Topic starter
11/06/2026 11:02 pm
TL;DR: 52% of employees download work apps without IT approval, 37% do not always follow AI usage policies, and 70% of security leaders say SSO is insufficient for managing employee identities, according to 1Password’s annual report, underscoring how SaaS sprawl outpaces centralized governance. The access problem is no longer login alone, but discovery, lifecycle control, and policy enforcement across managed and unmanaged apps.
Editorial analysis by NHI Mgmt Group, based on content published by 1Password: “Automating SaaS management: Extend IAM to regain time, trust, and control”.
By the numbers:
- 52% of employees admit to downloading work apps without IT approval.
- 37% admit they don’t always follow their company’s AI usage policies.
- 70% of security leaders say SSO is insufficient for managing employee identities.
Key questions
Q: What breaks when SaaS purchases bypass central procurement and IT approval?
A: When SaaS purchases bypass central approval, organisations lose the link between buying authority, asset inventory, and access ownership.
Q: Why does SSO fail to solve the access-trust gap on its own?
A: SSO solves federation at the login screen, but it does not govern app discovery, unused licenses, dormant accounts, or unfederated tools.
Q: How do unmanaged SaaS apps undermine joiner, mover, leaver processes?
A: Unmanaged apps undermine JML because lifecycle actions only work when every account is known and tied to a governed system.
Practitioner guidance
- Map the unmanaged app estate Use browser, finance, HR, and identity integrations to build a live inventory of SaaS and AI tools that exist outside SSO.
- Automate offboarding across unfederated apps Trigger account disablement, license reclamation, and role-based access removal from one workflow instead of separate tickets.
- Rebuild JML around discovered applications Tie joiner, mover, and leaver actions to actual application discovery so account lifecycle reflects reality, not assumptions.
Bottom line: SaaS sprawl creates an identity blind spot that SSO alone cannot close because the real problem is discovery and lifecycle control across sanctioned and unsanctioned apps.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 7:32 am
Access governance now fails at the discovery layer, not just the authorization layer: IAM programmes were built to control known applications and known users, but SaaS sprawl creates accounts the directory never sees. Once an app sits outside federated control, the programme cannot certify, revoke, or even inventory it reliably. The practitioner conclusion is that visibility has become a prerequisite for access governance, not a reporting enhancement.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should teams do when identity governance does not cover shadow IT?
A: Teams should treat discovered application inventory as the starting point for access governance, then automate onboarding, offboarding, and license control across those apps. If the control model only covers sanctioned systems, the remaining estate stays outside review, revocation, and compliance evidence.
👉 Read our full editorial: SaaS sprawl is exposing the access-trust gap in enterprise IAM
This post was modified 1 day ago by NHI Mgmt Group