SaaS discovery gaps are turning shadow IT into access risk

At a glance

What this is: JumpCloud’s article argues that SaaS discovery gaps are creating access risk because organisations cannot govern what they cannot see, especially as employees adopt applications outside IT control.

Why it matters: IAM and security teams need discovery before control, because unmanaged SaaS usage can hide OAuth permissions, shadow accounts, and unapproved data flows across human and non-human access paths.

By the numbers:

• 38% of admins admit they can’t even discover all applications in use.

Context

SaaS discovery is the governance problem behind shadow IT: if teams cannot identify which applications are in use, they cannot reliably review access, approve integrations, or revoke risky grants. In identity terms, the issue is not just application sprawl, but the loss of authoritative inventory across user-driven and credential-driven access paths.

The article frames visibility as the prerequisite for SaaS control because unmanaged apps can carry authentication, OAuth permissions, and account relationships that sit outside normal IT oversight. That makes discovery an IAM and governance issue, not merely an inventory exercise.

For practitioners, the operational question is whether current controls can distinguish approved SaaS usage from unsanctioned adoption before access becomes embedded in day-to-day work. In most organisations, that answer is still no.

Key questions

Q: What should IAM teams do first when they cannot see all SaaS applications in use?

A: Start by building a complete discovery picture from browser activity, SSO logs, and direct connectors. The first goal is not remediation but inventory quality, because access decisions cannot be trusted until you know which apps, accounts, and OAuth grants actually exist across the environment.

Q: Why do unseen SaaS apps create security risk even when users are productive?

A: Unseen SaaS apps create risk because productivity does not remove the governance gap. If an app is outside IT control, its authentication, permissions, and data flows may never be reviewed, which means the organisation can lose oversight over who has access to what and for how long.

Q: What signals show that SaaS governance is not working?

A: Look for delayed offboarding, repeated manual exports, inconsistent access review responses, and inactive accounts that still carry paid licenses. Those signals indicate that entitlement ownership and usage data are not reconciled often enough to support reliable governance.

Q: How should security teams govern Shadow IT without slowing users down?

A: Start with visibility, not prohibition. Classify shadow applications by business value and data exposure, then apply graded responses such as approve, warn, or block. Pair that with clear ownership so business teams can explain why a tool exists and IAM can prove who can access it. The goal is controlled adoption, not blanket prevention.

Technical breakdown

Why SaaS discovery fails when access starts in the browser

SaaS discovery often fails because the first signal of app usage appears in the browser, not in a central admin console. Browser-based adoption creates a gap between user behaviour and governance systems, so IT sees activity only after accounts, sessions, or data flows already exist. That gap matters because SaaS usage is frequently credential-linked and identity-mediated, which means each unseen app can become an unmanaged access path. Discovery needs to operate at the point of use, not only at the point of approval.

Practical implication: add browser-level discovery to close the gap between app use and IT visibility.

How OAuth permissions turn shadow IT into identity risk

When users grant OAuth access to third-party apps, the risk is not just that the app is unapproved. The deeper issue is delegated access that can persist beyond the user’s original intent, especially if the grant is not reviewed, inventoried, or revoked. In SaaS environments, OAuth permissions can expose identity-linked data and create durable trust relationships that outlive the business need. That is why SaaS discovery has to include permission scope, not just app names.

Practical implication: inventory OAuth grants alongside applications so delegated access can be reviewed and revoked.

Why SSO coverage is not the same as SaaS governance

SSO-connected applications are easier to track, but they do not represent the full SaaS estate. A managed login path gives visibility into approved apps, yet shadow IT often emerges through tools that sit outside SSO or through separate identity boundaries such as personal sign-ups and ad hoc integrations. Effective governance needs a single view of both approved and unapproved apps so that access review, approval, and offboarding can be applied consistently. Without that, SSO becomes a partial control rather than a complete governance layer.

Practical implication: compare your SSO catalogue with discovered app usage to identify unmanaged SaaS gaps.

Threat narrative

Attacker objective: The practical objective is not necessarily initial compromise, but persistence of uncontrolled access paths that can expose data and expand the attack surface.

