SaaS discovery and license control: what Zluri vs BetterCloud shows

At a glance

What this is: This comparison examines how SaaS discovery and licence control differ when a platform uses nine discovery methods instead of two, and why that matters for visibility into shadow IT and SaaS governance.

Why it matters: IAM, IGA, and security teams need discovery that finds unsanctioned apps early enough to govern access, licences, and risk across the SaaS estate rather than after sprawl has already become embedded.

Context

SaaS discovery is the control that tells identity and security teams what exists before they can govern it. In a SaaS-heavy environment, visibility is not the same as enforcement, and a single inventory source rarely captures apps purchased outside IT, connected through OAuth, or used only from browsers and endpoints.

The article compares BetterCloud and Zluri through discovery, licence management, spend control, app security, and customer ratings. Its practical argument is that broader discovery coverage changes how teams identify shadow IT, reclaim unused licences, and understand SaaS as an access problem rather than only a procurement problem.

Key questions

Q: What breaks when SaaS discovery only covers one or two signal sources?

A: Narrow discovery leaves blind spots in shadow IT, OAuth-connected apps, browser-only tools, and purchases made outside IT, so access reviews and licence decisions are based on incomplete evidence. The result is governance that can report on known apps but cannot reliably find the apps that were never brought under control.

Q: Why does SaaS sprawl increase non-human identity risk?

A: SaaS sprawl increases NHI risk because every new integration can create tokens, service accounts, OAuth grants, and delegated permissions that persist outside normal review cycles. Those identities often have more reach than human users and fewer lifecycle checks. The result is wider attack surface and harder-to-audit access paths.

Q: What signals show that SaaS license management is working?

A: Look for fewer premium licenses left idle, a shorter gap between usage decline and downgrade, and a clear owner for every renewal decision. If teams can explain why each higher-tier license exists, governance is improving. If they cannot, spend control is still mostly reactive.

Q: What is the difference between SaaS configuration and SaaS governance?

A: SaaS configuration is the on or off state of a feature. SaaS governance is the policy, ownership, monitoring, and cleanup process that determines whether the feature can be used safely. A disabled setting may reduce exposure, but only governance ensures identities, content, and exceptions are managed over time.

Technical breakdown

Why SaaS discovery depends on source diversity

SaaS discovery works by correlating signals from identity providers, finance systems, endpoints, browser activity, MDM, CASB, HR systems, and direct integrations. The technical issue is not simply how many connectors exist, but whether those connectors observe different control planes where app usage appears. OAuth grants reveal delegated access, SSO logs reveal authenticated usage, finance data reveals unsanctioned purchases, and endpoint telemetry can expose apps that never touch central identity tooling. A discovery model with only one or two signal types will miss entire classes of usage, especially when employees install or subscribe outside sanctioned workflows.

Practical implication: Treat SaaS discovery as multi-signal correlation, not a single inventory feed.

How licence control changes when discovery finds hidden apps

Licence management depends on knowing which apps are active, redundant, underused, or bought without oversight. Once discovery includes finance tools, direct integrations, and activity telemetry, the control objective shifts from counting licences to governing entitlement drift across business units and informal purchases. That makes reclamation, rightsizing, and forecasting possible only when the organisation can distinguish an unused licence from a dormant but still-business-critical app. In practice, licence control is a governance workflow built on evidence, not just a cost-reporting feature.

Practical implication: Tie licence reclamation to usage evidence and ownership, not just spend reports.

Why shadow IT becomes an identity governance issue

Shadow IT is not only an application catalog problem. It is a governance problem because every unsanctioned SaaS app may create a new authentication path, a new OAuth consent, or a new access footprint outside normal review cycles. When discovery misses those apps, recertification, offboarding, and least-privilege decisions operate on incomplete data. That is why SaaS visibility belongs in IAM and IGA conversations, not only in IT asset management. The control question is whether the organisation can govern access to systems it did not formally approve in the first place.

Practical implication: Bring shadow IT discovery into IAM and IGA workflows so review and offboarding use complete app data.

