SaaS asset management is becoming an identity governance problem

At a glance

What this is: This article argues that SaaS asset management now needs to be treated as an identity governance problem because access, renewals and offboarding are inseparable from software oversight.

Why it matters: It matters because IAM, IGA and PAM teams cannot govern SaaS spend or risk effectively if app ownership, user assignment and revocation sit outside lifecycle controls.

Context

SaaS asset management is no longer just about counting subscriptions or trimming software spend. In practice, it now spans app discovery, user assignment, renewals, vendor relationships and access revocation, which puts it squarely into identity governance territory.

The gap is familiar to IAM and IGA teams: if SaaS apps can be purchased and used without IT visibility, then licence management, access control and offboarding drift apart. That creates duplicate spend, orphaned access and inconsistent accountability across employees and external users.

The article frames SaaS management as a centralised control problem, but the deeper issue is governance scope. Once SaaS usage is tied to joiner-mover-leaver workflows, the boundary between software asset management and identity lifecycle management disappears.

Key questions

Q: What breaks when SaaS spend management is treated separately from identity governance?

A: The organisation can remove licences without removing accounts, or keep accounts active without any clear business need. That split leaves shadow access in place, weakens ownership, and produces a false sense of control because the finance view and the identity view never meet.

Q: Why do hidden SaaS renewals create security risk as well as cost waste?

A: Hidden renewals keep software and its access paths alive after the original business need may have ended. That means dormant integrations, stale administrative accounts, and forgotten data sharing can persist unnoticed. The risk is not only budget leakage. It is the continued existence of access that no one is actively reviewing.

Q: How can teams tell whether SaaS governance is actually working?

A: Look for evidence that discovered applications can be assigned an owner, tied to an access policy, and removed through an enforced workflow. If the platform can only report on SaaS usage but cannot drive deprovisioning or entitlement review, governance is still fragmented.

Q: How should teams align SaaS procurement with access governance?

A: Treat procurement as the start of the control chain, not the end. Every SaaS purchase should carry an owner, approved user population, review cadence, and offboarding process. That way finance, IT, and security are making the same decision record, and the organisation can revoke access when the business need changes.

Technical breakdown

Why SaaS asset management behaves like identity governance

SaaS asset management is not the same as traditional on-prem software asset management because the control problem is no longer just licence inventory. SaaS usage is dynamic, users can self-provision apps, and access often persists independently of procurement records. That means the relevant object to govern is not only the subscription, but also the user entitlement attached to it. Once licences, app access and business ownership are decoupled, a software asset programme starts behaving like an IGA programme with financial reporting attached.

Practical implication: treat SaaS inventory, entitlement ownership and revocation as one governed lifecycle, not as separate operational lists.

Why spreadsheets and ITAM tools miss the SaaS control point

Spreadsheets fail because they are static, manual and quickly stale when app adoption happens continuously across the business. IT asset management tools are useful for hardware and fixed estate tracking, but they do not usually capture the entitlement-level detail needed for SaaS governance, such as who has an app, how it was approved and whether it was removed on exit. The control gap is not visibility alone. It is the inability to connect application usage to ownership, renewal decisions and offboarding outcomes in time to matter.

Practical implication: replace manual inventory tracking with controls that tie app ownership to user assignment, renewal alerts and revocation events.

How automated licence lifecycle controls reduce SaaS governance drift

The article’s strongest operational point is that requisition, approval and revocation should be handled as one workflow across onboarding and offboarding. That turns SaaS management into a lifecycle control instead of a periodic clean-up exercise. It also extends governance to third parties such as vendors, freelancers and consultants, whose access can otherwise outlive their business need. In IAM terms, the issue is not only who got access, but whether access termination is reliably tied to the end of the relationship.

Practical implication: align SaaS app approval and revocation with joiner-mover-leaver processes so access does not outlast business need.

NHI Mgmt Group analysis

SaaS asset management is now an identity governance discipline, not a procurement exercise. Once app buying, user assignment and offboarding happen outside IT visibility, the real control problem becomes who can access what and for how long. The article is strongest where it shows that software oversight and access governance are converging, especially for internal users and external collaborators. Practitioners should treat SaaS stewardship as part of the identity lifecycle, not a standalone asset ledger.

