Identity governance gaps are widening as SaaS access sprawl grows

At a glance

What this is: This is Okta’s argument that SaaS sprawl is widening identity governance gaps, with orphaned and unmanaged access increasing breach exposure.

Why it matters: It matters because IAM and IGA teams have to govern access across human and non-human estates as SaaS usage expands faster than oversight.

By the numbers:

• Identity-related vulnerabilities continue to be linked to over 77% of breaches, according to Okta.
• 25% of SaaS services remain underutilized and therefore harder to monitor, according to Okta.

Context

Identity governance is the discipline that decides who or what should have access, for how long, and under what review process. When SaaS estates expand faster than governance workflows, visibility breaks before policy does, and orphaned or inactive accounts become persistent exposure points.

The article’s core claim is that this is not just an access problem. It is a lifecycle and compliance problem, because unmanaged SaaS access weakens least privilege, hides anomalous activity, and makes audit evidence harder to trust.

Key questions

Q: What breaks when SaaS access is not tied to lifecycle controls?

A: Access persists after the business need has ended, which means former employees, stale integrations, and unused permissions can still reach data. That breaks offboarding, weakens auditability, and leaves organisations unable to prove that access was removed when the relationship changed. SaaS governance only works when termination closes the identity path, not just the HR record.

Q: Why do underutilized SaaS services increase identity risk?

A: Underutilized services often receive less scrutiny, so dormant accounts, unused roles, and forgotten integrations remain active. Those quiet paths can become attractive targets because they are less visible to monitoring and less likely to be reviewed during normal operations.

Q: How do IAM teams know whether cloud least privilege is actually working?

A: They should look for declining counts of dormant privileges, fewer overprivileged machine identities, and a measurable shift from standing access to task-scoped access. If access reviews keep approving broad roles without evidence of recent use, the programme is documenting risk rather than reducing it.

Q: How should security teams govern access across SaaS sprawl?

A: Security teams should govern SaaS sprawl with one inventory, one policy model, and one review process that covers both human and non-human access. The practical goal is to connect application approval, entitlement review, and revocation to business ownership. Without that linkage, access governance becomes a manual cleanup exercise instead of a control system.

Technical breakdown

How SaaS access sprawl creates unmanaged identity surfaces

SaaS sprawl matters because every new application adds another entitlement set, approval path, and revocation dependency. In practice, access risk grows when provisioning happens faster than inventory, ownership, and recertification. Orphan accounts are especially dangerous because they preserve access after the business need has ended, creating an identity surface that security teams can no longer reliably govern. The governance failure is not the application itself, but the missing relationship between access, ownership, and lifecycle state.

Practical implication: inventory SaaS access paths and tie every account to an owner, business purpose, and expiry state.

Why least privilege fails when SaaS permissions are not actively governed

Least privilege is only real when permissions are reviewed against current job function or machine purpose, not initial provisioning assumptions. In sprawling SaaS environments, roles tend to accumulate, shared access creeps in, and overbroad entitlements become the default because no one is continuously pruning them. That produces a governance debt that is invisible until an audit, an incident, or a privilege review surfaces it. The article frames identity governance as the mechanism that keeps privilege from hardening into exposure.

Practical implication: recertify SaaS entitlements against actual use and remove dormant or excessive access on a fixed cadence.

How governance-focused reporting changes detection and audit readiness

Governance reporting is not just a compliance artifact. It is the operational view that shows whether access requests, approvals, and revocations are actually aligned to policy, and whether anomalies are emerging in the access estate. In a SaaS-heavy environment, reporting needs to expose inactive accounts, unowned entitlements, and exceptions that never closed. Without that reporting layer, teams can have controls on paper while still lacking evidence that access was ever cleaned up.

Practical implication: build reports that surface exceptions, dormant accounts, and approval gaps before auditors or attackers do.

Threat narrative

Attacker objective: The objective is to turn unmanaged SaaS access into durable, low-friction access to sensitive systems and data.

1. Entry occurs when underutilized SaaS services and orphaned accounts remain active, giving an attacker or insider a viable access path.
2. Credential or account abuse follows when unmanaged entitlements provide more access than the current user role should allow.
3. Escalation happens as standing permissions and weak lifecycle control let the actor move from one SaaS application to other connected resources.
4. Impact is unauthorized access to sensitive data and a wider breach surface that is harder to detect because governance data is incomplete.