NHI Mgmt Group analysis

SaaS discovery is an identity control, not a reporting feature: the operational question is whether teams can see every app that creates an access relationship, including OAuth grants, SSO use, browser activity, and purchases outside IT. A narrow inventory leaves governance blind to the places where SaaS is actually adopted. The implication is that discovery quality directly determines whether access governance is real or performative.

Shadow IT becomes a lifecycle problem once apps are bought and used outside formal channels: the issue is not only that an app exists, but that it can persist without ownership, review, or offboarding. Finance tools, endpoint signals, and identity logs together expose where the lifecycle was never entered into the control process. Practitioners should treat unsanctioned SaaS as unmanaged identity scope, not just unsanctioned software.

Licence rationalisation only works when usage evidence is broad enough to separate waste from dependency: underused subscriptions, duplicate applications, and hidden renewals cannot be governed from a single dashboard view. Better licence control emerges when usage telemetry and purchasing signals are combined into one decision model. For practitioners, the lesson is to align reclaim, renewal, and approval decisions to observed application behaviour, not assumptions.

Identity governance for SaaS depends on control-plane coverage across the whole stack: the strongest discovery model is the one that sees the app through identity, finance, device, and browser lenses at once. That is because SaaS sprawl often begins in one layer and becomes a governance issue in another. Practitioners should measure coverage by missed app classes, not by connector count alone.

Coverage gap is the named concept here: what matters is not whether a platform claims visibility, but whether it misses specific SaaS adoption paths that create governance blind spots. When discovery does not span purchase, authentication, endpoint use, and browser use, control coverage is incomplete. The practical conclusion is to evaluate SaaS governance tools by the classes of apps they fail to surface.

What this signals

Coverage gap: SaaS governance fails when discovery only sees the sanctioned control plane. The practical challenge is to find applications purchased outside IT, accessed through delegated consent, or used only from endpoints and browsers before those tools become embedded in the identity estate.

Discovery breadth matters because SaaS sprawl often appears first in places IAM teams do not monitor closely enough, especially finance-led purchases and informal app adoption. Practitioners should think about coverage by missed app classes, not by how many dashboards a tool can populate.

For practitioners

• Map discovery sources to control gaps Inventory which signal sources you rely on for SaaS visibility, then identify which adoption paths those sources cannot see, such as browser-only use, finance-led purchases, or direct integrations.
• Link licence reclamation to usage evidence Require active usage, ownership, and business justification before reclaiming or renewing SaaS licences so that dormant access and real dependency are not treated the same.
• Fold shadow IT into offboarding reviews Use SaaS discovery results during joiner-mover-leaver and offboarding reviews so unsanctioned apps are removed from the identity scope before they become persistent access paths.
• Measure discovery coverage by missed app classes Assess whether your controls detect apps purchased outside IT, accessed through OAuth, used through SSO, or installed only on endpoints and mobile devices.

Key takeaways

• SaaS visibility is only as strong as the variety of signals feeding discovery, and narrow connector sets leave unmanaged apps outside the governance model.
• Licence control improves when organisations use real usage evidence, ownership data, and discovery coverage together instead of treating renewals as a finance-only exercise.
• Shadow IT becomes an IAM problem when unsanctioned SaaS apps create unreviewed access paths that offboarding and recertification never see.

Key terms

• SaaS Discovery: SaaS discovery is the process of identifying all sanctioned and unsanctioned software-as-a-service applications in use across the organisation. It matters because cloud assurance increasingly depends on seeing where apps share data, what permissions they hold, and which identities can reach them.
• Shadow IT: Shadow IT is the use of applications or services outside formal enterprise approval or visibility. In SaaS environments, it often includes department-purchased tools and unsanctioned integrations that create hidden identity, data, and access paths the security team cannot readily govern.
• Licence Reclamation: Licence reclamation is the removal or downgrade of software entitlements that are no longer justified by usage. In identity governance terms, it is a lifecycle action based on observed need, and it becomes more effective when usage telemetry is reliable enough to trigger automated review or deprovisioning.
• Coverage Gap: A coverage gap is the space between what an access control programme claims to manage and what it actually governs in production. In PAM, this often appears when new resource types, teams, or protocols require exceptions, manual handling, or separate tooling, leaving important privileged pathways outside policy consistency.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.