Organisations now give access to far more people and systems they do not employ than they used to. Contractors, consultants, outsourced help desks, suppliers, partners, auditors, B2B customers and their SaaS integrations all hold accounts, tokens or API keys in your environment. Third-party identities are harder to govern because the HR system does not know about them, their employer controls their lifecycle, and their access often outlives the contract. Many recent breaches ran through exactly this gap. This guide covers how to onboard, govern and offboard third-party identities, both human and non-human.
Key takeaways
- Every third-party identity needs an internal sponsor who is accountable for it.
- Time-limit third-party access by default and require re-approval to extend it.
- Prefer federation with the partner's identity provider, but keep your own controls: MFA requirements, scope and the ability to cut access.
- Third parties also hold non-human identities in your environment, such as OAuth grants, API keys and service accounts, which need the same governance.
- Contracts should cover identity obligations: MFA, prompt notification of leavers, incident reporting and credential protection.
Types of third-party access
| Type | Example | Main risk |
|---|---|---|
| Contractors and consultants | Staff working inside your systems | Access not removed when the engagement ends |
| Outsourced operations | Help desk, IT operations, support centres | Broad privileges; social engineering; insider risk |
| Vendor remote support | Suppliers maintaining equipment or software | Permanent, unmonitored remote access |
| B2B customers and partners | Partner portals, shared workspaces, guest users | Guest sprawl; weak partner security |
| SaaS and integration providers | OAuth apps and API connections holding tokens | Token theft from the provider's environment |
| Suppliers holding your secrets | Consultancies and MSPs with keys and connection strings | Your credentials exposed in their breach |
Lessons from incidents
- Marks and Spencer (2025): impersonation of a third-party user led to ransomware and data theft.
- Coinbase (2025): outsourced support agents were bribed to copy customer data.
- Salesloft Drift (2025) and Klue (2026): OAuth tokens held by vendors were stolen and used against customers.
- Red Hat Consulting (2025): customer tokens and connection strings sat in a supplier's repositories.
- Snowflake customers (2024): some credentials were stolen from contractor devices.
Onboarding third-party identities
- Sponsorship: an employee requests the access, states the purpose and end date, and remains accountable.
- Identity verification: confirm the individual's identity, especially for privileged or remote access. See the Identity Proofing and KYC Guide.
- Named accounts: no shared vendor accounts; every person gets their own identity.
- Federation where it helps: B2B federation lets people use their own organisation's identity, but set conditions, such as requiring MFA and trusting only specific partner tenants.
- Least privilege: separate third-party roles, with access to named applications, not the whole network. See the Remote Access Identity Guide.
Governing access during the relationship
- Set an expiry date on every third-party account and grant, with reminders to sponsors.
- Include third parties in access reviews, reviewed by the sponsor. See the Access Reviews Guide.
- Require the supplier to notify you of leavers within a defined time, and reconcile regularly against their staff lists.
- Broker and record privileged third-party sessions. See the Privileged Session Management Guide.
- Apply the same help desk verification to third-party users as to employees, and extra scrutiny to outsourced help desks with reset powers. See the Account Recovery and Help Desk Security Guide.
- Monitor third-party activity for unusual volume, hours or locations. See the Insider Threat and Identity Guide.
Third-party non-human identities
- Inventory OAuth apps, API keys, service accounts and webhooks that belong to or are used by third parties.
- Limit scopes and review consent regularly. See the SaaS and OAuth App Governance Guide.
- Prefer integrations that use short-lived tokens and IP restrictions.
- Know how to revoke every third-party grant quickly during a supplier incident.
- Do not send suppliers long-lived credentials in documents or email; provision scoped, expiring access instead. See the Secrets Management Guide.
Offboarding
- Disable accounts automatically at the end date unless extended.
- On contract termination, revoke accounts, federation trust, OAuth grants, API keys and VPN profiles together.
- Rotate any shared or privileged credentials the third party knew.
- Confirm the supplier has deleted your credentials and data.
Contract and assurance
- Require MFA for supplier staff accessing your systems and for their own systems holding your credentials.
- Set notification times for leavers and security incidents.
- Include rights to audit or receive evidence, and use supplier risk assessments that ask identity-specific questions.
- Regulations such as DORA and NIS2 make ICT third-party risk an explicit obligation. See the Identity Security Regulatory Map.
Practitioner checklist
- Inventory all third-party human and non-human identities, with sponsors.
- Require sponsorship, named accounts and verified identity for every third-party user.
- Set end dates by default and include third parties in access reviews.
- Broker and record third-party privileged and remote sessions.
- Govern third-party OAuth apps, API keys and service accounts, with a fast revocation plan.
- Automate offboarding at contract end and rotate shared credentials.
- Put identity obligations in supplier contracts and check them.
Standards and references
- NIST SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices
- Regulation (EU) 2022/2554 (DORA): ICT third-party risk
- ISO/IEC 27001:2022: supplier relationships controls
- OWASP Non-Human Identities Top 10 (2025): vulnerable third-party NHI
Related NHI Mgmt Group resources: SaaS and OAuth App Governance Guide · Joiner-Mover-Leaver Guide · Access Reviews Guide · Remote Access Identity Guide
