Topic starter
01/07/2026 1:57 am
TL;DR: Unapproved AI tools, shadow SaaS, and apps outside SSO create unmanaged access sprawl that manual onboarding and offboarding cannot keep up with, according to 1Password. The governance problem is not just visibility, but lifecycle control across discovery, access review, and license reclamation.
Editorial analysis by NHI Mgmt Group, based on content published by 1Password: “Demo On Demand 1Password SaaS Manager demo”.
Key questions
Q: What breaks when SaaS apps are used outside SSO and central IAM?
A: The main failure is lifecycle control.
Q: Why does shadow SaaS create governance risk even when CASB is deployed?
A: Shadow SaaS creates risk because a CASB can only enforce policy on services it can see and classify.
Practitioner guidance
- Map all apps outside SSO Create and maintain an inventory of applications that users can access without the identity provider so unmanaged access paths are visible to IT and Security.
- Automate SaaS offboarding Replace manual checklists with lifecycle workflows that revoke access, close accounts, and remove entitlements when users change role or leave.
- Review employee app access routinely Set recurring access review cycles for approved and unapproved tools so dormant accounts and unnecessary privileges are identified before they linger.
Bottom line: SaaS sprawl becomes a governance failure when access exists outside the systems that can revoke it cleanly.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/07/2026 2:15 am
SaaS sprawl is now an identity governance problem, not a software inventory problem. The article shows that once applications sit outside SSO, the governance model loses the normal control plane for onboarding, review, and revocation. That means the real issue is not count of apps, but whether access can still be tied to an accountable lifecycle. Practitioners should treat unmanaged SaaS as a lifecycle failure mode, not a discovery backlog.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: When should organisations treat unapproved AI tools as a formal IAM issue?
A: They should treat them as formal IAM issues as soon as employees can use them without central approval, review, or offboarding. At that point, the tool is part of the access estate even if procurement never sanctioned it. Governance has to follow usage, not just purchase records.
👉 Read our full editorial: SaaS sprawl and shadow AI expose unmanaged access gaps