Topic starter
24/06/2026 10:44 pm
TL;DR: As enterprises spread identities across AWS, Oracle Cloud, Entra ID and SaaS, fragmented administration makes toxic access combinations, orphaned permissions and weak de-provisioning far harder to detect, according to SafePaaS. Centralised policy-based access control and privileged identity management become the practical response, not optional tooling.
Editorial analysis by NHI Mgmt Group, based on content published by SafePaaS: “Multi-Cloud Identity Management and Security: Navigating the New Digital Perimeter”.
Key questions
Q: What breaks when identity governance is split across cloud and on-premise systems?
A: The biggest failure is inconsistent control ownership.
Q: Why do toxic access combinations become harder to detect in multi-cloud environments?
A: They emerge from the combination of permissions across systems, not from any single role.
Q: How should security teams implement just-in-time privileged access in cloud environments?
A: Start with the most sensitive administrative paths, then require approval, session bounds, and automatic expiry for each elevation event.
Practitioner guidance
- Implement cross-platform entitlement correlation Aggregate identities, roles and privileges from clouds, identity providers and SaaS into one view so toxic combinations can be detected before access is granted or retained.
- Replace broad role assignment with policy-driven access Define business-based access rules centrally and map them to each platform so permissions are granted by policy intent rather than accumulated local roles.
- Separate privileged access from standing access Move administrator and infrastructure accounts onto just-in-time elevation so elevated rights exist only for the task window and are revoked automatically afterward.
Bottom line: Multi-cloud identity sprawl creates governance blind spots because access decisions are distributed across clouds, identity providers and SaaS systems.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 7:32 am
Identity fragmentation is now an access governance problem, not just an administration inconvenience. When access is split across multiple clouds and SaaS estates, no single control plane sees the full entitlement picture. That means least privilege can be true in one platform and false in the aggregate. The practical conclusion is that governance has to be cross-system by design, or it is incomplete by default.
A few things that frame the scale:
- Organisations maintain an average of 6 distinct secrets manager instances, creating fragmentation that undermines centralised control, according to the State of Secrets in AppSec.
A question worth separating out:
A: Policy-based control should take priority when the goal is consistent governance across heterogeneous platforms. Roles tend to accumulate exceptions and local drift, while policy expresses business intent that can be applied more uniformly. Role models still exist, but they should not be the primary control in fragmented environments.
👉 Read our full editorial: Multi-cloud identity fragmentation is exposing access governance gaps