Should organisations prioritise protocol cleanup or consent governance first?

How to decide what to clean up first

Use the control path that currently creates the longest-lived, hardest-to-revoke access. Legacy protocols are usually the first place to look when they still allow broad authentication, because they can bypass stronger modern controls and remain usable across many apps. If that surface is already tight, consent governance becomes the higher-value lever because identity privacy and consent governance can keep delegated access alive even after an account password changes.

In practice, protocol cleanup is a containment problem, while consent governance is an authorization and review problem. The right priority depends on which path gives an attacker the more durable foothold in your environment, not on which control team owns the issue.

Why legacy protocol cleanup often comes first

Broadly enabled legacy authentication is dangerous because it often permits access through older clients, weaker flows, or compatibility exceptions that security teams stop watching closely. If those protocols are still live, an attacker may not need to abuse the user’s primary login at all, and the exposure can extend across mail, file, and collaboration systems.

That is why protocol cleanup is usually the first move when modern authentication is not yet the dominant path. You are reducing the number of ways an identity can be reached, shrinking the attack surface before spending time on finer-grained review processes. For reference, the protocol landscape itself is maintained in registries such as IANA, which is a useful reminder that cleanup starts with knowing exactly which protocols and identifiers are actually in use.

Once legacy paths are constrained, the remaining risk shifts from “can someone still log in by an old method?” to “what delegated access already exists, and who approved it?” That is where consent review becomes more important than broad protocol removal.

Why consent governance becomes the priority after modern protocols are controlled

Consent grants, OAuth applications, and delegated permissions can outlast passwords and sometimes outlast user awareness. If modern authentication is already well controlled, then the more durable risk is often an application that still holds permission to read mail, access files, or act on behalf of a user. The control problem is not authentication anymore, it is continued authorization.

Consent governance matters because it changes the blast radius after initial compromise. A user can reset credentials and still leave a malicious or overbroad application with valid access. That is why app review, scope restriction, and token lifecycle discipline should move up the list once legacy protocol exposure is no longer the dominant issue.

For security baselines, this sequencing aligns with broader control catalogues such as NIST SP 800-53 Rev. 5 security and privacy controls, which separate authentication, access control, and monitoring concerns rather than treating them as one problem.

How to choose the right sequence in your environment

If legacy authentication is still broadly available, clean it up first. That is the fastest way to remove a durable access path and force activity through the better governed modern stack. If legacy use is already narrow, then move to consent governance, token review, and application inventory because that is where persistent delegated access usually hides.

The practical decision rule is simple: fix the path that can still authenticate or authorize access with the least resistance. In many environments that means protocol cleanup first, then consent review. In mature environments it may be the reverse because the legacy path is already mostly gone and the remaining exposure sits in long-lived grants.

Practitioner Guidance

What to prioritise: Start with whichever control removes the broadest surviving access path. If you can still authenticate through a legacy protocol at scale, reduce that first before spending cycles on application consent reviews.

What to verify: Confirm whether the protocol is merely deprecated or actually blocked, and verify whether granted applications can still read, send, or impersonate on behalf of users after a password reset.

Decision rule: If a control can still provide durable access without a fresh interactive login, treat it as the higher-priority cleanup item. If both paths are tightly constrained, shift attention to token lifetime and app approval governance.

Practitioner takeaway: Prioritise the control that most directly shortens attacker dwell time and limits persistence, because the best first move is the one that removes the strongest surviving route to durable access.

Related resources from NHI Mgmt Group

• Should organisations prioritise external exposure or internal credential governance first?
• Should organisations prioritise secrets governance or role cleanup first in Salesforce?
• Should organisations prioritise tool scoping or skill governance first for AI agents?
• What should organisations prioritise first in NHI governance?