Topic starter
08/07/2026 7:01 pm
TL;DR: Spreadsheet-based access reviews fail in SaaS-heavy environments because static exports cannot keep pace with changing entitlements, fragmented SaaS authorization models, and disconnected remediation, according to OpenIAM. The governance gap is not reviewer effort but an access-certification model built for stable systems that no longer exist.
Editorial analysis by NHI Mgmt Group, based on content published by OpenIAM: “Why Spreadsheet-Based Access Reviews Fail in SaaS Environments”.
Key questions
Q: What breaks when SaaS access reviews rely on spreadsheets?
A: Spreadsheets freeze access data in time, so reviewers work from stale exports while roles, teams, and app usage keep changing.
Q: Why do spreadsheet access reviews create governance risk in hybrid identity estates?
A: Hybrid estates combine AD, Entra ID, SaaS admin portals, and application-specific authorization models, so no single export fully represents the live access picture.
Q: How do organisations know if access certification is actually working?
A: Look for shrinking numbers of standing privileges, faster revocation after review decisions, and fewer orphaned or overprivileged accounts over time.
Practitioner guidance
- Replace snapshot-based certification with live access state Pull current entitlements from SaaS, directory, and admin systems at the point of review instead of certifying static exports that age during the campaign.
- Normalise entitlement context before reviewer sign-off Map technical role codes to business-readable ownership, risk, and function data so managers can judge whether access still matches job need.
- Make remediation evidence mandatory Do not close a review until the revocation or downgrade has been confirmed in the target system, not just recorded in a spreadsheet or ticket.
Bottom line: Spreadsheet-based access reviews fail because they certify stale snapshots in environments where entitlements change continuously.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/07/2026 7:25 pm
Spreadsheet certification is a control-model failure, not a process-efficiency problem: The article shows that manual reviews were built for stable access estates and now collide with continuous entitlement change. That means the failure is not reviewer diligence but the assumption that a periodic snapshot can represent current authorisation state. The practitioner conclusion is that certification must be redesigned around live identity state, not better spreadsheet hygiene.
A few things that frame the scale:
- 1 in 3 organisations encountered suspicious AI agent activity in 2025, and 99.4% experienced a SaaS or AI ecosystem incident.
A question worth separating out:
Q: What should organisations do when access reviews cannot keep up with SaaS change?
A: They should shift from fixed-interval spreadsheet campaigns to live, risk-based governance that prioritises privileged access, frequent change, and high-impact systems. The goal is to review current access with current context and close the loop with verified remediation. That reduces reviewer fatigue while improving the quality of the control.
👉 Read our full editorial: Spreadsheet-based access reviews fail in SaaS-heavy identity