TL;DR: SaaS oversight is becoming an identity lifecycle problem, not just an inventory problem, as 1Password’s quarterly security spotlight says SaaS Manager is being used to control SaaS spend, automate provisioning and deprovisioning, and streamline access reviews across the employee lifecycle, according to 1Password.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on 1Password's event briefing: SaaS governance is being pulled into IAM through lifecycle automation, access reviews, and spend control.
Why it matters: IAM and IGA teams need to treat SaaS visibility, provisioning, deprovisioning, and review workflows as one governance problem rather than separate operational tasks.
Context
SaaS governance fails when organisations can see applications but cannot govern the identities and requests behind them. The operational gap is not inventory alone, but the inability to connect provisioning, deprovisioning, and access review into one control loop across the employee lifecycle.
In this webinar recap, 1Password frames SaaS Manager as part of a broader identity workflow rather than a standalone inventory layer. That matters for IAM teams because SaaS sprawl creates hidden access paths, manual review debt, and spend that often persists after the business need has changed.
Key questions
Q: What breaks when SaaS change management is separated from IAM processes?
A: When SaaS change management is separated from IAM, teams lose visibility into who should still have access after a change, which accounts or integrations are obsolete, and whether approvals match current state. That separation typically produces orphaned access and incomplete audit trails. A unified process is needed to keep operational change and identity governance aligned.
Q: Why do SaaS environments create so much access review friction?
A: Because entitlement data is often fragmented across app consoles, directories, and shadow tools. Reviewers cannot make good decisions when they lack a single view of who has access, why it exists, and whether it is still used. The friction is a sign that governance is incomplete, not that reviews are too frequent.
Q: How should security teams connect SaaS spend management with IAM governance?
A: Security teams should treat SaaS spend data as an identity signal. Discovery, licence usage, and renewal reports should feed access reviews, offboarding, and app ownership workflows so shadow apps and idle licences are governed as entitlement problems, not only budget problems.
Q: What should IAM teams do first when they cannot see all SaaS applications in use?
A: Start by building a complete discovery picture from browser activity, SSO logs, and direct connectors. The first goal is not remediation but inventory quality, because access decisions cannot be trusted until you know which apps, accounts, and OAuth grants actually exist across the environment.
Background and context
Why SaaS governance becomes an identity lifecycle problem
SaaS governance stops being a pure discovery exercise when the same platform is expected to manage joiner, mover, and leaver events. Once provisioning and deprovisioning are tied to employee lifecycle stages, the control surface shifts from “what apps exist” to “who can access them, when, and for how long.” That is identity governance, not just asset inventory. The article’s core signal is that SaaS Manager is being positioned as an operational bridge between visibility and entitlement management, which is where many programmes currently have a handoff gap.
Practical implication: map SaaS app discovery to lifecycle ownership so access changes and offboarding are governed in the same workflow.
Access reviews and access requests need the same source of truth
Access reviews and access requests are often treated as separate processes, but SaaS sprawl makes them dependent on the same entitlement data. If review data is stale, the organisation certifies access that no longer reflects actual use. If request data is disconnected, teams approve access without seeing existing privilege or business need. The article points to a control model where full visibility unlocks both review quality and request handling. That is important because it turns SaaS governance into a closed loop rather than a periodic compliance exercise.
Practical implication: tie request workflows and review workflows to the same entitlement inventory so approvals and certifications use the same context.
SaaS spend control is now part of IAM governance
Spend control sounds like a procurement issue until unused applications and duplicated subscriptions reveal broken identity governance. When a team can eliminate SaaS spend it did not know it had, that usually means access paths outlived business need and were never reclaimed. The article shows why cost visibility and access governance converge: unused licences, orphaned access, and overprovisioned entitlements are often the same problem seen from different angles. IAM teams cannot treat cost optimisation as separate from deprovisioning discipline.
Practical implication: use SaaS spend findings as governance signals and feed them into access recertification and offboarding review.
NHI Mgmt Group analysis
SaaS governance is now an identity lifecycle discipline, not a shadow inventory exercise. The article shows the operating centre of gravity moving from simple discovery to provisioning, deprovisioning, and access review. That shift matters because the control question is no longer whether an app exists, but whether the entitlement lifecycle is governed end to end. Practitioners should treat SaaS management as part of IAM and IGA design, not as a parallel admin function.
Full visibility only matters when it changes entitlement decisions. Seeing every SaaS application is useful, but the article’s stronger signal is the ability to eliminate blind spots that previously hid access and spend. That is a governance problem because visibility without action still leaves stale accounts, duplicate subscriptions, and unmanaged requests in place. The practitioner takeaway is that discovery must feed policy enforcement, not sit beside it.
