.png){kind=small}
Most organizations assume their SaaS environments are secure because they're using enterprise-grade platforms. They're wrong, and the evidence is mounting.
In the last year, 29% of SaaS breaches were traced directly to misconfigurations, and 41% to permission drift, yet most of these issues go undetected for weeks or months.
The problem isn't always the software itself. It's the gap between what your SaaS platforms can enforce, and what your teams have actually configured.
This post breaks down what SaaS security misconfigurations are, the most common types putting organizations at risk right now, and, critically, how to remediate them and return to a secure baseline.
What Are SaaS Security Misconfigurations?
Picture this: your security team just passed a compliance audit with flying colors. Your SaaS vendors have SOC 2 certifications, and your CISO feels good. Then, a former employee walks out the door with three years of customer data, pulled from a Google Drive folder that was shared with "anyone with the link" since 2022. No one even noticed. No alert was fired. And the data? Gone.
That's a SaaS misconfiguration in action.
SaaS misconfigurations are improper, unchecked, or unreviewed settings within SaaS applications that expose data, expand your attack surface, or violate security policy.
They are not software bugs. The platform isn't broken. The vendor's infrastructure is fine. The problem is how your organization has configured the application, and that distinction matters enormously.
The root cause usually traces back to the shared responsibility model. While SaaS vendors secure the infrastructure, you are responsible for configuring security settings correctly.
Most organizations dramatically underestimate how much falls on their side of that line, and this is why configuration drift is so common.
For example, a SaaS vendor may provide strong security controls (MFA, sharing restrictions, access policies, etc.), but leave many of them optional and up to you to set up depending on how you want to run your security program.
Then, the employees at your company skip some, bypass some, and ignore some altogether. That gap between the secure defaults available and the settings actually enforced is configuration drift.
A vulnerability is different. A vulnerability is a flaw in the software itself: a bug the vendor must fix with a patch. A misconfiguration happens on your side: overly broad permissions, public links, disabled MFA, and the like. The vendor’s platform can be technically secure, while your configuration still leaves sensitive data exposed.
This is why many SaaS incidents are caused by misconfigurations.
For example, the notorious ScaleAI data breach resulted in thousands of confidential files, AI model training data from Meta & Google, and employee PII being stolen - all from a misconfigured sharing link.
No company is immune to this type of incident, no matter how big the logo.
Why Do SaaS Misconfigurations Keep Happening?
The real reason these keep happening is because it’s impossible to track manually - and oftentimes when settings become misconfigured, the security team has no idea. This is commonly referred to as configuration drift - but we’ll get to that.
Think of it this way: employees own the SaaS apps relevant to their functions without security expertise. Marketing runs Salesforce. Finance runs Workday. They configure what they need to get the job done, and security isn’t even a thought in their mind.
A few more reasons why?
- Rapid rollouts deprioritize security settings. Speed wins. Security settings get revisited "later," which often means never. The configuration that shipped on day one is the configuration that runs for years.
- Non-human identities go unmanaged. OAuth tokens, API keys, and service accounts can't have MFA applied. They accumulate quietly, each one a potential pivot point for an attacker.
- SaaS sprawl compounds the problem. The average enterprise uses over 125+ SaaS applications. Each one has its own configuration surface. Most of them are nobody's full-time job to watch. The sheer volume makes manual oversight impossible.
Even organizations with strong security teams see misconfigurations go undetected for weeks or months. The shared responsibility confusion isn't new, but SaaS sprawl has dramatically amplified it.
Configuration Drift: The Silent Accumulation of Risk
There's one cause that deserves its own conversation because it's the hardest to see and the easiest to underestimate: configuration drift.
This is the true answer as to why misconfiguration incidents keep happening. Configuration drift is defined as the gradual deviation of SaaS settings from your secure baseline as new features, users, and integrations are introduced over time.
No single change is catastrophic on its own; a new admin tweaks a sharing setting, a developer connects an OAuth app for a quick integration, a contractor gets provisioned with slightly more access than they need because it was faster; a vendor update quietly changes a default behavior.
Each of these changes is minor. The cumulative exposure across dozens of SaaS applications, hundreds of integrations, and thousands of users can be staggering.
Drift is silent by nature. It doesn't trigger alerts. It doesn't show up in your SIEM. It accumulates between your quarterly audits, which is exactly why point-in-time reviews consistently miss it.
By the time you run your next manual review, the environment has shifted in ways that are genuinely difficult to reconstruct. You're not actively measuring or preventing drift. You're discovering it after the fact, often during an incident investigation.
This is why configuration drift is the connective tissue between every misconfiguration type you're about to read. It explains how environments that were configured correctly at launch end up exposed. And it's why the solution isn't just better initial configuration - it’s continuous monitoring and remediation against a known-good baseline.
