TL;DR: SaaS management breaks down when visibility, procurement, finance, IT, and legal operate in separate lanes, because app sprawl creates security, compliance, and cost blind spots, according to Zluri. The operational issue is governance, not discovery alone, and that is where identity and lifecycle control start to matter.
At a glance
What this is: This is a stakeholder-governance view of SaaS management that argues app discovery is not enough without coordinated ownership across IT, finance, procurement, legal, and business leadership.
Why it matters: It matters because SaaS sprawl affects identity lifecycle, access oversight, licensing, and compliance decisions, so IAM and IGA teams need governance operating models, not just inventory tooling.
Context
SaaS management is not just an application inventory problem. Once procurement, finance, legal, IT, and business owners each hold part of the decision-making, the control gap shifts from discovery to governance, because no single team sees the full lifecycle of purchase, use, renewal, and offboarding.
That matters for identity programmes because SaaS sprawl is also access sprawl. Every unmanaged application can create duplicate accounts, abandoned entitlements, and weak joiner-mover-leaver execution, which makes lifecycle governance and access review discipline part of SaaS control, not a separate concern.
Zluri frames stakeholder collaboration as the way organisations reduce security, compliance, and cost blind spots. The underlying problem is typical of SaaS-heavy environments rather than a special case: fragmentation is the default failure mode when SaaS growth outpaces governance ownership.
Key questions
Q: What breaks when SaaS management is owned by one team only?
A: SaaS management fails when one team tries to own the whole problem because procurement, finance, legal, IT, and business owners each control a different part of the lifecycle. The result is incomplete visibility into renewals, licenses, compliance exposure, and access removal. Governance has to be shared across the functions that create and consume the app estate.
Q: Why does SaaS sprawl create security risk as well as cost pressure?
A: SaaS sprawl increases the number of accounts, roles, permissions, and integrations that must be governed. Each additional application adds another place where access review, approval, and offboarding can fail. The result is not just wasteful spend but a larger, harder-to-audit identity surface across business systems.
Q: What should IT and security teams do first to improve SaaS compliance governance?
A: The first step is to establish a single operational view of SaaS assets, user access, and license utilization. From there, teams can standardize provisioning, apply role-based access controls, and track where regulated data resides. A shared view makes it far easier to enforce policy, support audits, and reduce errors caused by manual administration.
Q: How can organisations reduce wasted SaaS spend without weakening access control?
A: They should combine usage telemetry, renewal calendars, and access reviews so underused licences can be reclaimed without delaying legitimate work. The best result is not fewer licences at any cost, but cleaner assignment and faster recovery of dormant entitlements. That approach reduces waste while preserving operational continuity.
Technical breakdown
Why SaaS sprawl becomes an identity governance problem
SaaS sprawl creates multiple identity control surfaces at once: provisioning, license assignment, contract ownership, and access removal. When those are split across teams, the organisation can know an app exists without knowing who approved it, who can still use it, or when access should end. That is why visibility alone is insufficient. The real challenge is maintaining lifecycle control across procurement, IT, and business ownership so that SaaS decisions remain tied to identity and spend governance.
Practical implication: treat SaaS inventory as a governance input, not the finish line.
How onboarding and offboarding failures show up in SaaS estates
The article links SaaS management to onboarding and offboarding, which is where operational drift tends to appear first. Manual handling increases the chance of lingering accounts, duplicated access, and untracked app usage after role changes or departures. In identity terms, this is a joiner-mover-leaver problem expressed through SaaS. When the app owner, the IT team, and the budget owner are not aligned, access revocation and license recovery both become unreliable.
Practical implication: connect SaaS access changes to lifecycle workflows so leaver actions cannot stall in a separate queue.
What stakeholder governance changes in procurement and legal review
Procurement and legal are not peripheral stakeholders in SaaS management. Procurement influences app selection, contract terms, and vendor consolidation, while legal shapes compliance obligations and audit exposure. If these functions work separately from IT and finance, the organisation can approve an app that is technically usable but operationally hard to govern. The governance issue is not contract administration alone. It is whether a SaaS purchase creates a manageable identity, compliance, and renewal footprint over time.
Practical implication: include access, renewal, and compliance criteria in SaaS approval and contract review processes.
NHI Mgmt Group analysis
Stakeholder fragmentation is the real SaaS control failure: SaaS risk grows when visibility, procurement, finance, legal, and IT each own a slice of the decision but none owns the whole lifecycle. That produces blind spots in spending, compliance, and access governance, which is why discovery tools alone do not solve SaaS management. The practitioner conclusion is simple: governance must be designed across functions, not after the fact.
