TL;DR: SaaS sprawl, shadow IT, and fragmented access governance are pushing organisations toward platforms that combine discovery, lifecycle automation, and review workflows, according to Zluri. KuppingerCole’s executive view highlights that SaaS management and IGA now need to operate as one control plane, not separate programmes.
At a glance
What this is: This summary of KuppingerCole’s Executive View says SaaS management and IGA are converging around shared identity control, driven by SaaS sprawl, shadow IT, and the need for lifecycle automation and access governance.
Why it matters: IAM and IGA teams should treat SaaS discovery, offboarding, and access review as one programme because fragmented ownership leaves hidden apps, stale access, and weak audit evidence.
Context
SaaS growth has turned application visibility into an identity governance problem, not just a software inventory problem. When business units can adopt cloud services faster than IT can track them, access control, lifecycle management, and compliance evidence become harder to maintain across the estate.
This article summarises KuppingerCole’s Executive View on Zluri’s SaaS management and IGA capabilities. The core message is that SaaS management and identity governance are converging because the same application sprawl that creates cost waste also creates access risk, review burden, and offboarding gaps.
Key questions
Q: How should security teams govern access across SaaS sprawl?
A: Security teams should govern SaaS sprawl with one inventory, one policy model, and one review process that covers both human and non-human access. The practical goal is to connect application approval, entitlement review, and revocation to business ownership. Without that linkage, access governance becomes a manual cleanup exercise instead of a control system.
Q: Why do periodic access reviews fail in dynamic SaaS environments?
A: Periodic reviews fail because they assess yesterday’s entitlement snapshot while access is changing every day. In SaaS-heavy environments, joiners, movers, leavers, and shadow applications create drift between review cycles, so the control becomes retrospective and incomplete. That leaves unowned and excessive access in place far too long.
Q: What breaks when offboarding does not fully remove directory access?
A: The directory stops reflecting current business reality. Access review, privileged access management, and incident response all become less reliable because the system still contains identities that appear authorised but no longer have a valid owner or purpose.
Q: What breaks when organisations try to rely on IGA alone for SaaS governance?
A: Relying on IGA alone leaves unmanaged SaaS outside standard joiner, mover, leaver processes and periodic access reviews. Former employees may retain access, risky apps may stay active, and app owners may never review permissions. In practice, the break point is not the IGA workflow itself but the gap between governed applications and the wider SaaS estate.
Technical breakdown
Why SaaS discovery now sits inside identity governance
SaaS discovery is no longer only about finding software. In practice, application inventory has become a prerequisite for knowing where identities exist, where entitlements are granted, and where access must later be reviewed or removed. The article’s emphasis on shadow IT shows why unmanaged applications create both financial waste and governance blind spots. A platform that centralises app and entitlement data can make lifecycle actions possible, but only if discovery is accurate and continuously refreshed. Without that, IGA controls are applied to an incomplete target set.
Practical implication: build a complete SaaS inventory before relying on lifecycle workflows, review campaigns, or deprovisioning automation.
How lifecycle automation changes SaaS access control
Lifecycle automation in SaaS governance ties onboarding, access requests, reviews, and deprovisioning into a single operational flow. That matters because the control problem is not just whether access is approved, but whether it is granted in the right context, documented, and later removed when the user changes role or leaves. The article points to granular control, contextual access requests, and playbook-driven deprovisioning as the mechanism that turns governance from periodic cleanup into continuous control. This is especially relevant when access spans many separate SaaS applications with different native administration models.
Practical implication: connect onboarding and offboarding workflows to application entitlements so access changes follow the person, not the app team’s manual queue.
Why access reviews fail when SaaS data is fragmented
Access reviews break down when reviewers cannot see the application, the entitlement, the risk, and the business context in one place. In SaaS environments, the scale of apps and the fragmentation of RBAC data make certification exercises slow and superficial. The article highlights policy-based remediation, multi-level reviews, and auditable evidence as the controls that reduce that friction. The underlying issue is not review frequency alone, but whether the review workflow is fed by complete entitlement data and can trigger actual remediation, not just attestation.
Practical implication: use entitlement-aware review workflows with remediation built in, rather than treating certifications as a separate paperwork exercise.
NHI Mgmt Group analysis
Unified SaaS governance is becoming an identity control problem, not a procurement problem. Once SaaS adoption outpaces central IT visibility, the same control gap appears in discovery, lifecycle management, and access review. That shifts the programme from software rationalisation to identity governance across the SaaS estate. Practitioners should treat app inventory as a prerequisite for access control, not a separate operational task.