10 Common SaaS Security Misconfigurations
These are the most common SaaS security misconfigurations that show up consistently across organizations of every size and industry.
1. Overly permissive access controls.
Excessive user privileges, shared admin accounts, and unused accounts that haven’t been disabled yet are among the most prevalent risks across SaaS environments, and they’re the result of normal business activity: access granted to get a project done, roles scoped broadly because precision took too long, and accounts that simply never got cleaned up.
A static policy that blocks external sharing outright doesn't work for modern teams. What's needed is adaptive, automated data access governance that continuously evaluates who has access to what, under what context, and for how long - because the access that was appropriate six months ago probably isn't appropriate today.
2. SSO bypass via local accounts.
Organizations enforce SSO at the identity provider level, but then create local accounts in individual SaaS apps that bypass that policy entirely. These accounts sit outside your traditional identity governance and sit at the SaaS security layer. They are invisible to your SSO logs, and wide open to credential attacks.
3. Dormant and orphaned accounts from former employees.
When employees leave, their SaaS accounts often remain active. Same with contractors, project-based users, and test accounts. These dormant accounts accumulate over time, each one a valid credential that no one is monitoring or rotating, and they’re easily compromised.
4. Excessive OAuth app permissions.
Third-party apps connected via OAuth frequently request broader access than they need. Users click through consent screens without reading them. The result is a growing inventory of integrations with read/write access to sensitive data, many of them forgotten entirely after initial setup.
5. Misconfigured email & communication tools.
Files and folders shared as "anyone with the link" are a pervasive, low-visibility risk. A user wants to get their work done quickly and sets the sharing link to public, not realizing that there is sensitive data being exposed. They share, close the tab, and move on. The sharing permission stays. Without proper SaaS security tooling, it stays forever.
6. Misconfigured Shared Drive collaboration settings.
Email and communication platforms are among the most heavily used - and most commonly misconfigured - applications in any SaaS stack. Auto-forwarding rules that silently redirect email to external addresses are a frequent vector for data exfiltration, often set up by a single user and never reviewed again. In collaboration tools like Slack, guest access is routinely provisioned too broadly and never scoped back down once the project ends.
7. AI apps + agent settings left at default
Enterprise AI tools like ChatGPT or Claude often include administrative settings that control how prompts, files, and conversations are retained, shared, or used within the organization. In many environments, those defaults are enabled for ease of adoption, not strict data governance. If administrators never revisit those settings, employees may unknowingly upload sensitive documents, source code, customer records, or internal strategy data into systems with overly broad retention, sharing, or plugin permissions.
8. Overly permissive admin roles.
Admin privileges get granted broadly because it's easier than scoping roles precisely. Global admin access in Google Workspace or Microsoft 365 system administrator roles carry enormous blast radius. When those accounts are compromised or misused, the damage is proportional to the access.
9. Disabled or misconfigured audit logging.
Many SaaS platforms have audit logging turned off by default or configured to retain logs for only a short window. When an incident occurs, the forensic trail is incomplete or missing entirely. Organizations need a full audit trail of every user behavior, data movement, and event within their SaaS environment. After all, you can't investigate what wasn't recorded.
10. Unreviewed third-party SaaS-to-SaaS integrations.
Direct app-to-app connections, often set up by individual teams without security review, create data flows that bypass your normal controls. These integrations frequently carry permissions scoped to the user who authorized them, meaning a former employee's integration can keep running long after their account should have been closed.
Each of these misconfigurations is manageable in isolation. The problem is that they don't exist in isolation. They compound across every app in your stack, and they drift further from baseline every week. That's what makes prevention harder than it looks.
Prevention Is Necessary, but Not Enough
Prevention has real value. Enforce MFA and SSO across all SaaS apps. Apply least-privilege access at provisioning. Establish secure configuration baselines before deployment. Train business-unit SaaS admins on security settings. All of this reduces your starting risk.
But prevention-focused approaches fail against configuration drift, legacy settings, historical oversharing, and the constant churn of SaaS updates that silently change default behaviors.
Misconfigurations are not a one-time project. They are a continuous security discipline that needs to be monitored, managed, and remediated daily.
Policy without detection is just documentation. Prevention sets the starting line. Remediation is ongoing work.
Returning to Baseline: What Effective Remediation Looks Like
When a security team runs their first comprehensive misconfiguration audit, the results are almost always a shock. Not because of one catastrophic finding, but because of the volume:
- hundreds of files shared publicly
- dozens of dormant accounts still active
- OAuth apps connected three years ago by employees who have since left
- MFA gaps in applications everyone assumed were covered
- AI tools + integrations introducing new risks without proper data controls
…and the list goes on.
