What breaks when user access reviews rely on directory data alone?

Why directory-only reviews miss the control objective

Directory data is a useful starting point, but it is not the same thing as the full access estate. A review built only from the identity provider can confirm what the directory knows, yet still miss direct application accounts, vendor-managed access, local entitlements, and other live paths that were granted elsewhere. That makes the certification process look complete while leaving material access outside the review boundary.

In practice, the gap matters because access governance is supposed to validate actual effective access, not just records in one system of truth. A directory-only campaign can therefore produce a formally clean attestation that does not reflect how people really reach sensitive apps, data, and functions. Access Reviews and Certification Guide is a useful companion when the goal is to design reviews that catch real access rather than administrative snapshots.

Where the blind spots usually come from

The most common failure mode is fragmented entitlement data. Some permissions are created inside SaaS platforms, some are inherited through federated roles, some sit in legacy directories, and some are granted directly to service teams or third parties without a matching directory record. If the reviewer only inspects the directory, those permissions are invisible and never challenged.

This is why the review design has to match the actual control plane, not the preferred reporting source. A good identity process accounts for joiner-mover-leaver changes, role assignments, application-specific grants, and non-directory accounts as part of one entitlement picture. IAM and IGA Basics helps anchor that broader view, and IGA Buyer's Guide is relevant when the organisation needs connectors and coverage across disconnected applications.

What a complete certification should prove

A useful review proves that the organisation can enumerate access across the full estate, assign ownership for each access path, and decide whether the access is still justified. That usually means reconciling directory data with application inventories, privileged pathways, SaaS admin consoles, and any shadow IT discovered outside the central identity stack.

For complex estates, the practical test is whether the reviewer can explain every access item in terms of business need, owner, and revocation path. If an access right cannot be mapped back to an accountable owner and a removal mechanism, it is not really governed. Identity Visibility and Intelligence Platforms (IVIP) Guide is helpful when the core issue is finding the hidden access that a directory alone will not show.

Risk and Threat Considerations

Directory-only reviews create a false negative problem: the organisation believes access is clean because the sampled records look clean, while unmanaged permissions continue to exist elsewhere. That leaves shadow IT, direct SaaS use, stale entitlements, and excess privilege outside governance, which is exactly where attackers and insiders benefit from weak oversight.

Failure mechanism: The control scope is narrower than the real access surface, so review evidence is derived from incomplete inventory and misses active permissions that were created outside the identity provider.

Impact: The organisation certifies incomplete access, weakens least-privilege enforcement, and may fail to revoke high-risk access that remains exploitable after the review closes.

Practitioner Guidance

What to verify: Verify that the access review source set includes application-native entitlements, federated and delegated access, privileged accounts, and any known shadow IT or direct SaaS paths. If those sources are absent, treat the review as partial, not complete.

Decision rule: If an application can grant or retain access independently of the directory, the review must consume that application’s entitlement data as well as directory records. If it cannot, you still need evidence that no parallel access path exists before you trust the certification.

What good looks like: A reviewer can trace each meaningful access path to an owner, a justification, and a revocation mechanism, and the review outcome changes when non-directory access is discovered rather than merely recording it.

Practitioner takeaway: Directory accuracy is necessary, but governance only works when the review covers every place access can actually live, otherwise the process certifies confidence instead of control.

Related resources from NHI Mgmt Group

• Why do user access reviews fail when teams rely on identity-provider data alone?
• What breaks when access reviews rely on memory instead of ownership data?
• What breaks when access reviews rely on stale entitlement data?
• What breaks when organisations rely on user judgment alone to protect sensitive data in AI prompts?