Topic starter
14/08/2026 6:37 pm
TL;DR: As SaaS adoption accelerates outside IT review, security teams lose visibility into OAuth tokens, local accounts, API keys, and other access paths that survive SSO deprovisioning, according to Obsidian Security. The governance problem is no longer just discovery, but proving which app identities still exist and can still reach sensitive systems.
Editorial analysis by NHI Mgmt Group, based on content published by Obsidian Security: “Obsidian Now Covers 200+ Enterprise Applications. Here's Why That Number Matters.”.
Key questions
Q: What breaks when SaaS connector coverage is incomplete?
A: Incomplete connector coverage leaves local accounts, OAuth grants, API keys, and non-human identities outside normal governance.
Q: Why do SaaS connectors create identity governance risk after offboarding?
A: Because offboarding in the identity provider only closes the federated path.
Q: What are the signs that OAuth permissions are drifting out of control?
A: Look for integrations with broad scopes, unused apps that still hold active tokens, unclear ownership, and access patterns that do not match the original business case.
Practitioner guidance
- Map every SaaS connector to an owning team Create an authoritative inventory of applications, delegated integrations, and ownership so no connector exists outside a named control boundary.
- Reconcile IdP deprovisioning with app-native access Verify that local accounts, OAuth grants, API keys, and other app-level identities are removed or disabled when users leave or change role.
- Track shadow apps as governance exceptions Treat unsanctioned or user-added apps as formal risk items with expiry dates, review ownership, and revocation triggers instead of informal findings.
Bottom line: SaaS connector coverage has moved from a visibility concern to an identity governance control because app-native accounts and delegated grants can survive SSO deprovisioning.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/08/2026 6:44 pm
Connector coverage is now an identity governance control: the boundary of SaaS identity has moved from the IdP to the application estate. SSO can only govern what it can see, and every hidden connector creates a separate lifecycle and revocation problem. For practitioners, this means app coverage must be measured as part of identity governance, not treated as an adjunct to discovery.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should security teams govern shadow IT in SaaS environments?
A: Security teams should govern shadow IT by treating it as unmanaged access, not just unsanctioned software. Start with continuous discovery, then map each app to owners, data types, delegated scopes, and revocation paths. The control goal is to reduce hidden access paths before they become business-critical dependencies.
👉 Read our full editorial: SaaS connector coverage is now an identity governance control