Multi-cloud identity fragmentation is exposing access governance gaps

At a glance

What this is: This is an analysis of how multi-cloud identity sprawl creates fragmented access governance, with the central finding that visibility and de-provisioning break down across platforms.

Why it matters: IAM, IGA, PAM and cloud security teams need this because fragmented identity administration hides toxic access combinations and leaves unmanaged privilege across human and non-human estates.

Context

Multi-cloud identity fragmentation is the governance problem that appears when access decisions, de-provisioning and privilege oversight are split across multiple clouds, identity providers and SaaS platforms. The issue is not cloud adoption itself but the lack of a single control point for who has access to what.

In that model, a missed de-provisioning step in one environment can leave access standing long after the business need ends. The article frames centralised identity management, policy-based access control and privileged identity management as the controls that make cross-platform access governable again.

Key questions

Q: What breaks when identity governance is split across cloud and on-premise systems?

A: The biggest failure is inconsistent control ownership. Teams lose clarity on who revokes access, who validates sessions, and who maintains audit evidence. Federation can still work technically while governance fails operationally, which leaves access paths open longer than intended and makes incident response slower and less certain.

Q: Why do toxic access combinations become harder to detect in multi-cloud environments?

A: They emerge from the combination of permissions across systems, not from any single role. When AWS, identity providers and SaaS apps are governed separately, the risky pattern is distributed across dashboards and access reviews. Detection requires correlated entitlement data, not isolated platform checks.

Q: How should security teams implement just-in-time privileged access in cloud environments?

A: Start with the most sensitive administrative paths, then require approval, session bounds, and automatic expiry for each elevation event. JIT works best when it is paired with central policy, strong logging, and a clear offboarding path for temporary rights. The goal is to make privilege a short-lived state, not a persistent account property.

Q: Should organisations prioritise policy-based access control or role-based access control in multi-cloud governance?

A: Policy-based control should take priority when the goal is consistent governance across heterogeneous platforms. Roles tend to accumulate exceptions and local drift, while policy expresses business intent that can be applied more uniformly. Role models still exist, but they should not be the primary control in fragmented environments.

Technical breakdown

Why identity fragmentation creates toxic combinations

Identity fragmentation means entitlement data is distributed across systems that do not share one authoritative view of users, roles and privileges. That breaks effective segregation of duties analysis because the risky combination often exists only when permissions from several platforms are combined. In practice, a user may look low-risk in one console and high-risk only when cross-platform access is correlated. The control failure is not only stale access, but invisible access relationships across AWS, Oracle Cloud, Entra ID and SaaS. Practical implication: security teams need a consolidated entitlement model before SoD and least-privilege controls can be trusted.

Practical implication: build cross-platform entitlement correlation before relying on SoD or least-privilege reviews.

How policy-based access control changes multi-cloud governance

Policy-based access control, or PBAC, shifts access decisions away from static role assignment and toward business rules that can be applied consistently across environments. That matters in multi-cloud programmes because roles drift quickly when each platform is governed separately. PBAC is most useful when policy intent is centralised and enforcement is mapped to the application, cloud, or identity context that actually issues access. It does not remove the need for lifecycle discipline, but it does make access decisions easier to standardise across heterogeneous platforms. Practical implication: governance teams should express access rules as shared policy, not as platform-specific role sprawl.

Practical implication: standardise access rules as shared policy rather than platform-specific role sprawl.

Why privileged identity management needs a federated view

Privileged identity management becomes harder, not easier, when cloud administrators and platform owners operate in separate control planes. A federated governance layer is needed because always-on admin rights across multiple clouds create a compounded attack surface, especially when no single dashboard shows the full privilege picture. Just-in-time provisioning reduces exposure by constraining elevated access to task duration, but its value depends on clean orchestration and revocation across the whole environment. Without that federation, privileged access may be technically limited in one system and still persistent in another. Practical implication: enforce privileged access as a federated lifecycle, not as isolated platform settings.

Practical implication: govern privileged access as one federated lifecycle, not as separate platform settings.

Threat narrative

Attacker objective: The attacker aims to exploit fractured identity governance to gain durable, cross-platform access that bypasses normal access reviews and privilege boundaries.

1. Entry begins when an administrator or business user remains active in one cloud or SaaS system after access should have been removed, leaving an unlocked path in a fragmented identity estate.
2. Escalation occurs when cross-platform permissions combine into a toxic access condition, allowing actions that no single system’s local view would flag as dangerous.
3. Impact follows when unmanaged privileged or orphaned access is used to perform high-risk business actions or infrastructure changes across environments.

