TL;DR: Tracking SaaS licenses is less about cost control than governance, because manual spreadsheets, employee surveys, ITAM, and SAM all miss parts of the software stack, according to Zluri. The real issue is that fragmented discovery leaves shadow IT, unused licenses, and offboarding gaps visible only after spend and access have already drifted.
At a glance
What this is: This article argues that SaaS license tracking is primarily a governance problem, not just a cost-management task, because manual and legacy methods miss shadow IT and lifecycle gaps.
Why it matters: IAM, IGA, and SaaS governance teams need a complete discovery and offboarding model because incomplete license visibility drives waste, unmanaged access, and audit exposure.
Context
SaaS license tracking is the discipline of identifying which applications are in use, who has access, what is being paid for, and what needs to be revoked or renewed. In this article, the central problem is that the discovery process is incomplete, so the organisation cannot reliably govern its SaaS footprint.
That gap matters to identity programmes because SaaS sprawl creates unmanaged access paths, duplicate entitlements, and broken offboarding. When discovery is fragmented across spreadsheets, surveys, ITAM, and SAM, the organisation sees cost drift first and governance failures only later.
Key questions
Q: What breaks when SaaS access reviews rely on spreadsheets?
A: Spreadsheets freeze access data in time, so reviewers work from stale exports while roles, teams, and app usage keep changing. That creates entitlement drift and weak evidence for auditors. A better model is recurring review automation with current usage, department, and risk context, plus direct remediation from the review step.
Q: Why do ITAM and SAM miss shadow IT in SaaS environments?
A: They miss it because they were built around hardware and on-premise software, not browser-delivered subscriptions created outside traditional procurement flows. SaaS adoption often happens through self-service sign-up or business-led purchasing, so endpoint-focused inventory leaves a gap where access exists but the governance team cannot see it.
Q: How can teams tell whether SaaS governance is actually working?
A: Look for evidence that discovered applications can be assigned an owner, tied to an access policy, and removed through an enforced workflow. If the platform can only report on SaaS usage but cannot drive deprovisioning or entitlement review, governance is still fragmented.
Q: How should organisations govern SaaS licenses as part of IAM and IGA?
A: Treat SaaS licenses as governed entitlements, not just commercial line items. Link each license to an owner, a business purpose, and a review cadence so access can be validated, reclaimed, or retired when the need changes. That approach reduces shadow IT and prevents dormant access from surviving contract renewals.
Technical breakdown
Why spreadsheets fail as a system of record for SaaS licenses
Spreadsheets are a static inventory tool, not a control plane. They depend on manual updates, so they cannot keep pace with employee sign-ups, app reassignment, contract renewal, or dormant access. In practice, that means the record lags the real environment and turns into a retrospective log rather than a live source of truth. For SaaS governance, this creates a visibility gap between the access that exists and the access that is recorded.
Practical implication: Use spreadsheets only as a temporary inventory aid, not as the authoritative record for SaaS entitlement governance.
Why ITAM and SAM miss the SaaS layer
IT asset management and software asset management were built around hardware and on-premise software, so they naturally under-cover browser-delivered SaaS usage. That mismatch matters because modern SaaS access is often created outside procurement and outside traditional software installation processes. The result is that the tools can report on endpoints or installed software while still missing the identity layer where SaaS licences are actually consumed, reassigned, or left active.
Practical implication: Separate SaaS discovery from endpoint and on-premise software management so governance does not stop at the device layer.
How discovery methods become the real governance control
SaaS governance depends on multi-source discovery because no single feed captures the full access picture. The article points to inputs such as SSO, identity providers, finance systems, HR systems, browser extensions, desktop agents, and direct app integrations. That is less about tool count than about control coverage: each source sees a different part of the lifecycle, from sign-up and usage to billing and offboarding. A credible system of record has to reconcile those views into one entitlement model.
Practical implication: Build reconciliation across identity, finance, and app data so renewal and revocation decisions are based on observed use, not assumptions.
Breaches seen in the wild
- SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Shadow IT is an identity governance failure before it is a cost problem: The article makes clear that unmanaged SaaS adoption begins when users can create access outside the controlled lifecycle. That means the organisation loses ownership of the joiner, mover, and leaver state for those apps, so governance never sees the entitlement until after spend and exposure have already accumulated. Practitioners should treat discovery completeness as a core identity control, not a procurement detail.
ITAM and SAM create false confidence when they are used as proxy controls for SaaS: These disciplines remain useful, but they were designed for different asset classes and do not map cleanly to browser-first software consumption. The result is a structural blind spot in which the organisation believes it has inventory coverage while the actual SaaS estate continues to expand through informal adoption. Teams should re-evaluate whether their current control set can actually observe software delivered through identity, not installation.
