Notifications
Clear all
Topic starter
02/09/2026 3:57 pm
TL;DR: Enterprises now average more than 200 SaaS applications, with 45% classified as shadow IT, and that sprawl fragments identities, hides access, and leaves orphaned accounts behind, according to SecureAuth. The governance problem is no longer authentication alone; it is the inability to maintain a single control plane across disconnected applications.
NHIMG editorial — based on content published by SecureAuth: The IAM Sprawl Problem
By the numbers:
- The average enterprise now uses over 200 SaaS applications.
- 45% of enterprise SaaS use is shadow IT.
Questions worth separating out
Q: How should security teams govern access across SaaS sprawl?
A: Security teams should govern SaaS sprawl with one inventory, one policy model, and one review process that covers both human and non-human access.
Q: Why do SaaS identity silos create orphaned accounts and access drift?
A: SaaS identity silos create orphaned accounts because lifecycle events stop at the boundary of each application.
Q: Why does SaaS adoption create IAM and data governance risk?
A: SaaS adoption creates risk because access, data placement, and accountability are distributed across multiple parties.
Practitioner guidance
- Map every SaaS application to an identity owner Build an authoritative inventory that includes sanctioned apps, shadow IT, and delegated admin paths so every system has a named governance owner and a review path.
- Centralize provisioning with SCIM and federation Use SCIM for lifecycle changes and SSO for authentication consistency, but require both to be tied to the same source of truth so account creation and removal stay aligned.
- Bring shadow IT into discovery and control Use CASB discovery to identify unsanctioned applications, then decide whether each one is blocked, onboarded, or folded into the standard lifecycle process.
What's in the full article
SecureAuth's full analysis covers the operational detail this post intentionally leaves for the source:
- How SecureAuth recommends centralizing provisioning and deprovisioning across mixed SaaS estates
- Which discovery approaches it highlights for finding shadow IT and unmanaged applications
- The specific role it assigns to SSO, SCIM, CASB, and identity governance policies in the control stack
- How its platform positioning maps to workforce and partner identity use cases
👉 Read SecureAuth's analysis of SaaS identity sprawl and IAM control gaps →
SaaS identity sprawl: what it means for IAM and governance?
Explore further
02/09/2026 3:58 pm
SaaS sprawl creates an identity control problem before it becomes an authentication problem. The article is really about governance loss across many application boundaries, not about login friction. Once identities are distributed across dozens or hundreds of SaaS systems, the enterprise no longer has a single source of truth for access, lifecycle, or accountability. That is why the first failure is visibility, not credentials.
A few things that frame the scale:
- The average enterprise now uses 144 non-human identities for every human identity, according to The NHI and Secrets Risk Report.
- A separate finding in the same report shows that nearly half of exposed secrets reside outside code repositories, which is where many SaaS-driven identity workflows now leak.
A question worth separating out:
Q: Should organisations prioritize SCIM, CASB discovery, or access reviews first?
A: If the estate is fragmented, start with discovery so you know which applications exist, then prioritize SCIM for the systems that hold the most sensitive or persistent access. Access reviews should run after the major gaps are visible, otherwise you only certify bad data. Sequencing matters more than tool count.
👉 Read our full editorial: SaaS identity sprawl is breaking IAM visibility and control