The control plane is the point of convergence between SaaS management and IGA. SaaS optimisation, onboarding, offboarding, and certification all depend on the same underlying entitlement data. If the inventory is incomplete, every downstream control inherits the same blind spot. The practical conclusion is that discovery, lifecycle, and governance workflows need shared data and shared ownership.
Shadow IT is the named concept that explains why this category is merging. When users can adopt applications outside formal procurement, governance no longer starts at procurement approval but at continuous discovery. That changes how auditors, IAM teams, and SaaS owners think about completeness and evidence. The practitioner takeaway is that unmanaged apps are now identity governance debt, not just IT sprawl.
Access review quality now depends on entitlement fidelity, not review frequency. Periodic certification alone cannot compensate for fragmented SaaS data, incomplete application visibility, or manual remediation. The stronger control model is one where the review itself can see the entitlement trail and trigger action. Practitioners should judge governance maturity by whether reviews produce enforceable change.
Lifecycle controls are only meaningful when they extend into individual SaaS applications. Offboarding that stops at the central directory leaves residual access behind in application-native admin planes. That is why playbook-driven deprovisioning matters in SaaS governance. The field should view app-level revocation as part of identity lifecycle management, not an optional enhancement.
From our research library:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
What this signals
Shadow IT is now an identity governance input, not just a discovery problem. When users can add apps faster than central teams can catalogue them, the governance model has to start with continuous visibility. That means SaaS inventory, ownership assignment, and access review cannot live in separate operational silos.
Control quality depends on entitlement completeness across the SaaS estate. Review processes only work when the programme can see which users have which permissions in which apps, and whether those permissions were granted for a current business need. If the entitlement picture is partial, certification and deprovisioning will always lag reality.
For practitioners
- Map the full SaaS estate before certifying access Tie discovery sources, application catalogs, and entitlement records together so hidden applications do not fall outside review and offboarding workflows.
- Connect onboarding and offboarding to SaaS entitlements Use lifecycle workflows that provision and revoke access across individual SaaS applications, not just in the upstream directory.
- Make access reviews entitlement-aware Require reviewers to see the application, the granted entitlement, and the business context so certifications can drive remediation instead of simple attestation.
- Track shadow IT as governance debt Treat unmanaged SaaS applications as identity control gaps that need discovery, ownership assignment, and inclusion in the review cadence.
- Measure deprovisioning completeness at the app layer Verify that offboarding workflows remove access inside each SaaS application where permissions persist after directory access has been removed.
Key takeaways
- SaaS management and IGA are converging because the same application sprawl that creates software waste also creates identity governance gaps.
- The critical control issue is not just knowing which apps exist, but whether entitlements, lifecycle actions, and reviews are tied to those apps end to end.
- Practitioners should treat discovery completeness, app-level offboarding, and entitlement-aware review workflows as one governance problem.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Residual SaaS access after offboarding is a core risk in this article. |
| NHI-05 — Overprivileged NHI | The article centres on controlling excessive SaaS permissions and least privilege. | |
| Recommendation — Audit SaaS offboarding paths and revoke access inside each application, not just in the directory. Review SaaS entitlements for excess access and remove permissions that exceed business need. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about governing access permissions and entitlement control across SaaS apps. |
| Recommendation — Use entitlement governance to keep SaaS permissions current and reviewable across the application estate. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Least privilege is a stated design principle for SaaS access governance in the article. |
| Recommendation — Apply least privilege to SaaS entitlements and remove access that is not required for the task. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article addresses lifecycle management, provisioning, and deprovisioning of SaaS accounts. |
| Recommendation — Centralise account management for SaaS apps and ensure joins, moves, and leaves trigger access changes. | ||
Key terms
- SaaS Management Platform: A SaaS management platform is a visibility and optimisation layer for cloud software use. It helps teams discover applications, track utilisation, and understand spend patterns, but it does not by itself enforce access policy, revoke permissions, or manage identity lifecycle state.
- Shadow IT: Shadow IT is the use of applications or services outside formal enterprise approval or visibility. In SaaS environments, it often includes department-purchased tools and unsanctioned integrations that create hidden identity, data, and access paths the security team cannot readily govern.
- Access Certification: Access certification is the periodic review of whether an identity still needs its current entitlements. For NHIs, certification is only reliable when reviewers know the identity's owner, purpose, and expiry, otherwise stale machine access can persist long after the original use case has ended.
- Entitlement data: Information showing which identities can access which systems, applications, or assets. For governance work, entitlement data is the bridge between inventory and enforcement because it reveals whether an asset is merely present or actively reachable by human and non-human actors.
Deepen your knowledge
Identity lifecycle management, secrets management, and workload identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 10, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org