SaaS sprawl is exposing the access-trust gap in enterprise IAM

At a glance

What this is: This article argues that enterprise IAM no longer has full visibility into SaaS and AI usage, with shadow IT and unmanaged apps creating an access-trust gap that SSO alone cannot close.

Why it matters: IAM, IGA, and security teams need to treat SaaS discovery, lifecycle automation, and policy enforcement as core governance work, or unmanaged apps will keep undermining access control, compliance, and offboarding.

By the numbers:

• 52% of employees admit to downloading work apps without IT approval.
• 37% admit they don’t always follow their company’s AI usage policies.
• 70% of security leaders say SSO is insufficient for managing employee identities.
• 38% of breached organizations linked incidents to unmanaged applications.

Context

SaaS sprawl is what happens when application adoption outpaces the identity controls built to govern it. In this article, 1Password frames the problem as an access-trust gap: employees add tools outside IT approval, AI use spreads faster than policy enforcement, and centralised IAM loses sight of what is actually in use.

For IAM and IGA teams, the issue is no longer whether SSO works at the login layer. The harder problem is knowing which apps exist, who approved them, which accounts remain active after offboarding, and how to enforce policy across managed, business-managed, and unmanaged SaaS.

That governance gap is typical of modern SaaS-heavy environments rather than an edge case. Once shadow IT becomes normal, access reviews and deprovisioning workflows stop reflecting the real application estate.

Key questions

Q: What breaks when SaaS purchases bypass central procurement and IT approval?

A: When SaaS purchases bypass central approval, organisations lose the link between buying authority, asset inventory, and access ownership. That makes shadow IT harder to detect, renewals harder to justify, and offboarding harder to complete. The immediate failure is not just overspend. It is the absence of a governed lifecycle for the application and its identities.

Q: Why does SSO fail to solve the access-trust gap on its own?

A: SSO solves federation at the login screen, but it does not govern app discovery, unused licenses, dormant accounts, or unfederated tools. If an application sits outside the federated boundary, revocation through the IdP does not guarantee the account disappears everywhere it exists.

Q: How do unmanaged SaaS apps undermine joiner, mover, leaver processes?

A: Unmanaged apps undermine JML because lifecycle actions only work when every account is known and tied to a governed system. If employees open accounts directly with vendors, offboarding can miss live access, leaving the organisation with orphaned accounts and incomplete evidence.

Q: What should teams do when identity governance does not cover shadow IT?

A: Teams should treat discovered application inventory as the starting point for access governance, then automate onboarding, offboarding, and license control across those apps. If the control model only covers sanctioned systems, the remaining estate stays outside review, revocation, and compliance evidence.

Technical breakdown

Why SSO stops at the login screen in SaaS environments

Single sign-on authenticates users and can revoke access at the federated entry point, but it does not govern the full SaaS lifecycle. It cannot automatically discover unsanctioned apps, remove dormant accounts inside unfederated tools, or reclaim licenses that sit outside the identity provider’s reach. That leaves a structural gap between authentication and ongoing access governance. In practice, the control boundary is narrower than most enterprises assume, especially when employees can create app accounts with only an email address and no central approval.

Practical implication: treat SSO as one control point in a broader SaaS governance model, not as evidence that application access is fully controlled.

How unmanaged SaaS breaks joiner, mover, leaver governance

Joiner, mover, leaver processes depend on knowing where accounts exist and which systems they touch. Unmanaged SaaS breaks that assumption because accounts may be created outside IT workflows, reused across roles, or left active after a person changes job or leaves. That creates orphaned access, wasted licenses, and a weaker audit trail. The identity problem is not only provisioning, but offboarding and lifecycle completeness across every app path, including those never tied back to the corporate directory.

Practical implication: build lifecycle control around discovered application inventory, not around the IdP alone.

Why SaaS management platforms extend identity governance

A SaaS management platform extends governance by continuously discovering applications through integrations with identity, HR, finance, and browser telemetry, then automating onboarding, offboarding, and license control. Mechanically, this shifts governance from reactive cleanup to ongoing policy enforcement. The key change is visibility: once the organisation can see every app and account, it can apply consistent rules for access, renewal, and revocation instead of relying on tickets and spreadsheets. That is where SaaS management becomes an identity control plane rather than a procurement tool.

Practical implication: use continuous discovery and workflow automation to make SaaS access decisions auditable, repeatable, and enforceable.

Threat narrative

Attacker objective: Exploit the organisation’s blind spots in SaaS governance to persist in unmanaged accounts, expand the attack surface, or take advantage of stale access paths.

