Notifications
Clear all
Topic starter
10/06/2026 11:12 pm
TL;DR: OAuth-connected apps, reused credentials, and overpermissioned third-party tools are turning everyday SaaS adoption into supply chain risk, according to 1Password. The access problem is no longer just sprawl, but an increasingly visible trust boundary that security teams must inventory, constrain, and continuously monitor.
NHIMG editorial — based on content published by 1Password: OAuth-based supply chain attacks and credential sprawl in SaaS and AI workflows
Questions worth separating out
Q: How should security teams handle OAuth-connected apps that outlive their original business need?
A: Security teams should treat every OAuth-connected app as a live entitlement with an owner, purpose, and expiry review.
Q: Why do overpermissioned third-party integrations increase supply chain risk?
A: They increase supply chain risk because a compromise in the external service can immediately inherit the scopes already granted by the organisation.
Q: How do organisations know whether OAuth discovery and revocation controls are working?
A: They know the controls are working when the inventory is current, app ownership is clear, and stale connections are removed quickly after use stops.
Practitioner guidance
- Inventory all OAuth-connected applications continuously Review Google Workspace or Microsoft-connected apps as a live access set, not a quarterly snapshot.
- Reduce token lifetime wherever the workflow allows Set expiry policies for OAuth tokens and avoid long-lived credentials in scripts or automation paths.
- Separate development, automation, and production credentials Do not let tokens used in testing or low-risk workflows carry over into production systems.
What's in the full article
1Password's full article covers the operational detail this post intentionally leaves for the source:
- The exact Google Workspace navigation path for reviewing third-party app access and revoking risky connections
- Practical examples of tightening default OAuth posture with basic profile-only permissions
- The article's step-by-step guidance for moving from snapshot reviews to continuous discovery and secrets rotation
- Specific 1Password SaaS Manager and Unified Access workflow details for tracking connected apps and credential use
👉 Read 1Password's analysis of OAuth supply chain risk and credential sprawl →
OAuth supply chain risk in SaaS and AI tools: are controls keeping up?
Explore further
12/06/2026 5:03 am
OAuth sprawl is now a supply chain governance problem, not just an app-management nuisance. Once external tools can act with valid workspace permissions, the risk shifts from local entitlement management to third-party trust lifecycle. That means the real control question is not whether an app was once approved, but whether the current access graph still reflects business intent. Practitioners should treat every connected app as part of the identity perimeter.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities.
A question worth separating out:
Q: Who is accountable when a third-party OAuth token is abused?
A: Accountability is shared across the business owner who approved the tool, the identity team that governed the scopes, and the security function that monitored the connection. If the external service was not risk-assessed or the token was never reviewed, the failure sits in governance as much as in detection. Clear ownership prevents the problem from disappearing into vendor blame.
👉 Read our full editorial: OAuth supply chain risk is expanding across SaaS and AI agents