Breaches seen in the wild

• Okta support system breach 2023: A support service account credential saved in a personal Google profile let attackers take HAR files and hijack five Okta customers' sessions.
• Cloudflare Thanksgiving breach 2023: One service token and three service accounts left unrotated after the Okta breach gave a nation-state attacker access to Cloudflare's Atlassian systems.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity governance is becoming the control plane for SaaS sprawl. When applications proliferate faster than access ownership and review, the programme stops being an entitlement process and becomes a containment problem. That shift matters across human and non-human estates because the same lifecycle weaknesses preserve risk in both. Practitioners should treat SaaS inventory and access governance as one operating model, not separate tasks.

Orphan accounts are not an edge case, they are the predictable residue of weak lifecycle governance. The article’s emphasis on elimination, least privilege, and reporting shows that unmanaged access does not appear by accident. It accumulates where offboarding, recertification, and exception handling are disconnected. The practitioner conclusion is simple: if access cannot be traced to ownership and purpose, it is already outside governance.

Governance-focused reporting is the missing evidence layer in many SaaS programmes. Security teams often have provisioning workflows but lack the reporting needed to prove revocation, detect anomalies, and close exceptions. That gap turns audit readiness into a proxy for operational health. Practitioners should measure whether their reports can actually identify who still has access, why they have it, and whether it should have been removed.

Least privilege only holds when access is continuously re-validated against current business need. The article implies that static entitlement models fail as SaaS estates grow because they do not keep pace with role drift and service sprawl. That is especially relevant where human users, service accounts, and delegated access coexist in the same environment. Practitioners need a single governance view of entitlement age, ownership, and activity.

Identity-related breach exposure is a governance failure before it is a technical one. The 77% breach linkage cited in the article is not a reason to chase more controls in isolation. It is evidence that visibility, lifecycle discipline, and compliance reporting are now core security functions. The practical conclusion is to stop treating identity governance as back-office administration and start treating it as breach prevention.

From our research library:

• Organisations that rely heavily on static credentials reported a 20-percentage-point increase in security incidents compared with those with low reliance, according to the 2026 Infrastructure Identity Survey.
• 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
• Read next: NHI Lifecycle Management Guide

What this signals

Access governance is now the difference between SaaS convenience and SaaS exposure. When entitlement growth is faster than ownership tracking, the programme stops being about granting access and becomes about proving that access should still exist. That is why identity governance has to cover joiner-mover-leaver state, exception handling, and recertification in the same operational view.

Orphan account reduction is a measurable security outcome, not just an administrative cleanup task. If teams cannot show how many inactive accounts were removed, how many exceptions remain open, and how quickly revocations are completed, the governance programme is not producing evidence. The control boundary has to move from initial provisioning to continuous lifecycle management.

For practitioners

• Eliminate orphan and inactive SaaS accounts Build a recurring process that finds unused accounts, confirms ownership, and removes access when the business purpose no longer exists.
• Enforce least privilege across SaaS entitlements Review roles, group memberships, and delegated permissions against current job needs, then shrink access that is broader than required.
• Automate access requests and approvals Use policy-based workflows so every request has an owner, approval record, and traceable justification before access is granted.
• Strengthen governance reporting for audits and anomaly detection Produce reports that show dormant accounts, unresolved exceptions, and revoked access so teams can verify control effectiveness.
• Tie SaaS ownership to lifecycle management Assign each application and each entitlement to a named business or technical owner who is accountable for review and removal decisions.

Key takeaways

• SaaS sprawl creates unmanaged identity surfaces when ownership, approval, and revocation do not keep pace with application growth.
• The article ties identity-related issues to more than 77% of breaches and notes that 25% of SaaS services remain underutilized, which makes visibility gaps harder to ignore.
• The practical response is to link every SaaS account to an owner, enforce least privilege continuously, and use reporting to expose dormant access before it becomes an incident.

Key terms

• Orphaned Account: An orphaned account is an identity that remains active without a clear owner or business purpose. These accounts are dangerous because they often escape review, retain unnecessary access, and provide attackers with low-friction entry points into otherwise governed environments.
• Identity Governance: Identity governance is the set of controls that defines who approves access, who owns it, how it is reviewed, and when it is removed. In practice, it turns identity management from a deployment task into a durable control system that can withstand audits, organisational change, and operational growth.
• Least Privilege: A security principle requiring that every identity, human or non-human, is granted only the minimum permissions necessary to perform its function. Least privilege is the single most effective control for reducing NHI blast radius.
• Access Recertification: Access recertification is the periodic review of user or account permissions to confirm that access is still justified. It is useful, but it is not enough on its own because it reacts after entitlements already exist, which is why lifecycle governance must reduce the volume of exceptions before review time.

Deepen your knowledge

NHI governance, IAM, and identity lifecycle management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.