SSO centralises authentication, but it does not automate account lifecycle by itself. If provisioning is manual, admins still create and remove accounts by hand, which increases delay, inconsistency, and orphaned access risk. The biggest gap appears when a user leaves, because app accounts can remain active unless offboarding is tied to a controlled provisioning process.
Why This Matters for Security Teams
Single sign-on simplifies authentication, but it does not close the lifecycle gap between an identity being approved and an application account actually being created, modified, or removed. When provisioning is still manual, access depends on ticket handling, spreadsheet tracking, and human follow-through. That creates delay, inconsistent entitlements, and orphaned accounts after role changes or departures. NIST Cybersecurity Framework 2.0 treats identity governance as an ongoing control activity, not a one-time login feature.
NHI Management Group research shows the scale of the problem: only 20% of organisations have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them. The same lifecycle weakness applies to app accounts behind SSO when joiner-mover-leaver actions are handled manually. Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs and Top 10 NHI Issues both highlight how lifecycle failures become security failures. In practice, many security teams discover stale access only after an offboarding event has already been missed.
How It Works in Practice
SSO authenticates the user at the front door, but the application still needs an internal account, group membership, role mapping, and sometimes local permissions before access is actually usable. If those steps are done by hand, the organisation has no reliable control plane for lifecycle state. The result is a split identity model: the directory says one thing, the app says another, and the security team assumes both are aligned.
Good practice is to connect identity events to automated provisioning and deprovisioning, usually through SCIM, workflow orchestration, or tightly governed identity governance tooling. Access should be granted from authoritative sources such as HR or contractor records, then removed automatically when the source of truth changes. NIST SP 800-53 Rev 5 Security and Privacy Controls supports this through access control, account management, and least-privilege expectations. For NHI-adjacent account governance, Ultimate Guide to NHIs explains why lifecycle discipline matters as much as authentication.
- Use the identity provider for authentication, but treat provisioning as a separate control stream.
- Automate joiner, mover, and leaver actions from authoritative records, not manual tickets.
- Apply role-based access only after the app account exists, then review entitlements regularly.
- Revoke access immediately on termination, contract end, or role removal.
This guidance breaks down when applications do not support SCIM or API-based administration, because manual exceptions tend to accumulate faster than teams can review them.
Common Variations and Edge Cases
Tighter lifecycle automation often increases integration overhead, so organisations must balance control coverage against app complexity and legacy constraints. That tradeoff is real, especially where older SaaS tools, custom applications, or acquired business units cannot be integrated quickly.
Best practice is evolving for edge cases. Some teams rely on periodic attestations or compensating controls when an app cannot be automated, but that is a weaker control than event-driven deprovisioning. Where access is shared, local admin-managed, or delegated outside the central identity stack, SSO can create a false sense of coverage because login is centralised while entitlement management is not. The same gap appears when privileged app roles are granted outside normal workflows, because the directory may show a user as removed while the app still retains active access. OWASP Non-Human Identity Top 10 reinforces the broader lesson: identity security fails when credentials and account state are not governed end to end. In practice, manual provisioning gaps surface most often during audits, M&A integrations, and employee exits, when stale access is already embedded in the environment.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC-4 | Access provisioning and deprovisioning must be governed, not left to ad hoc manual handling. |
| NIST SP 800-53 Rev 5 | AC-2 | Account management controls directly address orphaned accounts from manual provisioning. |
| OWASP Non-Human Identity Top 10 | NHI-01 | Manual lifecycle handling is a core non-human identity governance weakness. |
| CSA MAESTRO | GOV-01 | Agentic and non-human workload governance needs lifecycle accountability and policy enforcement. |
| NIST AI RMF | AI RMF supports governance of automated identity workflows and access decisions. |
Assign ownership for every non-human identity and enforce lifecycle policy at issuance and removal.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 27, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