Offboarding is the point where license tracking becomes governance enforcement: The article repeatedly connects SaaS visibility to revocation, renewals, and workflow automation. That is the right framing because a license that is not terminated on exit or role change becomes a standing access obligation as well as a cost issue. In practice, the governance value lies in synchronising entitlement removal with lifecycle events, not in building a better spreadsheet.
Multi-source discovery is the only credible system of record for SaaS entitlement governance: A single source will always miss some part of the stack because SaaS usage is distributed across identity, finance, HR, and user activity signals. The named concept here is discovery fragmentation, and it is the condition that turns shadow IT from a one-off exception into a repeatable governance failure. Practitioners should measure whether their discovery model can reconcile those sources into one entitlement view before they trust any renewal or revocation decision.
What this signals
Discovery fragmentation is the core governance issue in SaaS license management, because no single control plane sees sign-up, usage, finance, and offboarding at the same time. Practitioners should treat reconciliation across those feeds as the prerequisite for any trustworthy renewal or revocation decision.
SaaS governance becomes materially stronger when entitlement decisions are tied to identity lifecycle events rather than periodic cleanup. That shift moves the programme from inventory maintenance to access enforcement, which is the point where shadow IT stops being invisible.
When ITAM or SAM are used as proxies for SaaS governance, the programme inherits blind spots from the asset class those tools were built for. Identity and access teams should challenge any process that cannot show where a license was created, who uses it, and when it is removed.
For practitioners
- Adopt multi-source SaaS discovery Correlate SSO, identity provider, HR, finance, app integrations, and user activity signals into one entitlement inventory so hidden apps do not escape governance.
- Retire spreadsheets as the control point Keep spreadsheets only as a transitional reference and move renewal, ownership, and offboarding decisions into a governed system of record.
- Tie revocation to lifecycle events Trigger license removal when employees leave, change roles, or no longer need an application, instead of waiting for periodic clean-up cycles.
- Review unused and duplicate licenses routinely Use usage evidence to identify dormant, duplicate, or over-tiered subscriptions and route them through renewal and downgrade decisions.
- Extend governance to external users Include vendors, freelancers, and consultants in the same licence tracking process so third-party access does not sit outside ownership and review.
Key takeaways
- SaaS license tracking is really a governance problem because incomplete discovery leaves shadow IT, unused licenses, and offboarding gaps outside control.
- Manual methods such as spreadsheets and surveys cannot keep pace with how SaaS is adopted, reassigned, and abandoned across the enterprise.
- A credible programme ties discovery, renewal, and revocation to identity lifecycle data so access decisions reflect actual use rather than assumptions.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | The article ties license tracking directly to revocation and offboarding gaps. |
| NHI-05 — Overprivileged NHI | Unused or over-tiered SaaS licenses create excess entitlement beyond actual need. | |
| Recommendation — Tie license removal to offboarding events so dormant SaaS access does not persist after departure. Review SaaS entitlements for excess access and downgrade anything that exceeds current role need. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The issue is incomplete visibility into who has what SaaS access and why. |
| Recommendation — Validate SaaS entitlements against approved access records before renewal or reissue. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article centers on tracking accounts, licences, and revocation across the SaaS estate. |
| Recommendation — Centralise account and licence management so shadow IT cannot bypass lifecycle control. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | SaaS license governance depends on timely removal and management of active access credentials. |
| Recommendation — Enforce credential and account lifecycle management so stale SaaS access is removed promptly. | ||
Key terms
- Shadow IT: Shadow IT is the use of applications or services outside formal enterprise approval or visibility. In SaaS environments, it often includes department-purchased tools and unsanctioned integrations that create hidden identity, data, and access paths the security team cannot readily govern.
- SaaS Discovery: SaaS discovery is the process of identifying all sanctioned and unsanctioned software-as-a-service applications in use across the organisation. It matters because cloud assurance increasingly depends on seeing where apps share data, what permissions they hold, and which identities can reach them.
- License governance: License governance is the process of tracking purchased seats, active use, renewal timing, and ownership so software entitlement matches business need. It becomes a control function when unused licenses are removed, reassigned, or tied to access review rather than left to drift.
- Joiner, Mover, Leaver Workflow: A joiner, mover, leaver workflow is the process that grants, updates, and removes access as a user or identity changes state. In modern programs, the same logic should extend beyond employees to service accounts and AI agents so access does not persist after need ends.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on June 11, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org