now have to cover both human and machine access patterns. The same fragmentation that weakens SaaS user governance also weakens service and application identity governance when local credentials bypass the central control plane. That is why mature IAM teams are moving toward unified lifecycle oversight across all identity types, not just users.

From our research:

• 1 in 4 organisations are already investing in dedicated NHI security capabilities, with an additional 60% planning to do so within the next twelve months, according to The State of Non-Human Identity Security.
• 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human IAM efforts, according to The 2024 Non-Human Identity Security Report.
• For a practical lifecycle lens, the Ultimate Guide to NHIs explains how discovery, rotation, and offboarding fit into one governance model.

What this signals

Identity-first programmes will keep stalling until SaaS exceptions are measured as control debt. The useful metric is not whether the organisation has a formal identity strategy, but how many applications still require local credentials, separate account stores, or manual offboarding. When those exceptions accumulate, zero trust becomes selective rather than universal. With 1 in 4 organisations already investing in dedicated NHI security capabilities, the governance conversation is moving from concept to operational coverage.

SaaS access sprawl is now a governance signal, not just an IT inventory problem. If the enterprise cannot enumerate where accounts are created, how they are authenticated, and when they are removed, identity assurance will remain partial. That is especially true when users can create shadow accounts faster than the IAM team can reconcile them. The practical response is to treat discovery, review, and offboarding as one lifecycle workflow.

The next phase of identity-first security will reward organisations that can collapse fragmented SaaS identity into a governed access model across human and non-human accounts. That requires one control story for authentication, one for lifecycle, and one for exception handling, rather than separate processes that never fully converge.

For practitioners

• Map SaaS applications that bypass central SSO Build an inventory of SaaS apps that authenticate outside the enterprise IdP, then classify them by business criticality, data sensitivity, and ability to support central policy enforcement.
• Treat shadow SaaS as an identity lifecycle issue Reconcile discovered SaaS accounts against approved onboarding records, then remove orphaned access and document where local account creation bypassed governance.
• Prioritise high-risk SaaS for centralised access control Focus first on applications holding sensitive data or privileged workflows, especially where local identity stores prevent consistent MFA, logging, and revocation.
• Measure where SSO coverage is incomplete Track the percentage of SaaS applications covered by SSO, the number of exceptions still using local credentials, and the time required to revoke access across both paths.

Key takeaways

• Identity-first security is only as strong as the SaaS applications it can bring under central control.
• Shadow SaaS and local identity stores create lifecycle blind spots that weaken SSO, access review, and revocation.
• Practitioners should measure SSO coverage and identity exceptions as governance debt, not just integration backlog.

Key terms

• Identity-first security: Identity-first security is an approach that treats identity as the primary control plane for managing risk. Instead of relying mainly on network or endpoint boundaries, it uses identity context to decide what can happen, when it can happen, and under what conditions. That model is especially relevant where privileges move across human, non-human, and agentic actors.
• Shadow SaaS: Shadow SaaS is the set of unauthorised or unreviewed software-as-a-service tools used outside central security governance. These applications often bypass normal identity controls, making them difficult to inventory, monitor, and harden against credential-based abuse.
• Universal SSO: An SSO approach designed to extend central authentication coverage to applications that do not natively integrate with the identity provider. Its value is governance consistency, not convenience, because it helps bring disparate SaaS access paths back under one control model.
• Identity Governance Execution Debt: The accumulation of hidden operational gaps when identity controls depend on manual follow-through, stale data, or scattered evidence. It appears as a working process on paper, but it erodes control reliability, audit readiness, and the ability to prove outcomes at scale.

What's in the full article

Unixi's full analysis covers the operational detail this post intentionally leaves for the source:

• Browser-extension authentication flow and how it mediates SaaS logins without native IdP integration
• Central SaaS management capabilities for admins who need an application-by-application rollout plan
• Examples of how the approach addresses shadow SaaS and password reuse across the estate
• The vendor's description of universal MFA support and centralized visibility across SaaS apps

👉 Unixi's full article covers the SaaS coverage model, browser-based authentication flow, and centralized control approach.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.