TL;DR: Modern SaaS management platforms are moving beyond inventory and license savings into access governance, shadow AI monitoring, and automated deprovisioning, according to Zluri’s 2026 roundup, with 239,000+ apps in its discovery catalog and 4.7/5 G2 rating cited in the article. The security question is no longer how many apps exist, but whether identity, usage, and entitlement data are connected tightly enough to enforce policy at runtime.
At a glance
What this is: This article argues that SaaS management platforms now need to govern access, not just inventory apps and reclaim licences.
Why it matters: IAM, IGA, PAM, and NHI teams should care because SaaS control increasingly depends on connecting discovery, usage, entitlement, and deprovisioning in one operating loop.
Context
SaaS management used to be treated as an inventory and cost-control problem, but that view breaks once application access, usage, and entitlement data determine whether accounts should exist at all. In practice, the governance gap is not finding more apps. It is turning app discovery into a decision point for access reviews, deprovisioning, and policy enforcement.
The article frames SaaS management platforms as control planes for SaaS sprawl, shadow IT, and shadow AI. That matters for IAM because the same operational dataset can now drive both financial decisions and identity decisions, especially when app usage and permission data are available at the same layer.
Key questions
Q: How should security teams govern access across SaaS sprawl?
A: Security teams should govern SaaS sprawl with one inventory, one policy model, and one review process that covers both human and non-human access. The practical goal is to connect application approval, entitlement review, and revocation to business ownership. Without that linkage, access governance becomes a manual cleanup exercise instead of a control system.
Q: Why do shadow AI tools create an IAM problem instead of just an application risk?
A: Shadow AI creates an IAM problem because every unsanctioned tool introduces a new identity path, credential exposure point, or data connection that bypasses standard governance. The risk is not only the tool itself, but the fact that access may exist without ownership, review, or revocation.
Q: What breaks when SaaS governance lacks real-time data controls?
A: Without real-time controls, sensitive data can be shared, copied, or exposed after discovery has already happened. That leaves organisations with visibility but no effective intervention. The result is longer exposure windows, weaker audit evidence, and more manual cleanup. Controls that act in the moment are critical when users work across chat, docs, browsers, and AI tools.
Q: How do organisations decide whether a SaaS platform is only an inventory tool?
A: If it can only list applications and track spend, it is an inventory tool. If it can also link app state to identity state, trigger access reviews, and remove or downgrade access when usage changes, it functions as an access governance layer. That distinction matters more than feature count.
Technical breakdown
Why SaaS discovery is no longer enough
Traditional SaaS discovery answers a narrow question: what apps exist. The problem is that inventory alone does not tell you who is using an app, whether the account is active, or whether the access path is sanctioned. Modern SaaS management platforms combine API data, SSO telemetry, browser activity, and financial signals so the platform can infer both presence and usage context. That shifts the control objective from counting applications to deciding whether an application instance and its associated access should remain in service. In governance terms, discovery becomes an input to entitlement and lifecycle control, not an end state.
Practical implication: Treat discovery as the start of access governance, not the finish line.
How shadow AI changes SaaS governance
Shadow AI is a SaaS governance problem because unmanaged AI apps create the same visibility and access issues as unmanaged business apps, but with added data-handling risk. The article describes real-time monitoring, alerts, and policy enforcement for approved and restricted AI tools, which means the control boundary is now usage, not just installation. For IAM teams, that is important because AI app adoption can occur outside formal procurement and provisioning flows, so the governance question becomes whether the platform can observe and constrain usage as it happens. This is a runtime enforcement problem, not a quarterly review problem.
Practical implication: Fold AI app adoption into your SaaS governance and access policy model.
What access governance inside SaaS management actually means
Access governance in this context means the platform can connect app discovery to identity signals and then trigger action. If an app is shadow IT, the platform can open an access review. If a user is inactive, the platform can deprovision or reclaim the licence. If a new app appears, the platform can classify it against policy and risk posture. That is materially different from classic SaaS administration, which often stops at reporting. The technical shift is from visibility to enforcement, and from static licence optimisation to lifecycle control tied to identity state.
Practical implication: Require SaaS tooling to trigger access review and deprovisioning workflows from usage data.
