TL;DR: Most organisations can identify apps behind SSO, but far fewer can see the shared and sensitive logins teams use outside it, creating governance blind spots that complicate revocation, rotation, and auditability, according to 1Password. The underlying issue is that zero trust breaks down when credential-based access sits outside the control plane, not because the apps themselves are hard to secure.
At a glance
What this is: This is a product analysis about extending credential governance beyond SSO, with the central finding that shared and sensitive non-SSO logins remain difficult to discover, govern, and revoke.
Why it matters: IAM and NHI teams need this because access governance fails when sensitive credentials live outside the SSO control plane, leaving role changes, offboarding, and audit evidence incomplete.
Context
SSO gives teams a clear view of federated access, but it does not govern every credential employees still use. Shared logins, browser-stored credentials, and vault-based access can remain outside that control plane, which makes lifecycle actions such as revocation and rotation harder to execute consistently.
For identity programmes, the gap matters because governance is only as complete as the access paths it can see. When credential-based access is scattered across vaults and browsers, teams lose reliable inventory, ownership, and change tracking across the broader access estate.
Key questions
Q: What breaks when shared logins sit outside SSO governance?
A: Shared logins outside SSO break inventory, ownership, and revocation discipline. Teams may know an app exists, but not who controls the credential or whether it has been rotated after a role change. That creates blind spots in offboarding, auditability, and Zero Trust coverage because the access path is real even when it is not federated.
Q: Why does non-SSO access create a governance gap for identity teams?
A: Non-SSO access creates a governance gap because authentication telemetry and credential governance are not the same thing. SSO tells you about sign-in to federated apps, while vaults and browsers hold other credentials that may still grant access. Without a separate inventory, teams cannot confidently prove who can reach what or remove access cleanly.
Q: How can security teams tell whether credential governance is mature enough?
A: Look for measurable controls, not claims of modernisation. Mature governance can show where credentials are issued, who owns them, how they are revoked, and whether those actions are visible to audit and compliance stakeholders. If the programme cannot produce that evidence, it is not yet operating as a governed identity system.
Q: What is the difference between SSO governance and credential governance?
A: SSO governance controls federated authentication into applications, while credential governance controls the secrets, shared logins, and access paths that remain outside federation. The first is about identity assertion at sign-in. The second is about custody, visibility, rotation, and revocation of the credentials that still authorize real access.
How it works in practice
Why non-SSO credentials escape identity governance
Non-SSO logins often sit in a different operational plane from federated sign-in. SSO tells you who authenticated to the app, but it does not automatically reveal every shared credential, browser-stored login, or vault copy that still grants access. That separation creates a visibility problem rather than a pure authentication problem. The governance gap appears when credential ownership, storage, and usage are distributed across user devices and shared vaults instead of being tied to a central identity control. Practical implication: treat credential inventory as a distinct governance asset, not as a side effect of SSO coverage.
Practical implication: Inventory credential-based access separately from SSO so lifecycle controls can reach the full access estate.
How vault and browser signals change access visibility
Vault insights and browser signals are useful because they surface access evidence that federation logs never capture. A vault record shows the presence of a credential, while browser activity can show that an app is being used even when no company vault contains the secret. That combination helps IT infer shadow usage and shared login risk more accurately. It also changes the governance model from app-centric visibility to credential-centric visibility, which is essential when access is granted outside managed federation. Practical implication: correlate vault and browser telemetry to identify where access exists without a governed owner.
Practical implication: Use vault and browser telemetry together to find unmanaged access paths and assign ownership.
Why account governance depends on transfer and revocation workflows
Credential governance breaks down when access changes are handled manually or after the fact. If an employee moves roles or leaves, teams need a reliable way to transfer control of sensitive accounts, revoke old access, and rotate any exposed secret without exposing the password itself. The technical issue is not just privilege removal. It is maintaining continuity of business access while removing the original holder from the trust chain. Practical implication: build offboarding and role-change workflows around account transfer, revocation, and rotation rather than around SSO alone.
Practical implication: Design offboarding workflows that transfer control first, then revoke and rotate credentials without disrupting business access.
NHI Mgmt Group analysis
SSO visibility is not the same as access governance. The article shows that most organisations can account for apps behind SSO, yet still lack control over shared and sensitive logins that live elsewhere. That is a governance blind spot, not a mere tooling gap, because the control plane stops where credential-based access begins. Practitioners should treat non-SSO access as a separate governance domain with its own inventory and lifecycle rules.
Credential ownership is the missing control point. When credentials are tied to individuals, scattered across vaults, and hard to revoke, ownership becomes ambiguous the moment roles change. That ambiguity weakens auditability and makes offboarding dependent on manual follow-up. The practical lesson is that the organisation must govern the credential itself, not just the app or the user session.
