Unmanaged logins bypass the identity processes that give teams visibility into access, ownership, and offboarding. Once business users create accounts directly, those credentials can persist beyond role changes or project end dates. That raises both human and non-human identity risk because the organisation cannot reliably apply lifecycle controls to what it cannot see.
Why This Matters for Security Teams
Unmanaged SaaS and AI tool logins create shadow access paths that sit outside normal identity governance. That matters because access reviews, offboarding, and privilege controls only work when accounts are visible, owned, and tied to a lifecycle. Once a user signs up directly, the organisation may lose the ability to enforce joins, moves, exits, or sponsor approvals. This is also where NHI exposure grows, because SaaS apps, AI assistants, and automation tools often rely on tokens and API credentials that outlive the person who created them.
Current guidance aligns with the NIST Cybersecurity Framework 2.0 view that identity governance must support visibility, least privilege, and recovery. NHIMG’s Top 10 NHI Issues also highlights that unmanaged credentials are rarely an isolated problem; they are usually the entry point for persistence, excess privilege, and weak revocation. In the 2024 ESG Report: Managing Non-Human Identities, Oasis Security & ESG reported that 72% of organisations have experienced or suspect a breach of non-human identities, which shows how quickly hidden access can become an incident.
In practice, many security teams discover unmanaged logins only after a project ends, an employee leaves, or an AI tool keeps working with credentials no one remembered to revoke.
How It Works in Practice
The risk starts when business users create SaaS or AI accounts with personal email, self-service sign-up, or unsanctioned OAuth grants. Those accounts often bypass SSO, joiner-mover-leaver workflows, and ownership assignment. If the tool can connect to storage, chat, code, CRM, or ticketing systems, the login may also create a non-human identity trail through refresh tokens, service accounts, app registrations, or delegated permissions.
That is why identity teams increasingly treat this as both SaaS sprawl and NHI sprawl. A login without an owner is not just an orphaned user account, it can become a credential container for workflows, bots, and integrations. The safer pattern is to anchor access to centrally governed identity proof, then provision access only when needed. NHIMG’s NHI Lifecycle Management Guide is useful here because it frames the operational controls around creation, approval, monitoring, rotation, and revocation rather than around the tool itself. For IAM teams, the practical steps usually include:
- Discovering unsanctioned logins through SSO logs, SaaS inventory, CASB telemetry, and consent grants.
- Requiring owned accounts, named sponsors, and business justification for any direct login.
- Replacing long-lived static credentials with short-lived access where possible.
- Reviewing OAuth scopes, API keys, and refresh tokens as part of access certification.
- Revoking dormant accounts and disabling shadow integrations on offboarding.
For AI-specific tools, the problem is often worse because a human login can quickly expand into agentic access. Once the user authorises a tool to read mail, documents, code, or tickets, the tool may chain actions across systems in ways the original approver never intended. That is why the OWASP NHI Top 10 and agentic risk guidance are increasingly relevant even for what looks like a simple SaaS login. These controls tend to break down when users can self-authorise third-party apps against production data because revocation and ownership tracking become fragmented across multiple consoles.
Common Variations and Edge Cases
Tighter control over SaaS and AI logins often increases friction, so organisations must balance user convenience against governance depth. That tradeoff is real: the more business units rely on fast self-service tooling, the more important it becomes to classify which logins are allowed, monitored, or blocked.
Best practice is evolving for AI tools that use delegated access. There is no universal standard for this yet, but current guidance suggests treating consented app access, browser-based AI assistants, and embedded copilots as privileged pathways when they can read or write enterprise data. The same applies when a low-risk collaboration tool later gains automation features and starts storing reusable credentials. NHIMG’s Ultimate Guide to NHIs — Key Challenges and Risks is especially relevant because it reflects the governance gap between visible human logins and the hidden credentials they spawn.
Edge cases also appear in mergers, contractors, and research environments where shadow accounts are tolerated temporarily. Even there, the account should be time-boxed, sponsor-owned, and tied to a documented exception process. Teams that rely on audit alone usually find that the real risk is not the login itself, but the persistence of forgotten privileges after the original business need disappears.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-03 | Unmanaged logins often leave long-lived credentials and tokens behind. |
| NIST CSF 2.0 | PR.AC-4 | Direct logins bypass access governance, reviews, and least privilege. |
| NIST AI RMF | GOVERN | AI tool logins create accountability gaps that AI governance must cover. |
Inventory all SaaS and AI tool credentials, then rotate or revoke anything not tied to a known owner.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on June 10, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
