How should teams choose between SaaS-first and ERP-first identity governance models?

Why This Matters for Security Teams

Identity governance only works when the operating model matches how access is actually consumed. SaaS-first governance is designed for broad application sprawl, fast-changing entitlements, and rapid onboarding and offboarding. ERP-first governance is better suited to structured enterprise systems where segregation of duties, role design, and transaction-level access reviews drive the risk profile. Teams that pick the wrong model often end up optimising for reporting convenience instead of control effectiveness.

This distinction matters because identity risk is usually concentrated where access is both plentiful and hard to see. NHIMG notes in the Ultimate Guide to NHIs that 97% of NHIs carry excessive privileges, which is a reminder that visibility and entitlement discipline matter as much for machine access as they do for people. That aligns with the broader governance posture reflected in the NIST Cybersecurity Framework 2.0, which treats access control as an ongoing operational capability rather than a one-time design choice.

In practice, many security teams discover the mismatch only after access reviews become unmanageable or a separation-of-duties gap has already been exploited.

How It Works in Practice

SaaS-first governance typically starts with identity sources, app connectors, and policy workflows that can absorb rapid change across many applications. It works best when the control objective is to remove excess access, standardise approvals, and detect drift across cloud apps, collaboration tools, and business SaaS. ERP-first governance takes a different path: it focuses on entitlements nested inside business roles, posting permissions, workflow approvals, and SoD constraints that must be evaluated at a much deeper level.

A practical way to choose is to map the dominant review burden. If most effort goes into access lifecycle management across dozens or hundreds of apps, SaaS-first usually provides better coverage. If most audit findings come from toxic combinations inside SAP or Oracle, ERP-first usually gives more precise control. The key is not just where identities live, but where risk accumulates.

• Use SaaS-first when entitlements are wide, shallow, and frequently changing.
• Use ERP-first when access is deep, transaction-sensitive, and audit-driven.
• Use both when ERP remains the system of record for finance or supply chain, while SaaS dominates the rest of the enterprise.
• Align reviews to the control plane that actually grants privilege, not just to the directory that stores the account.

NHIMG’s Lifecycle Processes for Managing NHIs section is useful here because the same lifecycle discipline applies to service accounts and API keys, especially when teams rely on entitlement systems to trigger review, rotation, and offboarding. Where those lifecycle controls are weak, the problem quickly becomes operational, not just architectural.

These controls tend to break down in highly customised ERP landscapes because role mining, inherited access, and exception handling make clean governance boundaries difficult to maintain.

Common Variations and Edge Cases

Tighter ERP governance often increases review overhead, so organisations have to balance audit precision against the operational cost of maintaining detailed entitlement models. That tradeoff is especially visible in hybrid environments where finance sits in ERP, but workflows, analytics, and supporting operations have moved into SaaS.

There is no universal standard for this yet, but current guidance suggests avoiding a single governance model for every application class. A common failure mode is using SaaS-first processes for ERP simply because the tooling is easier, which can miss nested privilege chains and SoD conflicts. The reverse also creates problems: forcing ERP-style controls onto SaaS sprawl can slow access decisions without materially improving risk reduction.

Teams should also be careful with machine access. As NHIMG highlights in Top 10 NHI Issues, visibility gaps and excessive privileges are recurring problems, and the same governance model can fail if it assumes static, human-shaped access patterns. For that reason, identity governance should be segmented by workload, not treated as a single enterprise-wide control template.

For organisations building a mixed model, the safest approach is usually to set SaaS-first as the broad baseline, then apply ERP-first depth only where transaction integrity, regulatory reporting, or segregation of duties make it necessary.

Related resources from NHI Mgmt Group

• How should teams choose between ISO 27001 and SOC 2 for identity governance?
• How should security teams choose between Zero Trust and Defense in Depth for identity governance?
• How should teams close the gap between security alerts and identity remediation?
• How should security teams evaluate identity governance platforms that rely on integration libraries?