After the Rotation — The Campus Identity Exposure Canvas Remediation Made Visible

The Scenario

Your buyer's CISO just finished rotating API keys and OAuth tokens across every Canvas integration on campus. The FSA security alert (May 12, 2026) directed institutions to rotate local Canvas integrations, LTI tools, SSO connectors, and API keys. Instructure provided no bulk-rotation tooling. The CISO's team worked integration by integration, manually identifying each active developer key, each OAuth token, each LTI connection, re-authorizing them individually.

That process forced visibility into something the institution had never audited.

Canvas OAuth refresh tokens have no documented expiration in the REST API (verified June 2026). Manually generated access tokens persist indefinitely unless explicitly revoked. No institutional-level API endpoint exists to enumerate all active tokens across all integrations. The team found LTI tools nobody remembered approving, developer keys last used by staff who left two years ago, and OAuth tokens for AI-powered plagiarism detection, accessibility, and analytics tools that had been configured once and never audited.

Canvas is one system. Over 80% of faculty and staff already use AI tools for work-related tasks (2025 EDUCAUSE AI Landscape Study, n=788, survey conducted November 2024). Fifty-six percent of higher ed professionals report using AI tools not provided by their institution (The Impact of AI on Work in Higher Education, EDUCAUSE, January 2026, n=1,960). Only 9% of respondents in the 2025 study felt their institution's cybersecurity and privacy policies adequately addressed AI-related risks. Each unsanctioned tool authenticates somewhere. Student-facing AI advising and retention platforms carry their own service accounts. Research computing clusters mint ephemeral credentials for HPC jobs.

Each link in that chain is a category of non-human identity the institution has never inventoried. The exposure existed before rotation. Rotation just forced the CISO to look at it one credential at a time.

The governance question now sitting on the CISO's desk: who owns the lifecycle of credentials that AI tools generate as a byproduct of operating on campus?

The Structural Gap

The campus identity layer authenticates humans. Shibboleth issues SAML assertions for human users federating across SPs. It has no mechanism to issue, rotate, or revoke credentials for an AI agent acting across multiple SPs, no visibility into which OAuth tokens are active, stale, or orphaned across the LMS integration ecosystem, and no way to enforce token expiration policies on refresh tokens that Canvas itself does not expire.

Entra ID's default configuration governs identities within its own tenant boundary. It does not extend lifecycle management to OAuth tokens issued by Canvas, credentials minted by third-party AI tools, or service accounts provisioned by research computing platforms outside the Microsoft ecosystem.

The gap is architectural: the identity layer that manages human authentication has no surface area for the non-human credentials that AI integrations create as a byproduct of operation. When rotation requires a team to audit integrations one by one because no inventory exists, the institution is governing NHI through incident response. Call it what it is: a gap.

The Evidence Anchor

Two vendor-commissioned CSA surveys frame the scale in enterprise environments.

82% of organizations reported discovering unknown AI agents in their environments (CSA/Token Security, "Autonomous but Not Controlled", April 2026, n=418, online survey of IT and security professionals, January 2026). 68% cannot clearly distinguish AI agent activity from human activity in audit logs (CSA/Aembit, "Identity and Access Gaps in the Age of Autonomous AI", March 2026, n=228). Both sampled commercial enterprises; neither discloses education-sector respondents.

Campus-specific AI agent density is undocumented and likely lower given less cloud-native infrastructure. The directional finding still holds: AI tools are adopted faster than governance frameworks track the credentials they create. EDUCAUSE's own data on the policy-to-adoption gap confirms this pattern within higher education specifically.

Discovery Questions

Use these after the buyer has described their Canvas remediation experience. Follow the chain from what they lived through to what they haven't yet audited.

1. Start with what they know. "When your team rotated Canvas credentials, how did you build the inventory of active integrations? How confident are you it was complete?"

2. Expand to adjacent systems. "Beyond Canvas, do you have visibility into the OAuth tokens and service accounts your other SaaS tools have generated? Advising platforms, analytics, accessibility tools?"

3. Surface the shadow AI layer. "EDUCAUSE data shows over half of higher ed professionals use AI tools the institution didn't provision. Do you have a way to identify which of those tools have authenticated against institutional data stores?"

4. Reach the structural question. "Who on your team owns the credentials that AI integrations create? I mean the tokens and service accounts the tools themselves generate."

5. Name the lifecycle gap. "When a faculty member stops using an AI tool, or a research grant ends, what triggers revocation of the credentials that tool was issued?"

Positioning Bridge

The buyer just described an identity governance problem that spans human and non-human credentials across a federated campus environment. Their current stack was designed before AI integrations existed as an identity surface. No one on their team owns the lifecycle of credentials those integrations create.

Frame the next conversation around the category: unified identity governance covering the full credential lifecycle, human and non-human, across every system in the campus ecosystem. Okta's architecture fits this structural requirement because it operates as a neutral governance layer across federated environments, not bounded by a single vendor's tenant. As of Q2 2026, no competitor has published this argument for higher education. That window has a shelf life. Use it while it's open.