SaaS access governance is failing beyond SSO coverage

At a glance

What this is: This analysis says SaaS governance fails when IT can only see and control the apps already inside SSO, leaving shadow IT, unmanaged offboarding, and risky OAuth access outside oversight.

Why it matters: IAM and IGA teams need to treat SaaS as a lifecycle problem across sanctioned and unsanctioned apps, or access reviews and offboarding will miss the very accounts most likely to persist.

Context

SaaS access governance is the discipline of discovering, approving, reviewing, and removing access across cloud applications, whether or not those apps are protected by SSO. In this article, the core problem is that many organisations still treat SSO coverage as the control boundary even though employees are using apps IT never approved.

That boundary fails because SaaS usage now spans sanctioned apps, shadow IT, and third-party integrations that can outlive the user or the business need. The article also points to incomplete offboarding, inconsistent SCIM behaviour, and risky OAuth tokens as proof that lifecycle control has to extend beyond federation alone.

Key questions

Q: What breaks when SaaS apps are used outside SSO and central IAM?

A: The main failure is lifecycle control. If an app is not tied to SSO or the identity provider, offboarding, recertification, and access logging may never reach it. That leaves active accounts, orphaned licenses, and audit gaps even when the business believes access was removed.

Q: Why do shadow IT apps create renewal and compliance risk?

A: Shadow IT bypasses approved inventory and review processes, which means the organisation may renew an app it cannot fully account for. That creates spend waste, weakens control over access and contracts, and can leave audit gaps if the app handles regulated data or business workflows.

Q: How can organisations tell whether SaaS access governance is actually working?

A: They should look for three signals: low numbers of orphaned accounts, consistent entitlement recertification, and rapid revocation when users change roles or leave. If access remains valid across apps after a lifecycle event, governance is not working even if dashboards look complete.

Q: What should IAM teams prioritise when SaaS access is fragmented?

A: IAM teams should prioritise continuous discovery first, because discovery determines what can be governed. After that, they should focus on offboarding coverage, OAuth consent review, and the apps that cannot be federated so the programme reflects actual usage rather than the limited view inside SSO.

Technical breakdown

Why SSO coverage is not the same as SaaS governance

SSO centralises authentication, but it does not create an inventory of every app in use, nor does it automatically govern what happens after access is granted. If users can sign up directly for cloud services, IT may never see the account until audit, incident response, or renewal time. That creates a structural blind spot: identity is governed at the login layer while the application lifecycle lives elsewhere. In practice, this means SaaS governance depends on continuous discovery, application ownership, and lifecycle controls that extend to apps outside the federation perimeter.

Practical implication: Treat SSO as one control plane, not the whole control plane, and build discovery around the apps that never enter federation.

How shadow IT breaks the app inventory model

Shadow IT is not just unsanctioned software use. It is a failure of inventory, approval, and offboarding working together. When employees adopt SaaS tools without IT knowledge, the organisation loses the ability to classify the app, assign an owner, and decide whether it should be federated, monitored, or blocked. That also means access reviews become incomplete, because reviewers can only attest to what they know exists. The governance gap widens when web apps and locally hosted tools are both present, since control coverage varies by deployment model and purchasing channel.

Practical implication: Build a discovery process that maps unsanctioned usage back into inventory, ownership, and lifecycle decisions.

Why OAuth tokens and SCIM can still leave access behind

Federation and provisioning integrations are only as reliable as their implementation across each vendor. SCIM can automate lifecycle events, but the article notes that its effectiveness varies by vendor, which means deprovisioning may not fully remove access everywhere it was granted. OAuth introduces a different problem: a token can keep third-party access alive even after the user no longer needs the app. That is why SaaS governance has to manage not just accounts, but connected authorisations, provisioning links, and the residual access paths that persist after offboarding.

Practical implication: Review OAuth grants and SCIM coverage as distinct control surfaces, not as proof that access has been fully removed.

Threat narrative

Attacker objective: The practical objective is to retain or exploit unmanaged SaaS access paths long enough to preserve data access, persistence, or business disruption without going through approved controls.

1. Entry begins when employees download or adopt SaaS applications without IT approval, creating an access surface the organisation never explicitly governed.
2. Credential and authorisation exposure follow when sanctioned apps are outside SSO coverage and third-party OAuth tokens preserve access beyond the original user intent.
3. Impact appears as wasted spend, unsanctioned access, incomplete offboarding, and compliance failures because access remains active in places lifecycle controls do not reach.

