Spreadsheet-based access reviews fail in SaaS-heavy identity

At a glance

What this is: This is an analysis of why spreadsheet-based access reviews stop working in SaaS-heavy environments, with the central finding that static certification models cannot keep up with live entitlement change, fragmented authorization, and manual remediation.

Why it matters: It matters because access certification sits at the centre of IGA, and teams governing NHI, autonomous, or human access all need review processes that reflect current state rather than stale exports.

Context

Spreadsheet-based access reviews are a manual access certification pattern built around exported user and entitlement data, manager approvals, and audit trails. In SaaS-heavy environments, that pattern breaks because the access state changes faster than a spreadsheet can capture it, and the governance problem is no longer reviewer effort but model fit.

OpenIAM's analysis shows the real issue is structural: organisations now govern across SaaS, hybrid directory, and API-driven environments where entitlement logic is fragmented and frequently changing. The article argues that periodic export-and-certify workflows were designed for slower, more contained systems, not for continuously shifting access estates.

Key questions

Q: What breaks when SaaS access reviews rely on spreadsheets?

A: Spreadsheets freeze access data in time, so reviewers work from stale exports while roles, teams, and app usage keep changing. That creates entitlement drift and weak evidence for auditors. A better model is recurring review automation with current usage, department, and risk context, plus direct remediation from the review step.

Q: Why do spreadsheet access reviews create governance risk in hybrid identity estates?

A: Hybrid estates combine AD, Entra ID, SaaS admin portals, and application-specific authorization models, so no single export fully represents the live access picture. That fragmentation makes it easy to miss duplicate roles, orphaned privileges, or conflicting assignments. The risk is not just incomplete evidence, but certification of access that cannot be interpreted consistently.

Q: How do organisations know if access certification is actually working?

A: Look for shrinking numbers of standing privileges, faster revocation after review decisions, and fewer orphaned or overprivileged accounts over time. If campaigns finish but access sprawl remains unchanged, the programme is producing documentation rather than governance. Working certification changes the entitlement baseline, not just the audit record.

Q: What should organisations do when access reviews cannot keep up with SaaS change?

A: They should shift from fixed-interval spreadsheet campaigns to live, risk-based governance that prioritises privileged access, frequent change, and high-impact systems. The goal is to review current access with current context and close the loop with verified remediation. That reduces reviewer fatigue while improving the quality of the control.

Technical breakdown

Why static exports become stale in SaaS access reviews

A spreadsheet is a snapshot, not a governed data source. Once exported, it no longer reflects role changes, offboarding events, new entitlements, or SaaS admin changes that happen during the review window. That creates a mismatch between the state reviewers think they are certifying and the state that actually exists in production. In SaaS environments, where access can change through admin portals, role templates, and app-specific logic, staleness is not a timing issue. It is a design limitation of snapshot-based governance.

Practical implication: move certification to live access data and remove snapshot-only review inputs where access changes continuously.

How fragmented entitlement models defeat manual certification

SaaS platforms do not share a common entitlement language. One system exposes technical role IDs, another shows admin groupings, and a third uses business-specific permissions that have no direct directory equivalent. Hybrid AD and Entra environments add another translation layer, so the same user may appear with overlapping or conflicting access across systems. Reviewers then certify labels they cannot reliably interpret. When context is missing, access reviews degrade into guesswork, not governance.

Practical implication: normalise entitlement context before review so certifiers can see business meaning, privilege level, and system ownership.

Why remediation must be verified, not merely recorded

Spreadsheet reviews split decision-making from enforcement. A manager can mark access for removal, but a separate workflow must translate that decision into tickets, approvals, and changes across multiple target systems. That handoff creates delay, and delay creates failure points. Without confirmed enforcement, the spreadsheet only proves that someone made a decision, not that the access was actually removed. Governance breaks at the gap between certification and execution, especially in multi-system environments where no single control plane owns the outcome.

Practical implication: require closed-loop remediation evidence before treating an access review as complete.

Threat narrative

Attacker objective: The practical outcome for an attacker or risky insider is to retain access longer than governance teams believe they do, preserving paths into SaaS, directory, and admin functions.

1. Entry occurs when SaaS sprawl, hybrid directories, and shadow IT expand faster than the review process can consolidate them.
2. Escalation follows when stale exports and unreadable entitlements cause reviewers to certify access they do not fully understand.
3. Impact lands as unremoved privileges, persistent privilege drift, and audit findings that reflect governance failure rather than reviewer effort.

