SaaS access reviews and offboarding are breaking lean IT teams

At a glance

What this is: Josys profiles how a lean IT team managing more than twenty SaaS applications with spreadsheets struggled with offboarding, access reviews, and license visibility until centralised lifecycle controls reduced manual work.

Why it matters: This matters because SaaS sprawl turns access governance into an operational bottleneck, and IAM teams need a repeatable way to manage joiner-mover-leaver events, reviews, and ownership across many apps.

By the numbers:

• Josys uncovered $5,000 in unused licenses tied to GitHub and Adobe during the first demo.

Context

Lean SaaS governance breaks down when a small IT team has to reconcile users, licenses, and access rights across dozens of applications by hand. In ebbo’s case, every hire, exit, or role change meant logging into multiple portals, exporting lists, and matching them against spreadsheets, which made lifecycle control slow and error-prone.

The identity governance issue here is not only about reducing admin workload. It is about whether an organisation can keep access reviews current, offboarding timely, and ownership visible when the application estate grows faster than the team managing it. That is the point at which spreadsheet-based control stops being a governance model and becomes a liability.

Key questions

Q: What breaks when SaaS access reviews rely on spreadsheets?

A: Spreadsheets freeze access data in time, so reviewers work from stale exports while roles, teams, and app usage keep changing. That creates entitlement drift and weak evidence for auditors. A better model is recurring review automation with current usage, department, and risk context, plus direct remediation from the review step.

Q: Why do delayed offboarding processes create security risk?

A: Delayed offboarding creates security risk because access can remain active after the business relationship ends. Former users may still reach email, files, CRM, or admin tools, which expands the window for data theft or disruption. The issue is not the departure itself, but the period during which stale access still works.

Q: How can organisations tell whether SaaS access governance is actually working?

A: They should look for three signals: low numbers of orphaned accounts, consistent entitlement recertification, and rapid revocation when users change roles or leave. If access remains valid across apps after a lifecycle event, governance is not working even if dashboards look complete.

Q: What is the difference between access review and offboarding in SaaS governance?

A: Access review confirms that existing permissions still match business need, while offboarding removes access when the user no longer needs it. Reviews are periodic assurance activities, but offboarding is a lifecycle action. A mature programme needs both, because review without removal leaves stale access in place.

Technical breakdown

Why spreadsheet-based SaaS access reviews break down

Spreadsheet-led access reviews depend on static exports, manual comparisons, and human follow-up. That model assumes application state stays still long enough to be reconciled, but SaaS environments change continuously through hires, exits, role changes, and app sprawl. Once the number of apps climbs, the review process becomes a batch exercise rather than a live control, so stale entitlements and orphaned access can persist between cycles. The problem is not just volume. It is the lack of a single source of truth for who owns access, what licenses are in use, and whether removal actually happened.

Practical implication: replace spreadsheet reconciliation with a system that tracks access state, ownership, and review outcomes in one place.

How delayed offboarding creates orphaned access and waste

Offboarding in SaaS is often fragile because deprovisioning must happen across many separate admin consoles. If the process is delayed, former employees can retain access to tools such as code repositories, design software, or collaboration platforms, even after they leave. That creates two risks at once: unnecessary license spend and residual access exposure. Manual offboarding also depends on someone remembering to act during leave periods, handovers, or terminations, which makes consistency difficult. Automated offboarding schedules reduce that dependency by turning a manual follow-up into a governed workflow.

Practical implication: automate offboarding triggers so terminated users lose app access without waiting for an administrator to remember each step.

Why quarterly access reviews need live entitlement ownership

Access reviews are only effective when reviewers can see current usage, current ownership, and current business justification. In a fragmented SaaS estate, those inputs are scattered across app teams, finance records, and local spreadsheets, so certification becomes a chore rather than a control. Real-time alerts and access review workflows shift the process from retrospective chasing to current-state validation. That matters because access reviews are meant to confirm that privileges still match business need, not to reconstruct an incomplete history after the fact.

Practical implication: run access reviews against live entitlement data and use business-owned confirmations instead of spreadsheet-based attestations.

Threat narrative

Attacker objective: The practical objective is not a single intrusion but prolonged access persistence that increases exposure and waste across the SaaS estate.

1. Entry occurs through ordinary SaaS account sprawl, where new hires, departures, and role changes create unmanaged access paths across many applications.
2. Credential or account abuse takes the form of retained access after offboarding, which leaves former users or stale permissions active in production SaaS tools.
3. Impact appears as orphaned licenses, avoidable compliance friction, and continued access to apps like GitHub or Adobe after employment changes.