Access reviews fail when entitlement data and lifecycle events are disconnected. The webinar emphasis on streamlining reviews and requests points to a common IAM weakness: certification processes often operate on snapshots that do not reflect real user transitions. When joiner, mover, and leaver changes are not linked to the same entitlement record, review programmes certify yesterday’s access. Teams should re-evaluate whether their review model is grounded in live lifecycle data or in periodic administrative memory.
SaaS spend reduction is often a governance outcome, not a finance initiative. The article’s claim that unnecessary SaaS spend was eliminated is telling because wasted licences typically surface when identity controls are working poorly. Overprovisioned access, unused accounts, and delayed deprovisioning all show up as cost leakage. That makes cost analysis a useful governance diagnostic, and practitioners should use spend anomalies to identify broken lifecycle control rather than treating them as procurement noise.
Identity governance for SaaS needs a closed loop from request to revocation. The named concept here is SaaS lifecycle closure: the point at which access requests, approvals, provisioning, recertification, and deprovisioning are governed as one continuous process. The article suggests that this is where maturity is heading. Teams that cannot close that loop will keep compensating with manual work, and manual work does not scale with SaaS sprawl.
What this signals
SaaS lifecycle closure is the operating model shift this article points to: visibility only becomes governance when it drives provisioning, recertification, and deprovisioning as one workflow. IAM teams should expect more pressure to prove that access change, not just app discovery, is under control.
The practical test for SaaS governance maturity is whether review results, request approvals, and offboarding events are based on the same entitlement data. If those records diverge, the programme is still doing administration rather than governance.
For practitioners
- Map SaaS ownership to lifecycle control points Define which team owns provisioning, recertification, and deprovisioning for each SaaS application category, then record those ownership points in your IAM operating model.
- Unify access requests and access reviews Make sure request approvals and certification campaigns draw from the same entitlement source of truth so reviewers see current access, not stale snapshots.
- Use SaaS spend anomalies as governance signals Investigate unused licences, duplicate subscriptions, and unexpected spend as possible signs of orphaned access or missing deprovisioning steps.
- Automate employee lifecycle handoffs Link joiner, mover, and leaver events to SaaS entitlement changes so access removal is triggered by workflow, not by manual follow-up.
Key takeaways
- The article frames SaaS management as an IAM problem because visibility, access requests, and lifecycle changes now sit in the same control path.
- The strongest operational signal is the link between eliminated blind spots and eliminated spend, which usually reflects reclaiming access that no longer had a business owner.
- Practitioners should close the loop between request, review, and offboarding workflows so SaaS governance is enforced continuously rather than periodically.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | The article ties SaaS governance to deprovisioning across the employee lifecycle. |
| NHI-05 — Overprivileged NHI | Unused or excessive SaaS access is the governance issue behind hidden spend and review drift. | |
| NHI-09 — NHI Reuse | Shared or duplicated SaaS access paths create governance ambiguity across the lifecycle. | |
| Recommendation — Audit SaaS offboarding paths so access removal is triggered by lifecycle events, not manual follow-up. Recertify SaaS entitlements against actual business need and remove access that is no longer required. Eliminate shared SaaS access patterns that prevent clear ownership and accurate entitlement tracking. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about governing SaaS entitlements and access reviews. |
| Recommendation — Apply PR.AA-05 to keep SaaS permissions, approvals, and recertifications aligned with current business need. | ||
| CIS Controls v8 | CIS-5 — Account Management | SaaS provisioning and deprovisioning are classic account management concerns. |
| Recommendation — Use account management controls to track SaaS identities from onboarding through removal. | ||
Key terms
- SaaS governance report: A SaaS governance report is a structured view of application, user, ownership, usage, and spend data used to support control decisions. In identity programmes, it becomes a decision input for access reviews, renewal approvals, application cleanup, and offboarding when the data is tied to workflow.
- Access Review: A formal process for confirming whether access is still needed and justified. In IAM programs, the review becomes an evidence-bearing control when decisions are recorded, scoped correctly, and traceable to the right reviewer, application owner, or auditor.
- Deprovisioning: Deprovisioning is the removal of access when a user changes roles or leaves an organisation. For security teams, it is the point where stale accounts, tokens, and permissions should disappear. Weak deprovisioning leaves residual access that can outlive the business need that created it.
- Entitlement Source Of Truth: The authoritative record of what access exists, who owns it, and how it should be granted or removed. It prevents ticketing tools from inventing ad hoc permissions by forcing each request to resolve to a real role, policy, or access package.
Deepen your knowledge
NHI governance, identity lifecycle, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity governance programme, it is worth exploring.
Published by the NHIMG editorial team on June 10, 2026.
Updated on October 10, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org