Why does SaaS sprawl create more risk when onboarding and offboarding are still manual?

Why This Matters for Security Teams

saas sprawl turns access management into a moving target. Every new application creates another onboarding path, another offboarding dependency, and another place where entitlements can drift away from business need. Manual processes cannot keep pace with frequent role changes, temporary projects, and shadow IT, so access decisions become delayed, inconsistent, and hard to evidence during audits.

The risk is not only overprovisioning. Manual handling also increases the chance that abandoned accounts, shared admin access, and stale integrations remain active long after they should have been removed. That matters because compliance teams need to show who has access, why they have it, and when it was revoked. NIST’s NIST Cybersecurity Framework 2.0 treats identity governance as a core control area, not a back-office task. For lifecycle discipline, NHIMG’s NHI Lifecycle Management Guide is a useful reference for how unmanaged access compounds over time.

NHIMG research also shows how quickly lifecycle failures become security failures. In the 2025 State of NHIs and Secrets in Cybersecurity, 91% of former employee tokens remained active after offboarding, which is exactly the kind of residual access that manual workflows miss. In practice, many security teams discover the problem only after an audit finding, a license review, or a data exposure has already forced the issue.

How It Works in Practice

Manual onboarding and offboarding usually rely on tickets, emails, spreadsheets, and human follow-up across HR, IT, security, and application owners. That model assumes the organisation can keep a reliable inventory of users, apps, and entitlements by hand. As SaaS counts rise, the process fragments: some apps are provisioned through SSO, some through direct vendor consoles, and some through local admin accounts that no one remembers to remove.

The practical result is delayed revocation, incomplete deprovisioning, and inconsistent approval records. A user can move teams on Monday, retain access to finance data on Tuesday, and keep a dormant license running for months. The same problem appears with service accounts, API tokens, and delegated app permissions, where the business owner may assume the platform handles lifecycle tasks automatically when it does not. Current guidance from the NIST Cybersecurity Framework 2.0 and lifecycle-focused NHIMG material both point to the same operational need: central visibility, ownership, and repeatable revocation paths.

• Automate joiner mover leaver triggers from HR and identity events, not manual reminders.
• Use application ownership and entitlement catalogs so each SaaS app has a named accountable owner.
• Standardize deprovisioning for users, admins, OAuth grants, and machine-to-machine credentials.
• Continuously reconcile actual access against approved access so drift is found before review cycles.

Where this is strongest, teams pair workflow automation with periodic access recertification and log review. NHIMG’s Top 10 NHI Issues highlights how stale credentials and weak lifecycle controls often travel together, especially once SaaS usage becomes decentralized. These controls tend to break down when application ownership is unclear and offboarding depends on tribal knowledge because no one system can enforce revocation across every vendor console.

Common Variations and Edge Cases

Tighter lifecycle control often increases operational overhead, requiring organisations to balance faster access fulfillment against stronger governance. That tradeoff becomes more visible in fast-scaling companies, mergers, and highly distributed teams where app adoption outpaces centralized administration. Best practice is evolving, but there is no universal standard for how much manual review is enough when SaaS sprawl is already established.

One edge case is business-owned SaaS bought outside IT. Those apps often bypass identity standards, so onboarding and offboarding may depend on the department manager rather than the security team. Another is privileged or shared access, where a single login is used by multiple people, making revocation and accountability much harder. For machine access, the same pattern applies to long-lived credentials and service accounts that are forgotten during employee exits. NHIMG’s Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs and the Ultimate Guide to NHIs — Key Challenges and Risks both reinforce the same operational lesson: lifecycle controls must cover more than employee logins.

The hardest environments are those with fragmented SSO coverage, multiple identity stores, and no authoritative app inventory. In those conditions, manual offboarding fails because no one can prove all access paths were removed, especially when tokens, shared accounts, and third-party integrations persist outside the main directory.

Related resources from NHI Mgmt Group

• When does a short-lived API key still create material risk?
• Why do poor password practices still create risk even when organisations use password managers?
• Why do shared passwords and manual onboarding increase risk for identity and access teams?
• Why do non-human identities create more audit risk than human accounts?