1. Entry occurs when employees create accounts in unsanctioned SaaS or AI tools outside IT approval, bypassing central inventory and policy controls.
2. Credential and account risk then accumulates as dormant, unfederated, or previously owned accounts remain active after role changes or offboarding.
3. The organisation loses governance coverage because access reviews, license management, and deprovisioning do not reach the full application estate.
4. Impact appears as compliance exposure, unnecessary spend, and a larger attack surface that security teams cannot reliably monitor.

Breaches seen in the wild

• SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Access governance now fails at the discovery layer, not just the authorization layer: IAM programmes were built to control known applications and known users, but SaaS sprawl creates accounts the directory never sees. Once an app sits outside federated control, the programme cannot certify, revoke, or even inventory it reliably. The practitioner conclusion is that visibility has become a prerequisite for access governance, not a reporting enhancement.

Shadow IT turns lifecycle management into a partial-control problem: Joiner, mover, leaver workflows only work when every account can be tied back to a governed application record. When employees create or reuse SaaS accounts outside IT process, offboarding becomes a best-effort activity rather than a deterministic one. That means identity governance must start from discovered application state, not from the org chart alone.

SaaS management is converging with identity governance because the control boundary has moved: The market is not replacing IAM so much as extending it into application discovery, license control, and policy enforcement across managed and unmanaged apps. Access-trust gap: the core failure is that an organisation trusts its directory more than it understands its real app estate. Practitioners should treat this as a governance architecture issue, not a tooling preference.

AI usage policies are now part of access governance: The same unmanaged adoption pattern applies to AI tools, which means the identity problem is no longer confined to SaaS licences and offboarding. Policy enforcement now has to follow where users actually work, not where IT intended them to work. The practical implication is that governance teams need a shared view of SaaS, AI, and identity lifecycle states.

Auditability depends on continuous control evidence, not periodic reconciliation: When account creation, revocation, and renewal are handled through tickets and spreadsheets, the evidence trail becomes too fragmented to support fast review or consistent enforcement. That weakness shows up in SOC 2 and ISO 27001 contexts because the organisation cannot easily prove who had access to which systems at a given time. Practitioners should view continuous automation as an evidence-generation mechanism as much as an efficiency gain.

From our research library:

• 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
• Read next: AI Agent Authorisation Guide

What this signals

Access-trust gap: when employees can add SaaS and AI tools faster than IT can inventory them, the effective control point shifts from login to discovery. That means access governance has to follow the real application estate, not the approved one.

The practical signal for mature programmes is whether lifecycle automation reaches unfederated apps. If offboarding, license reclamation, and policy enforcement still rely on spreadsheets and tickets, the organisation is managing exceptions rather than governance.

The strongest response is to connect identity, HR, finance, and browser telemetry into one operational view. That is what turns shadow IT from an invisible risk into a governable part of the access model.

For practitioners

• Map the unmanaged app estate Use browser, finance, HR, and identity integrations to build a live inventory of SaaS and AI tools that exist outside SSO.
• Automate offboarding across unfederated apps Trigger account disablement, license reclamation, and role-based access removal from one workflow instead of separate tickets.
• Rebuild JML around discovered applications Tie joiner, mover, and leaver actions to actual application discovery so account lifecycle reflects reality, not assumptions.
• Track unsanctioned app use as a governance metric Measure how many applications sit outside approved workflows and review that gap alongside access recertification results.
• Align SaaS policy with AI usage rules Extend access governance to cover employee use of AI tools that are adopted informally but still process company data.

Key takeaways

• SaaS sprawl creates an identity blind spot that SSO alone cannot close because the real problem is discovery and lifecycle control across sanctioned and unsanctioned apps.
• The article links unmanaged applications to breached organisations and to a broader pattern of incomplete offboarding, orphaned access, and wasted licenses.
• Continuous discovery and automated lifecycle workflows are the controls that make SaaS governance auditable at enterprise scale.

Key terms

• Access-trust gap: The gap between having a policy and actually enforcing it when access is requested. It appears when compliance, HR, or training data sits in separate systems from the access decision, allowing users to reach resources even though a required condition has not been met.
• Shadow IT: Shadow IT is the use of applications or services outside formal enterprise approval or visibility. In SaaS environments, it often includes department-purchased tools and unsanctioned integrations that create hidden identity, data, and access paths the security team cannot readily govern.
• SaaS Management Platform: A SaaS management platform is a visibility and optimisation layer for cloud software use. It helps teams discover applications, track utilisation, and understand spend patterns, but it does not by itself enforce access policy, revoke permissions, or manage identity lifecycle state.
• Joiner, Mover, Leaver Workflow: A joiner, mover, leaver workflow is the process that grants, updates, and removes access as a user or identity changes state. In modern programs, the same logic should extend beyond employees to service accounts and AI agents so access does not persist after need ends.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.