Breaches seen in the wild

• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
• Klue OAuth Supply Chain Breach: OAuth tokens compromised in Klue integration breach affecting 700+ organisations via Salesforce data access chain.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

SSO has become a boundary assumption, not a governance strategy: The article shows that many organisations still equate federated login with control, even though a large share of SaaS activity happens outside that boundary. That assumption fails because discovery, approval, and offboarding do not end at authentication. The practitioner conclusion is that SaaS governance has to be measured by lifecycle coverage, not by SSO penetration alone.

Shadow IT is a lifecycle failure, not just a procurement problem: When users adopt apps without IT knowledge, the organisation loses the ability to assign ownership, enforce reviews, and verify deprovisioning. That is why the real risk is not only unsanctioned software, but unmanaged identity state across sanctioned and unsanctioned tools. The practitioner conclusion is that inventory, access review, and offboarding need to be designed as one operating model.

Residual access is the hidden control gap in SaaS environments: OAuth grants, inconsistent SCIM behaviour, and non-SSO apps leave access behind even after an employee leaves or a tool is no longer needed. Access removal without application reach: the offboarding model was designed for systems that all respond to the same lifecycle events, and that assumption fails when connected apps preserve authorisation independently. The practitioner conclusion is that access revocation must include the authorisation paths, not just the primary account.

SaaS governance is converging with NHI governance in practice: Once you follow the access path into OAuth tokens, app-to-app integrations, and non-SSO managed services, the problem looks less like traditional user access and more like non-human entitlement control. That does not make every SaaS issue an NHI issue, but it does mean the same lifecycle discipline is required across users, tokens, and connected services. The practitioner conclusion is that IAM, IGA, and NHI owners should coordinate on one shared inventory and review model.

Continuous discovery is now a control requirement, not a visibility nice-to-have: The article’s central lesson is that you cannot govern what you cannot see, and you cannot offboard what you never discovered. That makes SaaS discovery the leading indicator for the rest of the programme. The practitioner conclusion is to treat app discovery as the prerequisite control that determines whether any downstream governance can actually work.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: NHI Lifecycle Management Guide

What this signals

Access-trust debt: when organisations measure governance by SSO coverage alone, they accumulate invisible access that survives onboarding, role change, and offboarding. That debt shows up later as audit exceptions, stale app access, and cleanup work that is always more expensive than discovery would have been.

The practical shift for IAM programmes is to treat SaaS discovery as a control, not a reporting exercise. Once app inventory is incomplete, access reviews and offboarding become best-effort processes rather than enforceable governance.

For practitioners

• Map SaaS inventory beyond SSO coverage Build a living inventory that includes federated apps, direct sign-ups, web-based tools, and locally hosted software used for work. Tie each app to an owner, an approval state, and a lifecycle path so shadow IT becomes governable instead of invisible.
• Review OAuth grants as access paths Inventory third-party OAuth consents separately from user accounts and federation settings. Revoke risky grants where the token still permits access after the business need has ended, especially for apps that sit outside SSO.
• Extend offboarding to non-SSO apps Make employee exit and role-change workflows trigger revocation across every connected application, not only the identity provider. Verify that provisioning and deprovisioning actually complete in each SaaS tenant rather than assuming SCIM or SSO handled it.
• Measure access reviews against discovered reality Compare review coverage to the full set of apps in use, not just the applications already in the SSO catalog. If a tool is active but not included in review and offboarding processes, it is outside governance even if it appears low risk.

Key takeaways

• SaaS governance fails when identity teams can only manage the apps that have already been federated, because the rest of the estate stays outside review and revocation.
• The article points to shadow IT, inconsistent SCIM behaviour, and risky OAuth access as the main reasons access survives beyond its intended lifecycle.
• Continuous discovery, complete offboarding, and consent management are the control points that determine whether SaaS access is actually under governance.

Key terms

• Shadow IT: Shadow IT is the use of applications or services outside formal enterprise approval or visibility. In SaaS environments, it often includes department-purchased tools and unsanctioned integrations that create hidden identity, data, and access paths the security team cannot readily govern.
• SaaS Lifecycle Governance: SaaS lifecycle governance is the set of controls that manage applications from onboarding through access assignment, renewal, and decommissioning. It matters because the security value of SaaS management depends on whether the organisation can prove ownership, revoke access, and retire unused tools on demand.
• OAuth Token: A short-lived access credential issued by an OAuth 2.0 authorisation server granting an NHI scoped access to specific resources for a defined period. Preferred over static API keys because their short lifetime limits the exploitation window if intercepted.
• SCIM Provisioning: SCIM provisioning is a standardized way to sync identity information between systems. It helps automate account creation, updates, and removal across connected applications. Its main value is interoperability, but it still depends on accurate upstream data and governance over what access should actually be issued.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.