Account transfer is the operational hinge for shared access. The article points to a reality many programmes still understate: some access must be re-homed to IT before it can be safely retired or reassigned. That changes the model from user-centric access review to account-centric custody management. The implication for identity teams is to design workflows that preserve service continuity while removing informal credential custody.
Zero Trust becomes incomplete when it excludes credential-based paths. A Zero Trust posture that only covers federated applications leaves the real access environment partially outside policy enforcement. This is not an argument to force every app behind SSO, but a reminder that governance must follow how teams actually work. Practitioners should measure Zero Trust coverage by governed access paths, not by SSO penetration alone.
From our research library:
- 73% of vaults are misconfigured, leading to unauthorised access and exposure of sensitive data, according to the Ultimate Guide to NHIs.
- Only 44% of organisations are currently using a dedicated secrets management system, according to the 2024 State of Secrets Management Survey.
- Read next: Guide to the Secret Sprawl Challenge
What this signals
Credential sprawl becomes a governance problem when access outlives federation. Organisations that optimise only for SSO coverage can still leave sensitive credentials unmanaged in vaults and browsers, which means revocation and rotation remain incomplete. The practical shift is to treat credential-based access as part of the identity perimeter, not as an exception outside it.
Shared access needs custody, not just visibility. Once a sensitive login is used by multiple people or teams, ownership has to move from informal usage to explicit custodial control. That is the point where lifecycle governance, offboarding, and audit evidence converge, because no Zero Trust programme is complete if it cannot reassign or retire the credential itself.
For practitioners
- Map non-SSO credential estates Inventory shared and sensitive logins across vaults, browsers, and unmanaged repositories so you know which access paths sit outside SSO governance.
- Correlate vault data with SaaS usage Use credential storage signals and SaaS activity together to identify applications that are being used with credentials the IT team does not currently govern.
- Build role-change and offboarding workflows Require transfer of account control, followed by revocation and credential rotation, whenever an employee changes role or leaves the organisation.
- Separate access visibility from authentication visibility Report on which applications are governed by federation and which still depend on traditional credentials so leadership can see the remaining exposure clearly.
Key takeaways
- The core issue is not that SSO fails, but that many organisations still govern only the federated portion of access while credential-based paths remain fragmented.
- Visibility into vaults and browser usage matters because it reveals where access exists without a clear owner or lifecycle control.
- Teams need account transfer, revocation, and rotation workflows that cover non-SSO credentials if they want auditable Zero Trust coverage.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Role changes and leavers are central because old credential custody persists after personnel changes. |
| NHI-05 — Overprivileged NHI | Shared and sensitive logins create excess access when no one can see or scope their use clearly. | |
| NHI-07 — Long-Lived Secrets | Credentials that persist outside SSO remain hard to rotate and revoke on schedule. | |
| Recommendation — Use NHI-01 to govern offboarding so shared credentials are transferred or revoked when ownership changes. Apply NHI-05 to reduce standing access on shared logins and align privileges with business need. Apply NHI-07 to shorten credential lifetime and enforce rotation for non-SSO access paths. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about governing who can access what when entitlements sit outside federation. |
| Recommendation — Use PR.AA-05 to maintain accurate entitlement control across both federated and credential-based access paths. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Rotation and revocation of stored credentials are core authenticator management concerns. |
| AC-2 — Account Management | Account transfer and revocation during role changes are account management issues. | |
| Recommendation — Apply IA-5 to control credential issuance, rotation, and revocation for shared non-SSO logins. Use AC-2 to tie credential custody and access removal to joiner-mover-leaver processes. | ||
| NIST Zero Trust (SP 800-207) | Resource access policy — Resource access policy | The post extends Zero Trust governance beyond SSO to governed credential-based access. |
| Recommendation — Apply Zero Trust resource access policy to include credential-based access paths, not only federated sign-ins. | ||
Key terms
- Credential Governance: Credential governance is the discipline of controlling how secrets are issued, stored, rotated, revoked, and monitored across an environment. For NHIs, it also includes ownership and entitlement review, because a valid secret without governance becomes a standing path to misuse.
- Non-Sso Access: Access that relies on shared logins, individual application passwords, browser-stored credentials, or other direct secrets rather than federated single sign-on. In governance terms, it often sits outside identity provider logs, so teams must discover it through vault, browser, and application telemetry.
- Account Transfer: Account transfer is the process of moving custody of a sensitive login or shared account from one person or team to another without exposing the secret. It is a practical control for role changes, offboarding, and shared access continuity because it preserves business use while removing old ownership.
- Credential-Centric Visibility: Credential-centric visibility is the ability to see where secrets exist, who uses them, and which apps depend on them, even when those apps are outside SSO. It is more operationally useful than authentication logs alone because it links access evidence to the credential that actually authorises use.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 10, 2026.
Updated on October 10, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org