What do organisations get wrong about identity governance in hybrid and SaaS environments?

Why This Matters for Security Teams

Hybrid and SaaS identity governance fails most often when teams treat every application as if it fits the same control model. That assumption works poorly once accounts, APIs, service principals, OAuth grants, and machine identities all coexist with human users. NHI Management Group’s research shows that identity risk is not theoretical: the 2024 ESG Report: Managing Non-Human Identities found that 72% of organisations have experienced or suspect a breach of non-human identities.

The practical problem is that governance, access review, and lifecycle controls often lag behind how SaaS is actually deployed. Teams may have decent joiner-mover-leaver processes for employees, but they still miss orphaned OAuth grants, stale API keys, overprivileged service accounts, and app-to-app trust that survives beyond its business purpose. That gap shows up in audit findings, incident response, and shadow IT exposure. Current guidance from the NIST Cybersecurity Framework 2.0 emphasises governance and continuous risk management, but many organisations still apply it through manual review cycles that are too slow for SaaS sprawl. In practice, many security teams discover governance failures only after a connector, token, or delegated app has already been abused.

How It Works in Practice

Effective identity governance in hybrid and SaaS environments starts with recognising that not all identities are interactive people. A workable model separates humans, non-human identities, and delegated app access, then assigns different lifecycle rules to each. For humans, HR-driven provisioning and periodic certification may be enough. For SaaS and hybrid workloads, governance has to include configuration discovery, entitlement mapping, automated revocation, and continuous verification of what each identity can actually do.

That usually means integrating identity governance with source systems, SaaS admin APIs, and cloud control planes so policy is enforced where the entitlement exists, not after the fact. It also means treating secrets and tokens as first-class governance objects. If a service account is granted broad access in one tenant, that privilege should be visible in reviews, tied to ownership, and automatically removed when the application is retired. NHI Management Group’s Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs is useful here because it frames governance as an ongoing lifecycle, not a one-time inventory exercise.

• Discover all identity types, including human users, service accounts, API keys, OAuth apps, and federated workloads.
• Classify access by business function, data sensitivity, and administrative scope.
• Automate provisioning and deprovisioning through source-of-truth workflows.
• Review high-risk entitlements more frequently than low-risk ones.
• Revoke dormant, unused, or unowned access without waiting for the next certification cycle.

For implementation detail, the CISA cloud security guidance and identity governance patterns in NIST CSF 2.0 both support continuous control validation rather than static entitlement snapshots. These controls tend to break down when SaaS admins can create local exceptions faster than governance workflows can detect and reconcile them.

Common Variations and Edge Cases

Tighter governance often increases operational overhead, requiring organisations to balance control depth against admin friction and application velocity. That tradeoff is especially visible in mixed environments where on-prem directory policy, cloud-native identity, and third-party SaaS permissions do not share the same ownership model.

One common edge case is delegated access through OAuth or marketplace apps. These integrations can look harmless in a directory report while still holding broad read or write privileges in production systems. Another is M&A activity, where inherited tenants bring undocumented identities, duplicated admins, and inconsistent lifecycle ownership. Guidance is still evolving on the best way to govern these situations, but current practice suggests using risk-based certification and mandatory ownership assignment instead of waiting for a perfect unified model. NHI Management Group research on the Top 10 NHI Issues highlights how rotation, visibility, and privilege drift repeatedly surface as control failures, while the 52 NHI Breaches Analysis shows how quickly overlooked credentials become incident paths.

For hybrid estates, the hardest cases are identities that span multiple trust domains, such as an on-prem workload that authenticates to SaaS through federated tokens and then calls downstream APIs. In those environments, static review cadences are rarely enough because the real access path is dynamic, transitive, and easy to miss unless governance spans directory, cloud, and application layers.

Related resources from NHI Mgmt Group

• What do security teams get wrong about SaaS governance in hybrid work environments?
• What do security teams get wrong about using CASB or SSPM tools to manage SaaS identity risk?
• What do security teams get wrong about group accounts in SaaS environments?
• What do organisations get wrong about passwordless rollout in hybrid environments?