Topic starter
12/06/2026 10:07 pm
TL;DR: Zero trust can reduce exposure in SaaS-heavy environments, but it still depends on visibility, enforceable controls, and identity governance across users, devices, and permissions, according to Axiad. The real challenge is not adopting the label, but removing the trust assumptions that let access drift beyond what teams can actually govern.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “Do You Need a Zero-Trust SaaS?”.
Key questions
Q: What breaks when zero trust stops at SSO in SaaS environments?
A: Access removal becomes incomplete because SaaS applications often retain direct grants, delegated connections, and local admin roles after the directory account is disabled.
Q: Why do passwordless logins not solve SaaS zero-trust governance on their own?
A: Passwordless login removes password risk, but it does not decide who should have access, which privileges should remain, or when access should be revoked.
Q: How should security teams implement Zero Trust SaaS in practice?
A: Start with discovery, because Zero Trust SaaS cannot be enforced without knowing which apps, identities, tokens, and integrations exist.
Practitioner guidance
- Inventory SaaS identity touchpoints Map every SaaS application, user population, device context, and entitlement source that influences access decisions so gaps are visible before policy work begins.
- Separate authentication from authorization Treat passwordless and other sign-in improvements as only one layer of the zero-trust model, and keep entitlement governance distinct from login controls.
- Reconcile stale permissions continuously Review group membership, direct grants, and role-based access in SaaS platforms on a recurring basis so historical access does not outlive current job need.
Bottom line: Zero trust in SaaS fails when identity, device, and entitlement data are too fragmented to support consistent enforcement.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
13/06/2026 12:40 am
Identity visibility is the real zero-trust prerequisite in SaaS. The article’s core point is not that zero trust fails in SaaS, but that it cannot be enforced without accurate knowledge of users, devices, and permissions across a fragmented application estate. Zero trust becomes an aspiration rather than an operating model when the programme cannot see the identities it is supposed to govern. The practitioner conclusion is straightforward: visibility is not a reporting feature, it is the control substrate.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should IAM teams prioritise before expanding zero trust across SaaS?
A: IAM teams should prioritise visibility into who and what can access each application, then align entitlement governance to that view. If the programme cannot inventory users, devices, permissions, and application ownership, the zero-trust model will remain difficult to enforce consistently across the estate.
👉 Read our full editorial: Zero trust SaaS exposes the identity visibility gap in modern environments
This post was modified 6 days ago by NHI Mgmt Group