Breaches seen in the wild

• Canvas Instructure Data Breach: ShinyHunters exploits Canvas LMS platform to expose millions of student records via third-party NHI credential abuse.
• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Centralised lifecycle control is the real control plane for lean SaaS teams. When a two-person IT function has to manage more than twenty SaaS applications through spreadsheets, the governance model itself becomes the bottleneck. The issue is not simply efficiency loss. It is that access, license, and ownership decisions are no longer enforced by one operational system, so every joiner-mover-leaver event becomes a manual exception. Practitioners should treat unified lifecycle control as the baseline, not the optimisation.

Orphaned access is usually a lifecycle failure before it becomes a security incident. If offboarding is delayed, former employees can retain access long after the employment relationship ends, which creates residual risk in applications that hold code, documents, or customer data. That pattern is especially damaging because the organisation often discovers it through audit pressure or cost review rather than through access governance. The control gap is persistence of entitlement after the need has ended.

Access review fatigue is a governance signal, not an administrative annoyance. Quarterly certification becomes slow and error-prone when reviewers must reconcile spreadsheets against multiple admin portals. In practice, that means the organisation is asking humans to perform a machine-scale reconciliation task without machine-scale visibility. The result is weak attestations, delayed decisions, and incomplete assurance. Practitioners should read review fatigue as evidence that the certification process is structurally under-instrumented.

SaaS sprawl turns license management into identity governance by another name. Once unused licenses, application ownership, and access state are all split across separate files, the organisation loses the ability to distinguish entitlement from waste. That is why contract dates, department spend, and app usage matter together. For identity teams, the implication is clear: lifecycle governance for SaaS now spans access, cost, and accountability in one operating model.

Identity blast radius: In lean teams, the damage from one unmanaged joiner-mover-leaver event is not confined to a single app. It expands across every system where the same manual process, spreadsheet, or missed offboarding step is reused. The practitioner takeaway is to map where a single access change can cascade across the SaaS estate and close those shared failure points first.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: SaaS-to-SaaS and OAuth App Governance Guide

What this signals

Unified SaaS lifecycle control is now a baseline requirement for lean IT teams. When access, ownership, and license utilisation are split across spreadsheets and portals, the governance model cannot keep up with routine joiner-mover-leaver churn. The practical shift is toward a single operational view that lets teams decide faster and audit less manually.

Third-party SaaS sprawl expands the identity blast radius. Josys’s example shows why unmanaged external and internal access paths should be treated as part of the same governance problem, not separate administrative chores. According to the Ultimate Guide to NHIs, 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, and the same governance weakness appears when SaaS access is left fragmented. The practitioner signal is to reduce the number of places where offboarding can fail.

Automation should remove routine access work, not obscure accountability. Access review surveys, offboarding schedules, and real-time alerts only help when ownership remains explicit and exceptions are visible. Teams should measure whether automation shortens the time between a lifecycle event and the corresponding access change, because that is where governance either holds or breaks.

For practitioners

• Implement a single SaaS ownership register Maintain one authoritative view of each application, its business owner, and its access approver so reviews and offboarding do not depend on tribal knowledge.
• Automate offboarding for leavers Trigger deprovisioning workflows from HR or directory events so terminated users lose access across SaaS tools without manual portal-by-portal cleanup.
• Tie access reviews to live entitlement data Use current usage and owner confirmation as the basis for review decisions instead of stale spreadsheet exports and email chains.
• Track unused licenses alongside access Review license utilisation and app ownership together so the same workflow reduces waste, closes orphaned accounts, and improves audit readiness.
• Set alerts for post-termination access Notify the team immediately when a terminated user still appears active in any SaaS application so exceptions can be corrected before the next review cycle.

Key takeaways

• Lean SaaS teams do not just lose time to manual admin work. They also lose governance consistency when access reviews and offboarding are spread across spreadsheets and isolated app consoles.
• The article’s example shows that unused licenses, delayed deprovisioning, and audit friction often stem from the same problem. Lifecycle control is fragmented, not merely inefficient.
• Centralising ownership, automating offboarding, and reviewing live entitlement data are the practical controls that reduce both risk and overhead.

Key terms

• SaaS Access Governance: SaaS access governance is the control of who can reach cloud applications, how that access is exercised, and what conditions trigger review or restriction. It extends beyond sign-in events to include session behaviour, extension interference, and identity misuse after authentication.
• Off-boarding: Off-boarding is the process of removing a departing user’s access, credentials, and related entitlements from the environment. In mature IAM programmes, it also includes reviewing sessions, shared secrets, delegated roles, and linked non-human identities so that exit events do not leave behind hidden access paths.
• Orphaned license: A software subscription seat that remains active after the original user no longer needs it. Orphaned licenses create direct cost leakage and can also preserve access paths or data ownership links that should have been retired during offboarding.
• Identity Lifecycle Governance: Identity lifecycle governance is the set of processes that create, change, review, rotate, and revoke access across human and non-human identities. It matters because access risk usually increases when lifecycle events are slow, incomplete, or disconnected from the systems that rely on them.

Deepen your knowledge

NHI governance, identity lifecycle management, and workload identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.