Notifications
Clear all
Topic starter
01/07/2026 2:00 am
TL;DR: SaaS identity governance is a response to decentralized app ownership, fragmented entitlements, dormant accounts, and weak lifecycle control across hundreds of cloud applications, according to SecurEnds. Stronger inventory, provisioning, access reviews, and privileged access controls are now baseline identity work, not an audit afterthought.
NHIMG editorial — based on content published by SecurEnds: Identity governance for SaaS applications
By the numbers:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption.
Questions worth separating out
Q: How should security teams govern SaaS access across multiple cloud applications?
A: Security teams should centralise discovery, normalise entitlement models, and tie provisioning and deprovisioning to lifecycle events.
Q: Why do SaaS applications create more identity governance risk than simple login systems?
A: Because the hard part is not authentication, it is entitlement complexity.
Q: What breaks when SaaS access reviews focus only on accounts instead of entitlements?
A: Reviews can show that an account exists and is active while missing the real exposure hidden in permission sets, API access, inherited roles, and delegated administration.
Practitioner guidance
- Build a complete SaaS inventory Continuously discover approved apps, department-owned tools, shadow SaaS, and third-party integrations so governance starts from a real estate map instead of assumptions.
- Tie SaaS deprovisioning to lifecycle events Connect onboarding, transfers, promotions, contractor engagement, and termination events to automated access removal across connected cloud applications.
- Normalise entitlement models before review automation Map roles, permission sets, API scopes, delegated admin groups, and inherited access into a common inventory so certifications reflect effective privilege.
What's in the full article
SecurEnds's full article covers the operational detail this post intentionally leaves for the source:
- Specific connector and integration examples for SaaS, ERP, HR, and identity repositories
- Workflow detail for automated provisioning, certification, and remediation across connected applications
- Policy and reporting examples for segregation of duties monitoring and audit evidence collection
- Application-specific governance considerations for Salesforce, Workday, ServiceNow, SAP, and Oracle
👉 Read SecurEnds's analysis of SaaS identity governance for cloud applications →
SaaS identity governance: what IAM teams need to tighten now?
Explore further
01/07/2026 2:19 am
Shadow SaaS is not a procurement problem, it is an identity control failure. When teams can subscribe to cloud apps without central visibility, the enterprise loses the ability to govern access at the point of creation. That breaks the assumption that application inventory is authoritative. The result is unmanaged access paths, inconsistent controls, and certification evidence that never covers the full estate. Practitioners should treat discovery as an identity prerequisite, not a reporting task.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to 2024 ESG Report: Managing Non-Human Identities.
- Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, with a quarter encountering multiple attacks.
A question worth separating out:
Q: Who should be accountable for SaaS identity governance in distributed environments?
A: Accountability should sit with the application owner, the identity team, and the business sponsor together. SaaS governance fails when ownership is blurred, because no one can reliably approve access, validate necessity, or act on remediation across the full lifecycle.
👉 Read our full editorial: SaaS identity governance is now core identity control for enterprises
