How should security teams handle password management when SSO is already in place?

Why This Matters for Security Teams

Even when SSO is broadly deployed, password management still matters because SSO only covers the applications that actually participate in federation. Many organisations retain a long tail of SaaS tools, legacy platforms, break-glass accounts, vendor portals, and shared operational logins that sit outside the SSO boundary. For those systems, unmanaged passwords become a parallel identity plane with weaker revocation, inconsistent ownership, and poor auditability.

This is especially important in environments where secrets sprawl across code, endpoints, and admin consoles. NHIMG research shows that 96% of organisations store secrets outside of secrets managers in vulnerable locations, and 79% have experienced secrets leaks with tangible damage in 77% of those incidents, according to the Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs. That is the same operational pattern security teams see with human passwords when SSO is treated as a full substitute rather than one control layer.

Current guidance from the NIST Cybersecurity Framework 2.0 supports layered identity controls, not a single dependency. In practice, many security teams encounter password risk only after a legacy application, contractor account, or emergency access path has already bypassed SSO entirely.

How It Works in Practice

The operational model is straightforward: SSO remains the preferred path for federated applications, while a password manager becomes the control point for anything that cannot use federation or modern token-based access. That means unique passwords, centrally governed vaulting, automatic rotation where supported, and fast revocation when a user changes role or leaves. The objective is not to preserve passwords as a preferred method; it is to remove unmanaged passwords from the exception path.

Teams usually get better results when they treat password management as part of identity lifecycle governance. The same lifecycle discipline used for NHIs applies here: know where credentials exist, define ownership, reduce standing access, and revoke quickly when context changes. NHIMG’s NHI Lifecycle Management Guide is useful as a conceptual reference because the failure mode is similar: credentials outlive the need for them.

• Inventory every direct-login application that sits outside SSO.
• Enforce unique, vaulted passwords for each user or shared account.
• Prefer JIT access for privileged use cases instead of permanent credentials.
• Rotate passwords on departure, role change, and high-risk events.
• Monitor for reuse, vault drift, and orphaned accounts.

For teams aligning to baseline controls, NIST SP 800-53 Rev 5 Security and Privacy Controls remains the clearest reference for access control and account management expectations. These controls tend to break down in organisations with multiple business units using locally approved SaaS tools, because the password manager is only as effective as the inventory and offboarding process behind it.

Common Variations and Edge Cases

Tighter password governance often increases friction for users and help desks, so organisations have to balance convenience against coverage. The most common edge case is the application that technically supports SSO but still requires a local account for admin functions, emergency access, or integration work. Another is shared or service accounts, where human password practices are often misapplied to credentials that should instead follow NHI controls and stronger lifecycle rules.

Best practice is evolving, but current guidance suggests three practical distinctions. First, user passwords for non-federated apps should be vaulted and individually assigned where possible. Second, privileged or emergency accounts should be separated from daily user access and protected with stronger approval, logging, and recovery procedures. Third, machine credentials should not be managed as if they were human passwords. For those, the stronger pattern is short-lived secrets, workload identity, and policy-based access rather than long-lived shared passwords.

This distinction matters because SSO reduces the human password footprint, but it does not eliminate credential risk across the enterprise. NHIMG’s Top 10 NHI Issues and the Ultimate Guide to NHIs — Regulatory and Audit Perspectives both reinforce the same point: unmanaged credentials become a governance problem long before they become a login problem.

Related resources from NHI Mgmt Group

• How should security teams handle stolen OAuth tokens when MFA is already in place?
• How should security teams handle access requests when ITSM tools are already in place?
• How should security teams handle trust signals when cryptography is already in place?
• What should security teams check after an in-place restore?