SaaS sprawl and shadow AI expose unmanaged access gaps

At a glance

What this is: NHI Mgmt Group's analysis, drawing on 1Password's event briefing: SaaS sprawl, shadow AI, and apps outside SSO are framed as an access governance problem that manual onboarding and offboarding cannot keep up with.

Why it matters: It matters because IAM teams need lifecycle controls that can surface unmanaged apps, review employee access, and reclaim licences before unapproved tools become persistent governance blind spots.

Context

SaaS sprawl becomes an identity governance problem when applications sit outside SSO and therefore outside normal oversight. In that state, access is adopted ad hoc, reviewed inconsistently, and revoked through manual checks that rarely match the pace of employee tool use.

Shadow AI and shadow SaaS are not just inventory issues. They create unmanaged access paths, unused licences, and control gaps across onboarding, offboarding, access review, and spend governance, which is why lifecycle control is the real issue rather than discovery alone.

Key questions

Q: What breaks when SaaS apps are used outside SSO and central IAM?

A: The main failure is lifecycle control. If an app is not tied to SSO or the identity provider, offboarding, recertification, and access logging may never reach it. That leaves active accounts, orphaned licenses, and audit gaps even when the business believes access was removed.

Q: Why does shadow SaaS create governance risk even when CASB is deployed?

A: Shadow SaaS creates risk because a CASB can only enforce policy on services it can see and classify. Unapproved apps, browser-based access, and direct connections can escape network-centric inspection, which leaves access scope and data movement outside the governance model. Visibility gaps become control gaps.

Q: What happens when SaaS access reviews and offboarding are still manual?

A: Manual reviews and offboarding create delay, inconsistency, and avoidable security exposure. Departing users may keep access longer than they should, reviewers may miss stale permissions, and audit evidence becomes harder to assemble. As SaaS portfolios grow, these tasks also consume time that IT could spend on higher-value governance, planning, and stakeholder support.

Q: When should organisations treat unapproved AI tools as a formal IAM issue?

A: They should treat them as formal IAM issues as soon as employees can use them without central approval, review, or offboarding. At that point, the tool is part of the access estate even if procurement never sanctioned it. Governance has to follow usage, not just purchase records.

Background and context

Why apps outside SSO become unmanaged access

When an application is not routed through SSO, it often bypasses the controls that give IAM teams central visibility into who can access what. That means onboarding, offboarding, and access review all move into local admin consoles, spreadsheets, or ticket queues. The security problem is not simply that the app is unknown. It is that the access decision and the removal decision are no longer tied to the same governance process, so entitlement drift becomes normal rather than exceptional.

Practical implication: treat apps outside SSO as governance exceptions that need explicit ownership and lifecycle tracking.

How shadow AI changes SaaS lifecycle control

Shadow AI turns SaaS governance into a moving target because employees can adopt tools faster than central teams can approve or catalogue them. That matters because access governance is not only about initial permissioning. It is also about knowing whether a tool remains in use, whether the user still needs it, and whether licence and access removal happen together. In practice, unmanaged AI tools create a second parallel estate of access that sits outside procurement, identity review, and spend control.

Practical implication: extend SaaS lifecycle workflows to cover unapproved AI tools as first-class governed applications.

Why manual offboarding fails at SaaS scale

Manual offboarding depends on people remembering which apps were approved, who used them, and how access was granted in the first place. That model breaks when app adoption is frequent and decentralised. The control failure is timing: by the time a team finds the app, the user may have moved roles, left the company, or accumulated several other tools with similar unmanaged access paths. At that point, offboarding becomes partial, reactive, and expensive.

Practical implication: automate access review, offboarding, and licence reclamation so removal decisions keep pace with usage.

NHI Mgmt Group analysis

SaaS sprawl is now an identity governance problem, not a software inventory problem. The article shows that once applications sit outside SSO, the governance model loses the normal control plane for onboarding, review, and revocation. That means the real issue is not count of apps, but whether access can still be tied to an accountable lifecycle. Practitioners should treat unmanaged SaaS as a lifecycle failure mode, not a discovery backlog.

Shadow AI creates a second, faster-moving application estate that standard IAM reviews were not designed to see. Employees can adopt unapproved AI tools without central approval, which means the entitlement set grows outside procurement and access governance at the same time. That pattern widens the gap between who has access and who can actually explain it. The named concept here is lifecycle blind spots: tools that remain usable after governance has lost sight of them.

The governance failure is sequential, not isolated. Discovery, access review, onboarding, offboarding, and licence reclamation have to work together because weak performance in any one of them leaves the rest incomplete. 1Password's framing underscores that teams cannot rely on manual checklists once app adoption becomes user-driven. The implication is that access governance for SaaS now has to be continuous, not periodic.

Finance and security are converging on the same control problem. SaaS waste, unused licences, and unmanaged access are different symptoms of the same broken lifecycle process. That makes integrated governance more defensible than separate point solutions that only solve one slice of the problem. Practitioners should align IT, Finance, and Security around one view of app usage and entitlement state.

Lifecycle control is the decisive control, because visibility without revocation does not reduce risk. The article's central claim is that teams need to surface unmanaged apps and then act on them. That makes revocation, access review, and licence reclamation the controls that convert knowledge into reduced exposure. The practitioner lesson is to measure whether discovery actually leads to removal.

From our research library:

• Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
• Read next: NHI Lifecycle Management Guide

What this signals

Lifecycle blind spots: applications that sit outside SSO and shadow AI tools that appear faster than governance cycles can process them create an access estate that review cadences cannot fully see. Once access moves into that blind spot, removal depends on manual memory instead of enforceable lifecycle state.

The practical question for IAM teams is whether discovery actually feeds revocation. If unmanaged apps can be found but not quickly offboarded and reclaimed, the programme is measuring inventory rather than controlling access.

For practitioners

• Map all apps outside SSO Create and maintain an inventory of applications that users can access without the identity provider so unmanaged access paths are visible to IT and Security.
• Automate SaaS offboarding Replace manual checklists with lifecycle workflows that revoke access, close accounts, and remove entitlements when users change role or leave.
• Review employee app access routinely Set recurring access review cycles for approved and unapproved tools so dormant accounts and unnecessary privileges are identified before they linger.
• Track licence reclamation as a control Measure how many unused licences are recovered after offboarding and review, then tie that metric to Finance and Security reporting.
• Treat shadow AI as governed SaaS Apply the same ownership, approval, and access governance model to unapproved AI tools that employees adopt on their own.

Key takeaways

• SaaS sprawl becomes a governance failure when access exists outside the systems that can revoke it cleanly.
• The strongest evidence in the article is the spread of unapproved AI tools, shadow SaaS, and apps outside SSO, all of which outpace manual oversight.
• Teams need one lifecycle model that connects discovery, access review, offboarding, and licence reclamation if they want to reduce both risk and waste.

Key terms

• Shadow SaaS: Shadow SaaS is the set of unauthorised or unreviewed software-as-a-service tools used outside central security governance. These applications often bypass normal identity controls, making them difficult to inventory, monitor, and harden against credential-based abuse.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• SaaS Lifecycle Automation: SaaS lifecycle automation is the use of workflows to manage application discovery, onboarding, offboarding, access changes, renewals, and license optimization. It helps IT and procurement teams reduce manual effort and improve control over the application estate. The focus is operational efficiency, not direct data loss prevention.
• Apps Outside SSO: Apps outside SSO are applications that users can access without passing through the organisation's identity provider. They are difficult to govern because standard access policies, session controls, and revocation workflows no longer apply consistently, which leaves entitlement decisions fragmented across local app admins.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.