Topic starter
01/08/2026 10:46 pm
TL;DR: Hidden identity sprawl leaves large parts of the application stack outside SSO, according to Unixi, so ownership and revocation can fall outside central policy. Access review then has to cover non-SAML apps, shared accounts and shadow SaaS that the IdP cannot fully govern.
Editorial analysis by NHI Mgmt Group, based on content published by Unixi: “The Great Password Manager Myth”.
By the numbers:
- even in mature organizations, up to 80% of the application stack exists outside of traditional SSO and thus beyond the view and control of security teams
Key questions
A: Encrypted vaults can still be dangerous because the surrounding metadata often reveals which users belong to which SaaS apps, along with duplicate passwords.
Q: How should teams handle shared and utility accounts that sit outside normal identity workflows?
A: Treat shared and utility accounts as governed assets with named owners, documented purpose and a defined revocation path.
Q: What breaks when access sits outside SSO and the IdP cannot govern it?
A: When access sits outside SSO, the identity provider no longer has authority over the full lifecycle of the account.
Practitioner guidance
- Map the unmanaged application estate Create a separate inventory for non-SAML apps, shared utility accounts and shadow SaaS that sit outside the identity provider.
- Differentiate vault storage from lifecycle control Review every password vault deployment to confirm it does not get treated as an access governance control.
- Assign explicit owners to shared accounts For shipping, security, social and root-style accounts, name a business owner, define approval rules and require periodic review.
Bottom line: The article argues that SSO does not remove access risk when large parts of the application stack remain outside federation and lifecycle control.
Glossary terms: Identity Dark Matter, Federated Access, Shared Account, Password Vault
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 10 hours ago by NHI Mgmt Group
01/08/2026 10:55 pm
Identity dark matter is a governance failure, not a user habit problem. The article’s central point is that large parts of the access estate remain outside federated control even in mature environments. That means the programme is not missing only stronger passwords or better user training, it is missing authoritative coverage of where identity actually lives. The practitioner conclusion is to treat unmanaged access as a structural governance gap, not a behaviour issue.
A question worth separating out:
Q: When does SSO coverage give a false sense of security?
A: SSO coverage becomes misleading when the visible federated apps are treated as the whole estate. If business portals, shadow SaaS and shared logins still authenticate locally, the programme is only governing part of the environment. Teams should assume coverage is incomplete until they can prove where access actually terminates.
👉 Read our full editorial: Identity dark matter shows why SSO and vaults miss core access risk