Breaches seen in the wild

• Microsoft SAS token exposure 2023: An over-permissive Azure SAS token in a Microsoft AI GitHub repo exposed 38TB, including workstation backups and Teams messages, for 3 years.
• Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Spreadsheet certification is a control-model failure, not a process-efficiency problem: The article shows that manual reviews were built for stable access estates and now collide with continuous entitlement change. That means the failure is not reviewer diligence but the assumption that a periodic snapshot can represent current authorisation state. The practitioner conclusion is that certification must be redesigned around live identity state, not better spreadsheet hygiene.

Entitlement translation has become the hidden governance bottleneck: SaaS-heavy environments force reviewers to interpret role names, admin constructs, and hybrid directory mappings that do not share a common semantic model. When business reviewers cannot tell what an entitlement means, certification becomes a formality rather than a control. The implication is that access governance now depends on normalised context as much as on review cadence.

Verified remediation is the boundary between governance and paperwork: A review decision has no control value until the target system actually enforces it. Spreadsheet workflows often document intent while leaving execution distributed across tickets and manual follow-up. That makes the named concept here access certification drift: decisions and enforcement drift apart until the audit trail no longer matches reality. Practitioners need to treat closed-loop enforcement as part of the control, not as an operational afterthought.

Hybrid identity estates expose the limits of calendar-driven governance: When AD, Entra ID, SaaS admin consoles, and API-driven tools all hold overlapping authorisation data, fixed review cycles become a poor proxy for risk. Access changes can happen between campaigns, while shadow IT and role sprawl keep expanding the review surface. The field should treat access certification as continuous governance over a distributed entitlement graph, not as a quarterly ritual.

Identity governance for SaaS has moved from record-keeping to state verification: The central question is no longer who approved a spreadsheet row but whether current access, current business need, and current enforcement still align. That is a materially different governance problem, and it pushes IGA teams toward systems that can observe, contextualise, and confirm access in near real time. The practitioner conclusion is that the control objective has changed even if the audit requirement has not.

From our research library:

• 1 in 3 organisations encountered suspicious AI agent activity in 2025, and 99.4% experienced a SaaS or AI ecosystem incident.

What this signals

Access certification now needs state verification, not document review: Spreadsheet workflows assume a stable access picture, but SaaS-heavy estates change too quickly for periodic exports to remain trustworthy. The governance shift is from approving records to verifying current authorisation state at the point of decision.

Access certification drift: This is the control gap that opens when review intent, entitlement context, and remediation execution stop lining up. In practice, the reviewer says yes or no to an object that is already obsolete, and the downstream system change may never be confirmed.

Enterprises with hybrid identity estates should expect access review quality to become a measurable signal of IGA maturity. If the programme cannot tie certification decisions to live entitlements and verified enforcement, the review cycle is documenting risk rather than reducing it.

For practitioners

• Replace snapshot-based certification with live access state Pull current entitlements from SaaS, directory, and admin systems at the point of review instead of certifying static exports that age during the campaign.
• Normalise entitlement context before reviewer sign-off Map technical role codes to business-readable ownership, risk, and function data so managers can judge whether access still matches job need.
• Make remediation evidence mandatory Do not close a review until the revocation or downgrade has been confirmed in the target system, not just recorded in a spreadsheet or ticket.
• Prioritise high-risk access for continuous review Focus recurring certification on privileged accounts, admin portals, and entitlements with rapid churn, while moving low-risk access to exception-based handling.
• Reconcile hybrid identity sources before each campaign Compare AD, Entra ID, and SaaS authorization data for duplicates, conflicts, and orphaned assignments before sending any review to approvers.

Key takeaways

• Spreadsheet-based access reviews fail because they certify stale snapshots in environments where entitlements change continuously.
• The failure is amplified by SaaS fragmentation, hybrid identity sources, and remediation that is not verified end to end.
• Practitioners should move certification toward live state, readable context, and confirmed enforcement rather than more frequent spreadsheet cycles.

Key terms

• Access Certification: Access certification is the periodic review of whether an identity still needs its current entitlements. For NHIs, certification is only reliable when reviewers know the identity's owner, purpose, and expiry, otherwise stale machine access can persist long after the original use case has ended.
• Entitlement Drift: Entitlement drift is the slow accumulation of permissions that no longer match the original purpose, role, or workload. In cloud-native and NHI-heavy environments, it usually happens because access changes faster than review cycles, leaving organizations with more privilege than they intended.
• Verified Remediation: Verified remediation means a finding is only considered closed after the environment is rescanned and the issue is confirmed fixed. This matters because ticket closure alone does not prove risk reduction. Verification is the control that separates documented intent from actual security outcome.
• Hybrid Identity Estate: A hybrid identity estate combines cloud and on-premises identity systems under one operational environment. For NHIs, this usually means certificates, service principals, and service accounts are distributed across tools and teams, which makes visibility and lifecycle enforcement harder unless controls are centralised.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.