Topic starter
02/02/2026 9:12 pm
TL;DR: Unchecked SaaS adoption fragments access, expands the attack surface, and drives permission sprawl across departments, according to Linx Security. Centralised identity governance is no longer optional if organisations want to keep procurement, access reviews, and compliance aligned.
Editorial analysis by NHI Mgmt Group, based on content published by Linx Security: “Taming SaaS Sprawl Through Identity Management: The Key to Securing Your SaaS Environment”.
Key questions
Q: What breaks when identity governance is not aligned with modern access control in SaaS environments?
A: When governance lags behind access control, organisations lose visibility into who has access, why it was granted, and whether it is still needed.
Q: Why do decentralised SaaS purchases create security and cost risk?
A: Decentralised purchasing breaks the connection between approval, visibility, and renewal.
Q: How do teams know whether SaaS access reviews are actually working?
A: Look for reduction in orphaned accounts, faster revocation after role change, and fewer exceptions repeated across successive review cycles.
Practitioner guidance
- Centralise SaaS intake control Route every new SaaS request through a shared approval flow that checks identity model, role design, and offboarding ownership before activation.
- Inventory SaaS entitlements continuously Maintain a live map of applications, owners, roles, and delegated access so reviewers can see where permissions are duplicating or persisting after role changes.
- Tie access reviews to lifecycle events Trigger entitlement review when employees change teams, gain new roles, or leave, so SaaS access is removed before old permissions become normalised.
Bottom line: SaaS sprawl creates a governance gap because access is often granted before central review, not after it.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
11/10/2026 6:02 am
SaaS sprawl is an identity governance failure, not just an application sprawl problem. The security issue appears when departments can create access paths outside the normal governance sequence, leaving permissions fragmented across many control planes. That fragmentation turns every new SaaS tool into a separate entitlement island, which is why privilege sprawl is the predictable outcome. Practitioners should treat SaaS adoption as an identity lifecycle event, not a software procurement convenience.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
- 1 in 3 organisations encountered suspicious AI agent activity in 2025, and 99.4% experienced a SaaS or AI ecosystem incident.
A question worth separating out:
Q: What should IAM teams do when business units keep buying their own SaaS tools?
A: They should move governance to the intake stage and require shared ownership for every new app. That means no live SaaS deployment until the identity model, approval route, and offboarding responsibilities are documented. If teams can bypass intake, the organisation will keep inheriting shadow IT, fragmented entitlement records, and preventable access cleanup work.
👉 Read our full editorial: SaaS sprawl shows why identity governance must start earlier