1. Entry occurs when employees adopt SaaS applications outside IT involvement, creating access paths that never pass through formal approval or cataloguing.
2. Credential or account linkage is established when users connect those apps through company credentials, OAuth permissions, or separate SaaS accounts.
3. Impact follows when critical data flows through applications that are not being tracked, reviewed, or governed by the organisation.

Breaches seen in the wild

• SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Visibility debt is the real security debt in shadow IT. Once users can adopt SaaS tools faster than IT can inventory them, governance controls start operating on partial data. That undermines approval, review, and revocation processes across human identity and SaaS access, and the practitioner conclusion is simple: discovery quality sets the ceiling for every downstream control.

OAuth grants turn application discovery into delegated access governance. A discovered app is only one part of the problem if the linked permissions are still active, broad, or undocumented. The real governance question is who can act on behalf of whom, which makes SaaS discovery inseparable from access scope review and offboarding discipline.

Approved and unapproved SaaS now need to be governed as one estate. SSO coverage, browser discovery, and direct connectors each reveal different parts of the same environment. Teams that treat them as separate programmes create blind spots between sanctioned apps, personal sign-ups, and shadow accounts, so the practitioner task is to unify discovery before attempting control.

Browser-based usage tracking is becoming a baseline control, not a nice-to-have telemetry layer. The article’s model shows why central logs alone are insufficient when adoption begins in the endpoint browser. That shifts the governance priority toward continuous discovery tied to identity context, because the organisation cannot manage what it only sees after the fact.

SaaS discovery is the front door to NHI oversight in modern workplaces. Once connectors expose app-to-app integrations, service-linked activity, and OAuth-based access, the boundary between human usage and non-human access starts to blur. The implication is that IAM teams must treat SaaS governance as a shared control plane for users, apps, and delegated identities.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: AI Agent Identity Security Buyer's Guide

What this signals

Visibility debt will remain the limiting factor in SaaS governance until discovery is treated as a continuous control. Browser telemetry, SSO inventories, and app connectors each expose a different slice of the estate, so teams need to reconcile them instead of relying on a single source of truth. The practical shift is from periodic app inventory to ongoing access governance.

Shadow IT becomes more dangerous when it is identity-linked. Once users connect unsanctioned SaaS with company credentials or delegated permissions, the issue moves beyond app sprawl into account and authorization risk. That makes OAuth review and unmanaged-account detection core IAM work, not peripheral SaaS administration.

For practitioners

• Map the SaaS estate from multiple discovery sources Combine browser-based discovery, SSO application inventories, and direct API connectors so approved and unapproved apps are visible in one governance view.
• Review OAuth grants for hidden delegated access Identify third-party permissions tied to work accounts, confirm the approved business need, and revoke access where the grant is no longer justified.
• Compare discovered apps against the SSO catalogue Reconcile what users actually access with what the identity platform marks as managed so shadow IT can be separated from sanctioned usage.
• Track shadow accounts inside high-value SaaS platforms Look for user accounts, app-to-app connections, and usage patterns inside core SaaS tools that exist outside standard onboarding and offboarding workflows.

Key takeaways

• Shadow IT becomes an access problem when organisations cannot see which SaaS apps, accounts, and permissions are actually in use.
• The article’s central warning is that discovery gaps leave administrators blind to unmanaged applications and the grants attached to them.
• The effective control response is to unify browser discovery, SSO visibility, and connector data so access review can operate on a complete inventory.

Key terms

• Shadow IT: Shadow IT is the use of applications or services outside formal enterprise approval or visibility. In SaaS environments, it often includes department-purchased tools and unsanctioned integrations that create hidden identity, data, and access paths the security team cannot readily govern.
• SaaS Discovery: SaaS discovery is the process of identifying all sanctioned and unsanctioned software-as-a-service applications in use across the organisation. It matters because cloud assurance increasingly depends on seeing where apps share data, what permissions they hold, and which identities can reach them.
• OAuth Grant: An OAuth grant is the delegated permission an application receives to act on a user's behalf without storing the user's password. In NHI governance, it should be treated as a standing identity relationship with scope, ownership, and revocation requirements, not as a one-time setup detail.
• SSO Catalogue: The list of applications formally integrated with single sign-on and therefore known to the identity platform. In this context, the catalogue is only one part of governance because it can miss apps used outside SSO or outside approved workflows.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.