Breaches seen in the wild

• Microsoft Storm-0558 key breach 2023: China-based Storm-0558 used a stolen, never-retired Microsoft signing key to forge tokens and read email at 22 organisations in 2023.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity fragmentation is now an access governance problem, not just an administration inconvenience. When access is split across multiple clouds and SaaS estates, no single control plane sees the full entitlement picture. That means least privilege can be true in one platform and false in the aggregate. The practical conclusion is that governance has to be cross-system by design, or it is incomplete by default.

Cross-platform toxic combination risk: is the right named concept for this problem space. The article describes a user holding enough permissions across separate systems to create a vendor in one and execute a payment in another. That is a governance failure created by distributed visibility, not a single misconfiguration. Practitioners should treat entitlement correlation across domains as a first-class control objective.

Privileged access becomes materially more dangerous when it lacks a federated governance layer. Multi-cloud admin rights are not just broader, they are harder to inventory, review and revoke consistently. JIT reduces the exposure window, but only if the lifecycle is managed across every platform where privilege exists. The implication is that PAM cannot be evaluated only inside one cloud console.

PBAC is most valuable when it replaces role accumulation with policy intent that survives platform boundaries. Static roles scale poorly in multi-cloud environments because each system invites local exceptions and access drift. Policy-based controls help, but only if they are tied to business justification and enforced uniformly. The practitioner takeaway is that access governance should be written once and applied everywhere possible.

Lifecycle governance is the hidden dependency in multi-cloud identity programmes. The article’s de-provisioning example shows that one missed removal can leave a standing door open even when the rest of the estate is clean. That means joiner-mover-leaver controls, access reviews and privileged offboarding have to operate across clouds as one lifecycle. The programme implication is that fragmented identity administration becomes a lifecycle assurance failure, not just an inventory problem.

From our research library:

• Organisations maintain an average of 6 distinct secrets manager instances, creating fragmentation that undermines centralised control, according to the State of Secrets in AppSec.
• Read next: Identity Security Programme Guide

What this signals

Cross-platform entitlement correlation: multi-cloud teams need one correlated view of identities, roles and privileges before SoD and least privilege can be treated as real controls rather than policy language. Fragmentation turns review processes into partial checks, which is why the governance problem appears only when the platforms are analysed together.

Privileged access in fragmented environments needs federation more than breadth. If admin rights can be issued in one cloud and persist in another, the control boundary is already too narrow for the way the estate is actually used.

For practitioners

• Implement cross-platform entitlement correlation Aggregate identities, roles and privileges from clouds, identity providers and SaaS into one view so toxic combinations can be detected before access is granted or retained.
• Replace broad role assignment with policy-driven access Define business-based access rules centrally and map them to each platform so permissions are granted by policy intent rather than accumulated local roles.
• Separate privileged access from standing access Move administrator and infrastructure accounts onto just-in-time elevation so elevated rights exist only for the task window and are revoked automatically afterward.
• Automate de-provisioning across every connected platform Verify that user exit, role change and contractor offboarding events remove access from each cloud and SaaS system, not only the primary identity provider.
• Review toxic combinations as an SoD control Run recurring segregation-of-duties checks across ERP, cloud and identity data so cross-system conflicts are visible before audit or abuse exposes them.

Key takeaways

• Multi-cloud identity sprawl creates governance blind spots because access decisions are distributed across clouds, identity providers and SaaS systems.
• Fragmented entitlement data makes toxic combinations, de-provisioning failures and privilege drift harder to detect and easier to overlook.
• Centralised policy enforcement and federated privileged access management are the practical controls that restore visibility and lifecycle discipline.

Key terms

• Identity Fragmentation: Identity fragmentation is the condition where different parts of an infrastructure estate use separate trust models, credentials, and policy systems. In hybrid environments, this breaks unified governance because access, logging, and revocation no longer line up across cloud, data center, and colocated resources.
• Toxic Risk Combinations: Toxic risk combinations are unsafe interactions between datasets, access permissions, and AI workflows that only become problematic when combined. Individually they may appear harmless, but together they can expose sensitive information, enable re-identification, or create unintended inferences that traditional controls may miss.
• Policy-Based Access Control: Policy-based access control grants or denies access using rules that evaluate context, signals, and identity state at decision time. It is more adaptive than static role assignment, but only if the policy engine receives accurate runtime inputs and can enforce them across systems.
• Just-in-Time Provisioning: Just-in-time provisioning creates an account or entitlement at the moment it is needed, then removes it later. It reduces standing access duration, but it still relies on a static identity or role existing during the access window, which leaves room for misuse if revocation lags.

Deepen your knowledge

NHI governance, identity lifecycle management, and workload identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity security programme, it is worth exploring.