Organisations should use an identity governance approach that connects access provisioning, de-provisioning, review, and audit trails across the full application mix. The goal is to replace isolated point controls and manual approvals with policy-driven processes that can track who has access, enforce segregation of duties, and support evidence collection across environments.
How to automate access provisioning without fragmenting control
Automating access across ERP, SaaS, and legacy applications works best when one governance layer owns the request, approval, provisioning, de-provisioning, and review workflow, even if the target systems use different technical connectors. The key is to standardise policy and evidence, not to force every application onto the same native control plane. That keeps the process scalable while preserving a consistent audit trail.
Where possible, route requests through a central entitlement model so the business approves access in terms of role, function, or policy, then let connectors translate that decision into the target system’s native account or permission model. For the governance layer, the practical baseline is an identity and access governance model that separates provisioning logic from application-specific implementation.
Legacy applications are usually the hardest part because they often lack modern APIs, native approval hooks, or reliable account metadata. In those cases, automation may need to use file drops, RPA, scripts, or ticket integrations, but the governance requirement stays the same: every action should still map back to an approved entitlement, a change record, and a named owner. If you cannot trace the request to the resulting account state, the automation is too opaque for audit use.
What preserves audit visibility across ERP, SaaS, and legacy systems
Audit visibility depends on capturing the full lifecycle of access, not just the initial grant. Organisations need evidence for who requested access, who approved it, what policy justified it, when it was provisioned, whether it was used, and when it was removed or recertified. A useful control model is to treat the audit trail as a product of the access workflow itself, not as a separate reporting exercise after the fact.
That is especially important when access spans multiple platforms with different log formats and retention rules. A central evidence layer should normalise entitlement, approval, and recertification events so auditors can see one coherent story across systems. An audit evidence and continuous controls monitoring approach helps because it emphasises evidence freshness, lineage, and control testing rather than relying on static screenshots or ad hoc exports.
For ERP environments, audit teams often care about segregation of duties, role design, and emergency access. For SaaS, they usually want proof that role assignment, admin rights, and offboarding are controlled centrally. For legacy applications, the evidence challenge is often completeness, so teams should prove that manual or semi-automated steps still feed the same audit repository and review cadence as the modern stack.
How to avoid SoD conflicts, stale access, and blind spots
Automation fails when it accelerates bad policy. If roles are too broad, if approvals are purely nominal, or if de-provisioning is not tied to joiner-mover-leaver events, the organisation simply creates faster access sprawl. The main risk is not the automation itself, but the false confidence that comes from faster processing without stronger entitlement design.
Segregation of duties needs explicit policy checks before provisioning, especially in ERP where financial or operational conflicts can arise from combining otherwise reasonable entitlements. A well-designed workflow should also catch dormant accounts, orphaned access, and privilege creep during review cycles. That is why many organisations anchor their control design to access control policy statements that define least privilege, review cadence, and joiner-mover-leaver handling in advance.
Another common blind spot is exception handling. Temporary elevation, break-glass access, and legacy admin accounts are often treated as operational shortcuts, then forgotten. Those paths need the same provisioning and de-provisioning discipline as standard access, plus tighter review thresholds because they tend to carry the highest audit and abuse risk.
Risk and Threat Considerations
Automated access control reduces manual effort, but it also concentrates trust: if the workflow, connector, or policy engine is wrong, the same error can propagate to ERP, SaaS, and legacy systems at scale. The biggest exposure is usually excessive privilege, delayed revocation, or incomplete logging, because those failures weaken both prevention and forensic reconstruction.
Failure mechanism: A poorly governed automation layer provisions access faster than reviewers can detect policy errors, and a weak integration to legacy platforms leaves gaps in revocation, recertification, or event capture.
Impact: The organisation can lose segregation of duties, leave stale accounts active after role changes or exits, and fail to prove who had access at a specific time during an audit or investigation.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Covers account provisioning, changes, and removal across systems. |
| AC-6 — Least Privilege | Directly supports limiting ERP, SaaS, and legacy access to required entitlements. | |
| AU-2 — Event Logging | Supports audit visibility by requiring access events to be logged and reviewable. | |
| Recommendation — Centralise account lifecycle decisions and automate revocation when access no longer matches need. Enforce least-privilege role assignment and review elevated access regularly. Log access requests, approvals, provisioning, and removals in a central evidence trail. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Addresses access granting, revocation, MFA, and centralised access control operations. |
| Recommendation — Standardise access granting and revocation so every application follows the same control process. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Applies to organisational access control policy and enforcement across mixed application estates. |
| Recommendation — Define and enforce access rules consistently across ERP, SaaS, and legacy systems. | ||
Practitioner Guidance
What to prioritise: Start with the controls that create durable evidence, namely request, approval, entitlement, provisioning, recertification, and de-provisioning records. If those six steps are not consistent across ERP, SaaS, and legacy systems, the automation will improve speed but not assurance.
What to verify: Confirm that every connector writes the same core metadata, including requestor, approver, target entitlement, effective time, expiry or removal time, and exception reason where relevant. If a platform cannot produce that lineage, treat it as a control gap, not just a reporting limitation.
What good looks like: Access decisions are policy-driven, exceptions are time-bound, and auditors can reconstruct the full access history without chasing screenshots, emails, or one-off extracts from each application team.
Practitioner takeaway: The real test is whether automation makes access more governable, not just faster, so design the workflow around traceability, revocation, and review from day one.
Related resources from NHI Mgmt Group
- Visibility
- How should security teams automate access reviews and audit reporting in ERP environments without losing governance control?
- How should security teams control SaaS renewals without losing visibility across departments?
- How should organisations automate SaaS access requests without losing control?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 5, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org