Business-led IT and shadow SaaS: governance gaps to close

At a glance

What this is: 1Password’s analysis argues that shadow SaaS is a governance gap, not a ban list problem, and points to discovery, review, and lifecycle management as the controls that close it.

Why it matters: IAM and IGA teams need to treat unmanaged SaaS as part of the identity estate because ungoverned apps create access, compliance, and offboarding blind spots that span human and non-human workflows.

By the numbers:

• 34% of applications sit outside of the company’s SSO, according to 1Password.

Context

Shadow SaaS becomes a governance problem when employees adopt applications outside central IT oversight and those tools never enter the identity and access management workflow. In practice, that means discovery, approval, review, and offboarding happen too late or not at all, leaving the organisation with fragmented control over who can use what.

The article frames business-led IT as a structural reality rather than a failure mode. That is the right starting point for IAM teams: if line-of-business teams choose tools to get work done, identity governance has to meet them with visibility and lifecycle control instead of trying to eliminate the behaviour.

For NHI and autonomous programmes, the same pattern matters because unmanaged SaaS often becomes the entry point for embedded tokens, API connections, and workflow automations. The identity problem is not only who signed up for the app, but what credentials and delegated access the app accumulates over time.

Key questions

Q: What breaks when SaaS is adopted outside approved governance processes?

A: When SaaS is adopted outside approved governance processes, organisations lose the connection between application ownership, user access, and renewal accountability. That creates stale subscriptions, duplicate tooling, and unreviewed entitlements that persist beyond business need. The practical failure is not just overspend. It is the loss of a reliable control path for who approved the app and who can remove it.

Q: Why do unmanaged SaaS applications create risk for sensitive data and compliance programs?

A: Unmanaged SaaS creates risk because security teams lose control over where data lives, who can access it, and whether the application meets internal and regulatory requirements. Unapproved apps may lack patches, integrate poorly, or store data outside governed systems. That combination increases exposure, makes audits harder, and can turn ordinary productivity tools into persistent security and compliance gaps.

Q: How can teams tell whether SaaS governance is actually working?

A: Look for evidence that discovered applications can be assigned an owner, tied to an access policy, and removed through an enforced workflow. If the platform can only report on SaaS usage but cannot drive deprovisioning or entitlement review, governance is still fragmented.

Q: How do organisations know whether shadow SaaS is actually under control?

A: They should be able to show a current inventory of SaaS apps, the identities using them, the data they hold, and the owner responsible for offboarding and renewal. If any of those four elements is missing, the programme still has blind spots. Control exists only when discovery, ownership, and lifecycle actions are connected.

Technical breakdown

Why shadow SaaS breaks identity governance

Shadow SaaS is any business application adopted outside the normal procurement and identity governance path. The security issue is not simply that the app exists. The issue is that identity teams lose the chance to assign ownership, review access, standardise authentication, and enforce offboarding before the app becomes part of daily work. Once that happens, the app may hold sensitive data, operate with stale permissions, and bypass the normal lifecycle controls that govern the rest of the estate.

Practical implication: build app discovery into identity governance so unmanaged SaaS is identified before it becomes invisible.

How automated discovery changes SaaS control

Automated discovery is the mechanism that turns shadow SaaS from a guessing exercise into an inventory problem. Instead of waiting for users to report an application, IT can continuously identify apps in use, compare them against managed inventory, and decide whether to standardise, approve, restrict, or retire them. This matters because the governance model changes from periodic cleanup to continuous lifecycle control, which is the only workable approach when business teams adopt tools whenever work demands it.

Practical implication: treat discovery as the first control in SaaS governance, not a reporting convenience.

Why lifecycle management matters more than blocking

Lifecycle management is the control layer that keeps SaaS aligned to business need after initial adoption. It covers access reviews, renewals, standardised management processes, and offboarding when the app is no longer justified. Blocking alone pushes activity into the shadows; lifecycle governance keeps the app visible and accountable. For identity teams, the key question is whether the application remains within a managed trust boundary after the first user signs up.

Practical implication: pair approval with ongoing lifecycle review so sanctioned SaaS does not drift into unmanaged use.

Breaches seen in the wild

• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
• Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Shadow SaaS is an identity governance problem before it is an IT preference problem. The article correctly treats business-led adoption as a durable operating reality, not a temporary exception. Once applications are adopted outside central oversight, the identity programme loses the ability to govern authentication, ownership, and offboarding on standard terms. The practitioner conclusion is clear: unmanaged SaaS must be treated as part of the identity estate, not as an exception outside it.

