Topic starter
10/06/2026 11:30 pm
TL;DR: SSO and identity providers still leave a structural “API gap” in SaaS governance, because many apps cannot be governed end to end and offboarding remains manual, error-prone, and blind to orphaned access, according to Josys. That makes lifecycle coverage, not login consolidation, the real control boundary.
Editorial analysis by NHI Mgmt Group, based on content published by Josys: “Achieving Zero-Touch Security: Why SSO Isn't Enough for Secure Employee Offboarding”.
Key questions
Q: What breaks when employee offboarding depends on disconnected SaaS apps?
A: The first failure is that deprovisioning stops being automatic.
Q: Why do unsupported SaaS apps complicate employee offboarding?
A: Unsupported SaaS apps complicate offboarding because the identity team cannot rely on the normal connector model to remove access or verify entitlement changes.
Q: How do security teams know whether offboarding is actually working?
A: Security teams should measure completion, not process start.
Practitioner guidance
- Inventory every SaaS app by offboarding coverage Classify each application by whether it can receive deprovisioning signals, expose entitlement data, and remove access without manual intervention.
- Flag orphan-risk applications for manual review Prioritise niche, legacy, and shadow IT applications where access removal still depends on users, admins, or helpdesk staff logging in by hand.
- Test the leaver signal path end to end Validate that the HR offboarding event reaches identity, downstream applications, and admin roles before the employee exit date, then confirm revocation actually completed.
Bottom line: The article’s core point is that SSO alone does not finish the job of SaaS offboarding when applications sit outside the connector set.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 17 hours ago by NHI Mgmt Group
12/06/2026 5:35 am
Lifecycle coverage is the real control boundary, not SSO adoption: Centralised authentication does not equal centralised deprovisioning. The article shows that the limiting factor is whether every application in scope can receive identity and entitlement changes at offboarding time. Where that control path is missing, governance ends at the connector boundary rather than at the application boundary. Practitioners should treat offboarding coverage as the test of whether identity governance is actually complete.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: When should teams treat an application as outside identity governance?
A: Any application that cannot consume offboarding signals, surface permissions, or support revocation at scale should be treated as outside effective governance until that gap is closed. Those systems require compensating controls because central IAM coverage does not extend to them automatically.
👉 Read our full editorial: Zero-touch employee offboarding exposes the API gap in SaaS governance
This post was modified 17 hours ago by NHI Mgmt Group