top of page
Search

Which SaaS Apps Most Frequently Bypass SSO? Our Analysis

Single Sign On
Single Sign On

If invoices or audit logs keep revealing surprise apps, you’re not alone. The most common SSO gaps come from apps that can use SSO but don’t have it enforced, personal accounts, guest/contractor access, OAuth consents, and API tokens. Waldo Security discovers every SaaS app and account in minutes, flags services operating outside SSO/MFA, and centralizes OAuth grants so you can right-size permissions and revoke risky tokens fast. Start with Instant SaaS Discovery, then export audit-ready proof from our SaaS Compliance Overview.


First, some context

  • The typical enterprise now runs ~100+ apps, which multiplies bypass paths. (Okta)

  • Stolen credentials drive most basic web app attacks, so any app outside SSO/MFA is low-hanging fruit. (Verizon)

  • GenAI usage is exploding (avg. ~9–10 genAI apps per org), often via personal accounts or browser add-ons. (Netskope)


The seven categories we most often find outside SSO

Important: Every app below supports SSO. Bypass happens when SSO isn’t enforced, when users authenticate with personal identities, or when tokens/guests skirt the front door.

1) Collaboration suites (guests & exclusions)

  • Slack lets orgs exclude certain members or guests from SSO, which is useful—but also a common bypass if left broad. (Slack)

  • Atlassian (Jira/Confluence) SSO can be enforced for managed users; unmanaged/guest access and API tokens can still slip through if policies aren’t tight. (Atlassian Support)


2) Meetings & scheduling

  • Zoom supports SAML SSO, but personal accounts and external invites frequently appear in logs. If SSO isn’t required, users default to email/password. (Zoom Support)


3) File sharing & personal storage

  • Dropbox supports SSO for business tenants; users still spin up personal Dropbox or mix identities unless you block consumer variants and enforce domain claims. (Dropbox Help Center)


4) Dev & data tools (tokens beat logins)

  • GitHub: organizations with SAML SSO must authorize PATs and SSH keys; otherwise tokens become the back door. We regularly see PATs outlive people changes. (GitHub Docs)


5) Doc/whiteboard/work management

  • Tools like wiki/whiteboard/project boards often allow both enterprise SSO and personal accounts. If SSO isn’t enforced at the tenant and consumer domains aren’t filtered, users pick convenience.


6) AI assistants & extensions

  • GenAI apps and browser plug-ins commonly run under personal identities, exfiltrating snippets from tickets, chats, or code outside SSO purview. Netskope tracks rapid growth in org-level genAI usage. (Netskope)


7) OAuth “Sign in with …” (consent sprawl)

  • End-user consent can connect third-party apps without standard SSO flows. If policies allow broad consent, users may grant persistent access (offline_access) that outlives password resets. Microsoft documents how to restrict or disable user consent. (Microsoft Learn)


How to detect SSO bypass in the real world

  1. Build a ground-truth inventory (non-negotiable).Correlate IdP sign-ins with email/collab logs, DNS/proxy, browser extensions, and expense data to produce a deduped list of apps, tenants, and accounts. Tag auth method (SSO vs local), admin count, and OAuth scopes. This mirrors CISA’s zero-trust basics: inventory + least privilege + logging. (Okta)

  2. Hunt for logins that never touched your IdP.Look for SaaS domains in proxy/DNS with no matching IdP events. Cross-check with card charges/invoices to surface paid tools your SSO never saw.

  3. Pull every OAuth grant and score the risk.Flag *.ReadWrite.All or tenant-wide scopes plus offline_access (persistent refresh tokens). Remove unused consents; require verified publishers and admin approval for high-privilege scopes. (Microsoft Learn)

  4. Find SSO “holes” in suite policies.

  5. Slack: review SSO member/guest exclusions. (Slack)

  6. Atlassian: enforce SSO for verified domains; lock down API token policies. (Atlassian Support)

  7. Zoom/Dropbox: ensure SSO required for enterprise tenants (don’t allow email/password fallback). (Zoom Support, Dropbox Help Center)

  8. GitHub: confirm PAT/SSH SSO authorization is enforced for org access. (GitHub Docs)

  9. Watch for genAI with personal IDs.Baseline genAI domains; alert when traffic lacks corresponding enterprise identities or violates your allowlist. (The average org now uses ~9–10 genAI apps.) (Netskope)


Quick queries that work

  • Apps with users but no SSOJOIN idp_signins ON app_id LEFT JOIN catalog WHERE catalog.sso_enforced = false AND signins.count > 0

  • Grants with persistence + breadthscope CONTAINS "offline_access" AND scope MATCHES ".*ReadWrite.All|mail.send|files.content.write"

  • Never-seen-SSO domains with spendproxy.domain IN SaaS_known AND NOT EXISTS idp_signin[domain] AND EXISTS expense[domain]


Close the loop: fix and prove it

  • Tighten consent policies. Restrict end-user consent to low-risk scopes and verified publishers; require admin approval for multi-tenant/high-privilege apps. (Microsoft Learn)

  • Enforce SSO/MFA where risk is highest. DBIR shows credential abuse dominating basic web-app attacks—close that door first. (Verizon)

  • Govern tokens. Revoke idle refresh tokens, require GitHub PAT/SSH SSO authorization, and set token expiry. (GitHub Docs)

  • Automate long-tail offboarding. HR event → remove access everywhere (including niche apps and tokens) → transfer ownership → store proof.

  • Stream logs and ship evidence monthly. Maintain exportable packets (SSO coverage, admin changes, token revocations, sharing exceptions).

With Waldo: We correlate identity, network, and spend to spotlight apps/users operating outside SSO/MFA, bulk-revoke risky grants, and produce one-click evidence for auditors via the SaaS Compliance Overview.

TL;DR

The apps that “bypass SSO” most often are the ones where SSO is available but not enforced, or where tokens, consents, guests, and personal accounts sneak around the front door. Given today’s sprawl (100+ apps per org) and credential-driven attacks, you need a repeatable loop: discover → detect bypass → fix guardrails → prove continuously. Start by mapping what’s actually in use with Instant SaaS Discovery—then make bypass the exception, not the default.

 
 
 

Comments

bottom of page