Manual tracking fails because SaaS changes faster than governance cadences. Spreadsheets can record ownership, but they cannot reliably enforce approval, renewal and termination at the pace SaaS is adopted. That means the organisation inherits stale assignments, duplicate licences and delayed revocation. The practical conclusion is that periodic review alone is not enough when the control surface changes continuously.

Joiner-mover-leaver workflows are the missing governance bridge for SaaS spend and access. The article shows that procurement, IT and security all need the same lifecycle signal, because renewals and access changes are the same governance event from different angles. This is where identity governance becomes financially material as well as security-relevant. Teams should manage SaaS licences through lifecycle ownership, not isolated application administration.

Third-party SaaS access is a lifecycle risk, not just a vendor-management detail. The article explicitly calls out vendors, freelancers and consultants, which is where many organisations lose governance continuity. External access often has weaker ownership, lighter review and less reliable offboarding than employee access. That makes third-party SaaS entitlement control a core NHI and access-governance concern, not a peripheral procurement issue.

What this signals

SaaS lifecycle governance is becoming a core IGA pattern: organisations that still treat software assets as a procurement record will struggle to keep pace with how SaaS is actually adopted, assigned and retired. The control point is shifting toward entitlement ownership and revocation at the moment the business relationship changes.

For identity and security teams, the practical signal is that SaaS oversight now belongs in the same operating model as joiner-mover-leaver processes, not in a separate asset spreadsheet. The more apps are bought outside IT, the more governance depends on discovery, ownership and termination discipline.

For practitioners

• Map SaaS ownership to a named business owner Assign every SaaS application to a clear accountable owner who can approve access, review usage and accept renewal decisions. Do not let app ownership remain implicit in procurement, because unknown ownership is where orphaned licences and unmanaged access persist.
• Tie SaaS onboarding and offboarding to JML workflows Connect app requests, approvals and revocations to joiner-mover-leaver processes so access changes follow employment and engagement changes. Include contractors, freelancers and vendors in the same lifecycle path where they use company SaaS.
• Replace static spreadsheets with continuous discovery Use discovery methods that can surface apps, users, licence types and usage patterns continuously rather than at monthly or quarterly intervals. The goal is to reduce stale records and identify abandoned apps before renewal decisions are made.
• Build renewal decisions around usage and risk Use contract and payment alerts to review whether each app is still being used, whether the licence tier matches need and whether the app presents an elevated governance or data exposure risk. Renewal should be a control point, not an accounting formality.
• Extend offboarding to external identities Ensure vendor, freelancer and consultant access is removed when the business relationship ends, and verify that app licences are actually revoked rather than merely marked inactive. This closes one of the most common lifecycle gaps in SaaS governance.

Key takeaways

• SaaS asset management now overlaps with identity governance because access, ownership and offboarding determine whether software is truly under control.
• The article shows why spreadsheets, generic ITAM and traditional SAM tools miss the SaaS control point when adoption is decentralised.
• The practical shift is toward lifecycle-based governance that ties app approval, usage review and revocation to business ownership.

Key terms

• SaaS Portfolio Management: The process of assessing, classifying, and governing an organisation's cloud application stack so it aligns with business need and security expectations. In practice, it combines cost control, access oversight, renewal decisions, and retirement hygiene into one continuous management loop.
• Joiner-Mover-Leaver Lifecycle: The joiner-mover-leaver lifecycle describes the access changes that should happen when a person or account is created, changes role, or exits the organisation. It is the basic operating model for keeping entitlements aligned to current need, and it becomes critical when automation replaces manual ticket handling.
• SaaS Sharing Entitlement: A SaaS sharing entitlement is any permission that allows data to be accessed outside the original owner or team, including links, folder access, email distribution, and connected app permissions. In governance terms, it is an access object that needs lifecycle control, not a one-time convenience setting.
• Software Asset Discovery: The process of identifying which software applications are in use, who uses them and where the related licences reside. For SaaS governance, discovery must be continuous enough to support renewals, offboarding and risk review before decisions are made.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.