SaaS lifecycle governance is an identity problem as much as a software problem: The article repeatedly links SaaS management to onboarding, offboarding, licences, and renewals. Those are identity lifecycle events, not just operational admin tasks, because they determine who keeps access and who does not. Where organisations fail is assuming SaaS control can be delegated to one team; the access and lifecycle consequences cross organisational boundaries.
Contract governance and access governance now share the same boundary: Procurement and legal are no longer just commercial functions when SaaS becomes the dominant delivery model. A contract that is not tied to ownership, renewal, compliance, and offboarding discipline creates an identity governance gap downstream. Practitioners should treat SaaS agreements as part of the control environment, not as paperwork around it.
Named concept: stakeholder-constrained SaaS governance: This article points to a model where effective SaaS control depends on coordinated decisions across the functions that touch the application lifecycle. The concept is useful because it explains why fragmented ownership produces repeated blind spots even when individual teams are competent. For identity programmes, the lesson is to govern the service, the contract, and the access path together.
Identity programmes should absorb SaaS governance into operating rhythm: SaaS growth changes the economics of access review, licence recovery, and app rationalisation. If those processes sit outside the normal identity operating rhythm, they arrive too late to prevent waste or risk accumulation. The practical conclusion is that SaaS management belongs inside ongoing identity governance, not beside it.
From our research library:
- The average enterprise SaaS platform connects to 42 or more third-party applications through OAuth tokens, API keys, webhooks and automation platforms.
What this signals
SaaS management programmes now have to behave like governance programmes, not inventory projects. When procurement, finance, legal, and IT do not share a control model, the organisation will continue to find apps without controlling renewal, access, or compliance outcomes.
Stakeholder-constrained SaaS governance: The durable model is one in which every major SaaS decision has a named owner, a lifecycle checkpoint, and a compliance review path. That structure matters because SaaS risk accumulates in the gaps between teams, not inside any one team's workflow.
For practitioners
- Map SaaS ownership to named stakeholders Assign explicit owners for procurement, finance, legal, IT, and application sponsorship so each app has a decision path for approval, renewal, access changes, and retirement.
- Tie onboarding and offboarding to SaaS records Make joiner-mover-leaver workflows trigger SaaS account provisioning, suspension, and removal so access changes follow the employee lifecycle rather than informal requests.
- Review unused and duplicate apps quarterly Use finance and usage data together to identify redundant subscriptions, duplicate tools, and abandoned apps before renewals lock in waste or access sprawl.
- Require legal review for compliance-sensitive apps Route regulated or data-heavy SaaS purchases through legal and security review so contract terms, compliance obligations, and data handling conditions are clear before approval.
Key takeaways
- SaaS management becomes a governance problem when ownership is split across procurement, finance, legal, IT, and business stakeholders.
- The operational evidence in the article is lifecycle fragmentation, which drives blind spots in renewals, licences, onboarding, offboarding, and compliance oversight.
- Practitioners should align ownership, lifecycle workflows, and contract review so SaaS control and identity control operate as one process.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | SaaS offboarding gaps leave accounts and access behind when apps are retired or ownership changes. |
| Recommendation — Tie SaaS offboarding to NHI-01 so dormant app access is removed with the business relationship. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article centers on controlling who can still use SaaS apps as ownership and lifecycle change. |
| Recommendation — Apply PR.AA-05 to keep SaaS entitlements aligned with current business need and ownership. | ||
| CIS Controls v8 | CIS-5 — Account Management | SaaS governance here depends on knowing which accounts exist and when they should be removed. |
| Recommendation — Use CIS-5 to maintain accurate SaaS account inventory and remove unneeded access promptly. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | The governance gap described in the article amplifies over-assigned SaaS access and stale permissions. |
| Recommendation — Enforce AC-6 so SaaS access stays limited to the minimum required for each role. | ||
Key terms
- SaaS Lifecycle Governance: SaaS lifecycle governance is the set of controls that manage applications from onboarding through access assignment, renewal, and decommissioning. It matters because the security value of SaaS management depends on whether the organisation can prove ownership, revoke access, and retire unused tools on demand.
- Identity Lifecycle Governance: Identity lifecycle governance is the set of processes that create, change, review, rotate, and revoke access across human and non-human identities. It matters because access risk usually increases when lifecycle events are slow, incomplete, or disconnected from the systems that rely on them.
- App Sprawl: App sprawl is the rapid growth in the number of SaaS and cloud applications an organisation must manage. It increases complexity because each app brings its own permissions, access paths, and lifecycle needs, making manual governance harder and creating more places for security blind spots to emerge.
Deepen your knowledge
NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity governance programme, it is worth exploring.
Published by the NHIMG editorial team on June 12, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org