Topic starter
27/08/2026 8:35 am
TL;DR: Identity hygiene depends on visibility, governance, and modern SSO coverage, because shadow SaaS adoption and token-based SSO weaknesses can expand attack paths across the enterprise, according to Unixi. The core issue is that IAM programmes often assume they can govern what they cannot see, which fails once users create unsanctioned application accounts.
Editorial analysis by NHI Mgmt Group, based on content published by Unixi: “Visibility, Control, and Modern SSO: Elevating IAM Hygiene”.
By the numbers:
- 80% of employees adopt SaaS applications without IT approval, according to Unixi.
Key questions
Q: What breaks when users can create shadow SaaS accounts without approval?
A: Governance breaks because the organisation loses inventory, lifecycle, and revocation control over the accounts created outside policy.
Q: Why do shadow SaaS environments create so much operational risk for identity teams?
A: Shadow SaaS creates risk because security teams lose consistent control over discovery, user justification, and access revocation.
Q: How do security teams tell whether SSO coverage is actually sufficient?
A: They measure coverage by application and session path, not by whether users can log in successfully.
Practitioner guidance
- Map shadow SaaS discovery to identity inventory Build a discovery process that identifies unsanctioned applications created with corporate email and ties each app back to the identities using it.
- Measure SSO coverage by application, not by login volume Separate applications that are federated from those that still rely on local passwords or ad hoc access.
- Insert SaaS approval into the intake path Require review before new SaaS tools are adopted so application creation, data sharing, and identity provisioning do not happen outside policy.
Bottom line: Shadow SaaS creates an identity governance gap because users can create and populate applications outside approved workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/08/2026 8:35 am
Shadow SaaS is an identity governance failure before it is a software sprawl problem: the moment employees can create application accounts outside approved workflows, the organisation has already lost lifecycle control over those identities. Discovery is only the first test; the real failure is that local accounts, sharing links, and delegated access can persist beyond any access review process. That turns SaaS adoption into an identity governance blind spot, not just an inventory gap. Practitioners need to treat unsanctioned app adoption as a governance boundary breach, not a peripheral IT issue.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations prioritise SaaS visibility over app approval reviews?
A: Yes, when the environment already contains shadow SaaS. Approval reviews help only for known services, while visibility is what reveals the hidden ones and the connections between them. Without discovery, review cycles certify an incomplete estate and miss the access paths most likely to create data exposure or lateral movement.
👉 Read our full editorial: Identity hygiene gaps are exposing shadow SaaS and SSO risk