Topic starter
11/06/2026 11:51 pm
TL;DR: Oktane 2024 conversations underscored that manual access reviews, SaaS sprawl, shadow IT, and compliance pressure are making access governance harder to manage at enterprise scale, according to Zluri. The practical shift is toward automation and app-level visibility, because identity programmes can no longer rely on review cycles designed for smaller, slower software estates.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “How Access Management Took Center Stage at Oktane 2025”.
Key questions
A: Security teams should centralise access reviews in one workflow, assign clear ownership, and use automated notifications plus fallback reviewers so certifications do not stall.
Q: Why do SaaS environments make access governance harder than traditional directories?
A: SaaS adoption happens outside central control through direct signups, free tiers, departmental purchases, and personal accounts used for work.
Q: What are the signs that access reviews are no longer keeping up with SaaS sprawl?
A: Common signs include long review backlogs, repeated exceptions, unknown applications in use, and licence data that does not match actual business activity.
Practitioner guidance
- Automate access review workflows Replace spreadsheet-driven or ticket-based review cycles with automated certification workflows that can process SaaS entitlements at enterprise scale without waiting for quarterly cleanup.
- Build an application-level access inventory Maintain a current inventory of SaaS applications, native roles, and delegated permissions so governance teams can certify access at the application layer, not only through the identity provider.
- Identify shadow IT access paths Detect SaaS applications adopted outside central IT and classify them by business owner, data exposure, and offboarding risk before they become permanently unreviewed access surfaces.
Bottom line: Manual access reviews do not scale well when SaaS portfolios grow faster than governance teams can inventory and certify them.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
12/06/2026 8:43 am
SaaS governance bottlenecks are now an access inventory problem, not just a review-volume problem: Manual certification fails when the estate changes faster than the governance cadence. The real failure is not reviewer fatigue alone, but the inability to maintain a trustworthy, current map of applications, entitlements, and owners. Practitioners should read this as a sign that access governance must start with inventory accuracy.
A question worth separating out:
Q: Should IAM teams prioritise automation or visibility first?
A: Visibility should come first if teams cannot reliably see access state, while automation should follow where repetitive work is consuming time and delaying response. The right sequence is to make identity data usable for security decisions, then remove the manual tasks that slow the programme.
👉 Read our full editorial: Access management at scale is becoming the SaaS governance bottleneck
This post was modified 4 days ago by NHI Mgmt Group