Why does ERP-centric access governance leave organisations exposed in hybrid application environments?

Why This Matters for Security Teams

ERP-centric access governance was built for a world where finance, HR, and procurement were the primary sources of truth. Hybrid application estates break that assumption. When identity reviews only reflect ERP entitlements, security teams can miss conflicting SaaS privileges, cloud console roles, and service account access that still carry real business risk. That gap shows up in recertification, emergency access, and joiner-mover-leaver workflows, where the control looks complete on paper but not across the full estate.

This is not a theoretical issue. NHIMG research on The State of Non-Human Identity Security reports that 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, which is a useful proxy for how often identity governance stops at the platform boundary rather than the application boundary. The same problem appears in broader access reviews documented in Ultimate Guide to NHIs, where lifecycle control depends on seeing the full identity footprint, not just the ERP record.

Security teams also need to align this with the current control model in NIST Cybersecurity Framework 2.0, which emphasises continuous governance rather than periodic approval alone. In practice, many security teams discover toxic access combinations only after an audit finding, a privilege escalation, or a third-party incident has already exposed the gap.

How It Works in Practice

Effective governance in hybrid environments starts by treating ERP as one input, not the control plane. The control objective is to unify identity, role, and entitlement data across SaaS, cloud, on-premises apps, and service accounts, then evaluate that data against business context at the point of review or request. That usually means feeding an identity governance platform or policy engine with authoritative sources from HR, ERP, directory services, cloud IAM, and key applications, then normalising entitlement names and inheritance rules.

Current best practice is to use continuous entitlement discovery and risk scoring so reviewers can see whether a user is over-entitled in one platform even if the ERP record appears clean. This is especially important for delegated admin rights, app-specific roles, and non-human identities such as API keys and automation accounts. The OWASP Non-Human Identity Top 10 is relevant here because the same governance failure occurs when secrets, tokens, and machine accounts are invisible to the review process.

• Map each identity to every effective entitlement, not just the ERP-originated role.
• Correlate cloud, SaaS, and directory data into a single access graph.
• Flag conflicting combinations such as approver plus payment processor, or admin plus auditor.
• Use continuous monitoring to detect drift after the review is completed.
• Apply stronger controls to privileged and non-human identities where audit trails are weaker.

For practitioners, the operational question is not whether ERP remains important, but whether it is still being used as the only evidence source for access decisions. Where access paths are federated, inherited, or provisioned outside ERP workflows, the governance model can look complete while still missing the highest-risk entitlements. These controls tend to break down in environments with heavy SaaS sprawl and independent cloud admin domains because entitlement ownership is fragmented and no single system can explain effective access end to end.

Common Variations and Edge Cases

Tighter access governance often increases review effort and integration cost, so organisations have to balance assurance against operational friction. That tradeoff becomes sharper when mergers, subsidiaries, or regional business units run different identity stacks and application catalogs.

One common variation is when ERP remains the approval source for employment status but not for application entitlement logic. That is acceptable only if downstream systems are continuously reconciled back to a central entitlement model. Another edge case is emergency access: break-glass roles may be intentionally outside normal ERP workflows, but they still need compensating controls, time-bounded approval, and post-use review. For hybrid estates with shared admin accounts, the guidance is clear that shared credentials should be reduced aggressively, though there is no universal standard for exactly how quickly every legacy system can be remediated.

Current guidance suggests that organisations should prioritise the systems most likely to create toxic combinations first: finance, HR, customer data, cloud administration, and any platform with delegated provisioning. The NHI lifecycle material in Ultimate Guide to NHIs — Regulatory and Audit Perspectives is useful here because auditability depends on evidence across the full identity chain, not only the originating system. When governance tooling cannot reconcile inherited roles, manual exceptions, and app-local administrators, the model degrades quickly into spreadsheet-based assurance.

Related resources from NHI Mgmt Group

• Who is accountable for access governance when enterprises run mixed ERP, cloud, and legacy environments?
• How should security teams build audit-ready password governance reporting across hybrid environments?
• What is the difference between role-based access and API key governance for NHI security?
• Why do application testing tools matter for NHI governance?