The baseline was never established. The drift was never measured.
Effective remediation starts with continuous monitoring. Here's what that looks like by misconfiguration type:
MFA and SSO gaps → Identify every account not covered by SSO or MFA enforcement. Automate enforcement where possible. Flag exceptions for immediate human review. Don't wait for the next audit cycle. One uncovered account is all an attacker needs.
Dormant accounts → Automate identification based on defined inactivity thresholds. Disable automatically. Revoke inactive third-party integrations on the same schedule. The manual process doesn't scale across 100-plus SaaS applications.
Overshared files and data → Scan for historical files shared publicly or with "anyone with the link." Revoke or scope-limit sharing. Prioritize files containing sensitive content. This is where organizations consistently find their most significant historical exposure, and it's almost always older than anyone expects.
Excessive OAuth, AI app, & third-party permissions → Audit every connected app. Identify over-permissioned integrations. Build revocation workflows for unused or excessive grants. Review of these need to be automated and continuous.
Default settings → Compare your current configuration against vendor security benchmarks and your internal baselines. Flag every deviation for review. Don't assume the default is secure.
Configuration drift → Establish a known-good baseline. Alert on any deviation. Auto-remediate where policy allows, with human review workflows for changes that could impact business operations.
The challenge most organizations face isn't knowing what to fix. It's having the visibility and tooling to find misconfigurations across every SaaS app, prioritize them by risk, and act on them continuously. That's the gap that needs closing.
How DoControl Manages SaaS Misconfigurations Continuously
DoControl is a SaaS Security Posture Management (SSPM) platform built to operate at the data and identity layer across your entire SaaS stack, covering Google Workspace, Microsoft 365, Slack, Salesforce, Box, and the integrations connecting them.
DoControl’s SaaS Misconfiguration Management helps security teams move from reactive cleanup to proactive control.
Instead of manually reviewing hundreds of SaaS settings across disconnected platforms, teams gain centralized visibility into security drift, risky configurations, and compliance gaps before they turn into incidents.
Our platform:
- Continuously evaluates SaaS applications against security best practices, internal policies, and regulatory frameworks.
- Identifies weak controls, excessive sharing, risky AI settings, external access exposure, and other configuration risks across the environment.
- Maps and prioritizes by application, security domain, and business impact so teams can focus remediation efforts where risk is highest.
- And, most importantly, streamlines the remediation process itself by FIXING the drift!
Security teams receive guided remediation recommendations, and can actually automate corrective actions in real time, reducing the operational burden of managing SaaS security at scale and eliminating their SaaS misconfiguration risk.
As organizations rapidly adopt AI-enabled SaaS platforms, external collaboration tools, and decentralized workflows, configuration management becomes a core security function - not just an administrative task.
DoControl helps organizations continuously align SaaS security controls with evolving compliance standards, internal governance requirements, and the pace of modern business operations.
{{cta-1}}
Summary
In today’s SaaS and AI-driven environments, an immense amount of risk comes from how systems are configured, and how quickly those configurations drift as teams, tools, contractors, and workflows change. Security can’t rely on one-time setup or periodic audits anymore, they need something smart, scalable, and always-on to correct their drift for them.
DoControl brings continuous visibility and control to that reality, helping organizations detect misconfigurations early, prioritize what matters, and remediate at scale. The result is a SaaS security posture that stays aligned with how the business actually operates - not how it was originally deployed.
Frequently Asked Questions (FAQ’s)
What are SaaS security misconfigurations?
SaaS security misconfigurations are incorrect, insecure, or unreviewed settings within SaaS applications that create security gaps. They are not software vulnerabilities. The platform itself may be secure, while your configuration of it exposes sensitive data, bypasses authentication controls, or grants excessive permissions.
What is configuration drift and why does it matter?
Configuration drift is the gradual deviation of SaaS settings from your secure baseline as new features, users, or integrations are introduced over time. No single change is catastrophic on its own. The cumulative exposure across dozens of SaaS applications, hundreds of integrations, and thousands of users can be significant. Drift is silent by nature, which is why point-in-time audits miss it entirely and why continuous monitoring is the only reliable defense.
What should you do first when starting a SaaS misconfiguration remediation program?
Start with visibility. You cannot remediate what you cannot see. Map every connected SaaS application, every OAuth integration, and every user account including dormant ones. Run a baseline assessment against vendor security benchmarks. Prioritize MFA gaps, dormant accounts, and publicly shared files containing sensitive data. These three categories consistently represent the highest-risk, fastest-to-remediate findings in initial audits. Then build continuous monitoring so you're not starting from scratch six months from now.