Breaches seen in the wild
- SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
SaaS management is becoming an identity control surface, not a back-office admin tool. Once a platform can correlate discovery, usage, entitlement, and lifecycle actions, it stops being a reporting layer and becomes part of the access governance stack. That changes the buying question for IAM and IGA teams from coverage to control depth. Practitioners should judge these tools by whether they can move from visibility to enforced decisioning without manual stitching.
Shadow AI exposes a control gap that traditional SaaS inventories were never designed to close. The article shows that unmanaged AI adoption is now part of the SaaS problem space, which means access policy has to cover tools that were never formally onboarded. This is where SaaS management and identity governance overlap most sharply: if usage cannot be tied to an accountable identity and an approval state, policy becomes advisory rather than enforceable. Practitioners should treat unmanaged AI apps as a governance event, not a curiosity.
Automated licence recovery is only valuable when it is tied to lifecycle evidence. A licence reclaimed because usage dropped is useful, but a licence reclaimed because the account is inactive is stronger because it reflects identity state, not just spend data. That distinction matters for NHI, human IAM, and contractor access alike. The field is moving toward governance loops that blend financial optimisation with access revocation, and that convergence will favour platforms that can prove why an entitlement still exists.
Runtime enforcement is the named concept this category now needs. The article’s core shift is from retrospective SaaS reporting to decisions made while access is still live. That is the point at which SaaS management stops being a spreadsheet problem and becomes an operational control plane. Practitioners should expect future programme scrutiny to focus on whether their toolchain can enforce policy during use, not merely document it after the fact.
From our research library:
- The average enterprise SaaS platform connects to 42 or more third-party applications through OAuth tokens, API keys, webhooks and automation platforms.
What this signals
SaaS governance is converging with identity governance because the same telemetry now supports inventory, access decisions, and lifecycle enforcement. That convergence matters most where shadow IT and shadow AI are both present, since unmanaged adoption tends to outpace manual review cycles and creates policy gaps that reporting alone cannot close.
Runtime enforcement: The category is moving toward controls that act while access is active, not after the fact. For IAM and IGA teams, that means evaluating whether a platform can revoke, downgrade, or review access based on live usage rather than relying on periodic audits.
For practitioners
- Map SaaS discovery to access decisions Require every discovered app to feed a decision path for review, deprovisioning, or exception handling rather than a passive inventory record.
- Tie inactive usage to entitlement removal Use usage telemetry to identify dormant accounts and reclaim or downgrade access when activity no longer supports the assigned entitlement.
- Bring shadow AI into governance scope Classify unsanctioned AI apps alongside shadow IT so they can be monitored, reviewed, and restricted under the same policy model.
- Unify identity and spend signals Connect licence data, app usage, and identity state so finance optimisation does not happen separately from access governance.
Key takeaways
- SaaS management platforms are no longer just for app visibility and cost reduction. They are increasingly expected to participate in access governance and lifecycle control.
- The article shows that the real value comes from connecting discovery, usage, entitlement, and deprovisioning in one workflow. Without that linkage, organisations only get inventory, not control.
- For practitioners, the key test is whether the platform can enforce policy at runtime for apps and AI tools that users adopt outside formal approval paths.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CSA Cloud Controls Matrix, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | The article centres on SaaS access governance and identity-linked control. |
| Recommendation — Apply IAM domain controls to tie SaaS discovery to access approval and removal. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The core issue is whether SaaS entitlements are governed from usage and identity data. |
| Recommendation — Use PR.AA-05 to validate that SaaS entitlements match current business need. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article repeatedly returns to active accounts, inactive users, and deprovisioning. |
| Recommendation — Apply CIS-5 to remove dormant SaaS accounts and reclaim unnecessary access. | ||
Key terms
- SaaS Management Platform: A SaaS management platform is a visibility and optimisation layer for cloud software use. It helps teams discover applications, track utilisation, and understand spend patterns, but it does not by itself enforce access policy, revoke permissions, or manage identity lifecycle state.
- Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
- Access Governance: Access governance is the policy and workflow layer that manages how access is requested, approved, certified, and revoked. In SaaS environments it helps standardise control across many applications, reducing inconsistency between teams. It is most effective when it covers both human accounts and non-human identities.
- Runtime Enforcement: Runtime enforcement is the practice of blocking malicious behaviour while software is running, rather than only detecting it after the fact. It monitors process activity, network actions, and privilege changes so a live attack can be interrupted at the point of execution.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 9, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org