Business-led IT creates a governance gap when discovery is optional. The article’s 34% outside-SSO figure points to a broader failure of inventory discipline, not just SSO adoption. When teams cannot see the application, they cannot recertify it, standardise it, or retire it. The result is a control environment that looks complete on paper but is fragmented in practice. The practitioner conclusion is to make app discovery a governance input, not a periodic audit output.

Lifecycle control is the decisive concept here, not shadow IT suppression. The useful framing is that shadow usage becomes risky when renewal, access review, and offboarding are missing or delayed. That creates persistent exposure in the application layer even when the organisation believes it has a clean identity perimeter. The practitioner conclusion is to manage SaaS through the same lifecycle discipline applied to other identities and access relationships.

Unmanaged SaaS often becomes the container for wider identity sprawl. Once a business unit normalises a tool, the app may accumulate users, integrations, embedded credentials, and delegated workflows faster than IT can classify it. That is how governance blind spots spread from a single app into a broader access graph. The practitioner conclusion is to map application ownership alongside access ownership, then make standardisation decisions from that combined view.

Ephemeral app adoption creates an identity blast radius if ownership is unclear. The article shows why ad hoc SaaS use cannot be left to local convenience. Without a clear accountable owner and a managed inventory, each new tool expands the blast radius of poor access decisions, redundant licensing, and unreviewed data exposure. The practitioner conclusion is to assign governance ownership before the app becomes embedded in business operations.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: NHI Lifecycle Management Guide

What this signals

Business-led IT only works when discovery is continuous. The practical shift is from one-time inventory projects to an always-on view of SaaS adoption, because business units will keep choosing tools whenever work patterns change. That makes application visibility a governance control, not a reporting metric.

Shadow SaaS is where IAM, IGA, and lifecycle management converge. The same app can introduce authentication sprawl, unreviewed access, and offboarding failure if ownership is not defined. Teams that already manage human identities need to extend the same discipline to application inventories and delegated access paths.

Lifecycle control, not suppression, is the sustainable model for business-led IT. Discovery, approval, review, and retirement should be one operating model, because trying to eliminate local tool choice usually drives adoption outside the controls you were trying to preserve.

For practitioners

• Build continuous SaaS discovery into identity governance Continuously inventory applications in use, compare them to approved platforms, and flag anything that has entered the environment without a managed workflow.
• Standardise app ownership and approval criteria Require each business application to have a named owner, a documented purpose, and a decision path for whether it should be approved, restricted, or retired.
• Tie access reviews to the managed app inventory Move review cycles from ad hoc spreadsheets into the inventory process so unmanaged applications cannot bypass recertification or renewal checks.
• Offboard SaaS through lifecycle workflows Remove users, integrations, and redundant licenses when an app is no longer justified, and treat offboarding as part of normal governance rather than cleanup.
• Review shadow SaaS for embedded credentials and integrations Check whether unmanaged applications contain tokens, API connections, or delegated access that must be governed alongside user access.

Key takeaways

• Unmanaged SaaS is best understood as a governance gap, not simply an unsanctioned software problem.
• Discovery, ownership, access review, and offboarding are the controls that keep business-led IT inside a managed identity model.
• When shadow SaaS is handled as part of lifecycle governance, organisations can preserve productivity without losing oversight.

Key terms

• Shadow SaaS: Shadow SaaS is the set of unauthorised or unreviewed software-as-a-service tools used outside central security governance. These applications often bypass normal identity controls, making them difficult to inventory, monitor, and harden against credential-based abuse.
• Business-led IT: Business-led IT is a governance model where line-of-business teams influence tool selection because they understand operational needs better than central IT does. In a secure programme, that autonomy is paired with visibility, approval paths, and lifecycle control so local choice does not become unmanaged access.
• Lifecycle Management: Lifecycle management is the process of creating, reviewing, rotating, and retiring identities and their secrets in a controlled way. For NHIs, it is essential because stale credentials, orphaned accounts, and incomplete offboarding are common paths to long-lived exposure and unauthorised access.
• Application Inventory: An application inventory is the authoritative list of software an organisation believes it uses and governs. For identity teams, the inventory matters because every access review, ownership decision, and offboarding workflow depends on it being complete enough to reflect the real application estate.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.