Identity sprawl is the uncontrolled growth of accounts, roles, service principals, and permissions across cloud platforms, SaaS tools, endpoints, and internal systems. It happens when teams create access quickly and do not fully retire it later, leaving duplicate users, stale accounts, overprivileged roles, and inconsistent permission sets scattered across environments.
It matters because identity is a primary control plane in modern security. If an attacker steals one password, API token, or session, identity sprawl can give that foothold excessive reach through inherited roles, shared admin access, or forgotten vendor accounts. Defenders reduce the risk with least privilege, regular access reviews, privileged access management, and continuous inventory of identities and entitlements. In practice, identity sprawl often appears alongside shadow IT and forgotten cloud services, making exposure harder to see and easier to exploit.