SaaS management platforms now sit inside identity governance

At a glance

What this is: This is a Zluri overview of SaaS management platforms that makes a larger point: SaaS management is now tightly bound to identity governance because visibility alone does not answer who should keep access.

Why it matters: For IAM, IGA, and SaaS owners, the practical shift is that app discovery, license optimisation, access reviews, and deprovisioning can no longer be treated as separate workstreams.

Context

SaaS management platforms are tools for discovering applications, understanding usage, and controlling spend. In this article, the governance gap is that app inventory by itself does not tell teams whether access is still justified, especially when unmanaged applications and shadow AI sit outside formal approval paths.

Zluri's framing is that SaaS management has crossed from procurement support into identity governance. That matters because the same data used to decide license allocation can also drive access review, deprovisioning, and policy enforcement across sanctioned and unsanctioned SaaS apps.

Key questions

Q: How should security teams implement identity governance in SaaS-heavy environments?

A: Start with a complete inventory of users, service accounts, integrations, and privileged entitlements across all major applications. Then enforce ownership, periodic review, and automatic deprovisioning when accounts become unused or unassigned. The goal is to make access changes traceable and reversible before stale privileges become a security issue.

Q: What happens when SaaS management tracks apps but not entitlements?

A: You get visibility without control. Teams can count applications, but they still cannot confidently answer who should retain access, which permissions are excessive, or which accounts should be removed. That creates a gap where shadow IT, inactive users, and over-assigned access remain operational even though the dashboard looks complete.

Q: Why do shadow AI apps create identity governance risk?

A: Shadow AI creates risk because the application can be adopted outside approved procurement and still move sensitive data. That means identity teams need to know who is using the tool, whether the use is authorised, and whether the session should be blocked, monitored, or reviewed.

Q: Should SaaS access reviews be driven by usage data or manager attestation?

A: Usage data should lead, with attestation used as a backstop. Manager review alone often reflects organisational memory rather than current access reality, while telemetry can show inactive accounts, low-value licences, and stale entitlements. The strongest model combines both, but the evidence should come from observed use.

Technical breakdown

Why SaaS inventory is not the same as access governance

A SaaS inventory tells you what exists, while access governance tells you who can use it, how they are using it, and whether the entitlement still makes sense. The gap matters because usage telemetry, SSO data, browser activity, and finance-system signals each reveal a different slice of the same identity picture. Without stitching those signals together, organisations can count applications yet still miss inactive accounts, excess permissions, and shadow IT. In practice, this is why many SMPs remain cost tools while IGA owns the authoritative access decision.

Practical implication: treat SaaS discovery as input to governance, not as evidence that governance is already happening.

How automated licence reclamation changes identity operations

Automated licence reclamation is not just a spend optimisation feature. It is an entitlement-control mechanism that acts on observed usage rather than waiting for a manual review cycle. When a platform can downgrade or reclaim access based on configurable thresholds, the control moves from quarterly clean-up to continuous entitlement management. That is operationally significant because the access decision is now bound to live behaviour, not static onboarding records. It also creates a tighter link between IGA, finance, and SaaS administration than most teams currently maintain.

Practical implication: define which usage thresholds can trigger reclaim or downgrade actions without creating false removals.

What shadow AI exposure adds to SaaS governance

Shadow AI extends the SaaS problem because the issue is no longer only unsanctioned apps, but unsanctioned data flows through generative tools. If employees can adopt AI apps without visibility, teams lose control over which users are allowed, what data is exposed, and whether the app itself is approved for business use. That turns AI app governance into an identity and policy problem, not just an acceptable-use problem. Continuous monitoring matters here because periodic audits will always lag behind employee-led adoption.

Practical implication: extend SaaS governance rules to AI app usage, including who may access approved tools and which data classes may enter them.

NHI Mgmt Group analysis

SaaS management has become a governance plane, not a reporting layer: Once a platform can tell you who is using an app, at what level, and whether the access should still exist, it is operating in IGA territory. The category shift is not semantic. It means organisations should stop treating SaaS management as a parallel operational stack and start treating it as part of the access governance model that spans joiner, mover, and leaver decisions.

License data is now identity evidence: The interesting part of this market is not license savings, it is the evidentiary value of usage data. When access reviews, deprovisioning, and renewal decisions all draw from the same telemetry, governance becomes more defensible and less reliant on self-reported ownership. Practitioners should expect SaaS platforms to be judged by how well they feed identity decisions, not by how many apps they count.

Shadow AI forces SaaS governance to widen into policy enforcement: Unsanctioned AI app adoption creates the same governance problem as shadow IT, but with a sharper data-risk edge. A platform that only reports on usage cannot answer the core question of whether the app should be allowed at all. The implication for practitioners is that SaaS governance now needs explicit policy boundaries for AI tools, not just inventory and spend controls.

App discovery without entitlement control leaves the hardest issue untouched: The article's deeper point is that visibility is only useful when it can drive action on entitlements. That is the governance gap many organisations still carry: they can map the stack, but not continuously align access with business need. The practical conclusion is to evaluate SaaS management through the lens of access lifecycle control, not dashboard breadth.

Identity governance is expanding sideways into adjacent tooling categories: SaaS management, spend optimisation, and access review are converging because the underlying object is the same: entitlement. That convergence will keep accelerating as organisations connect more SaaS, more AI apps, and more identity signals into one operating model. Teams that keep these disciplines separate will struggle to prove who should still have access.

From our research library:

• The average enterprise SaaS platform connects to 42 or more third-party applications through OAuth tokens, API keys, webhooks and automation platforms.

What this signals

SaaS management is moving into the identity control plane: The category boundary is shifting because entitlement decisions are now inseparable from app discovery and usage telemetry. Teams should expect their SaaS platform to be judged by whether it can support access review and deprovisioning, not just by whether it can enumerate applications.

Shadow AI widens the governance problem: Once employees can adopt AI tools outside sanctioned channels, the issue becomes policy enforcement as much as visibility. Organisations need a control model that can distinguish approved AI use from unmanaged adoption before data exposure becomes normalized.

App inventory without lifecycle action will keep failing governance teams: Discovery, on its own, does not close the access gap. The programme-level question is whether the platform can turn observed usage into revocation, downgrade, or review events that identity teams can actually govern.

For practitioners

• Define SaaS governance as an access-control function Map SaaS discovery, entitlement review, and deprovisioning into the same governance process instead of running them as separate operations.
• Use usage telemetry to drive entitlement decisions Tie inactive account detection, low-usage thresholds, and renewal decisions to measurable access outcomes so review cycles are based on evidence.
• Extend policy coverage to shadow AI tools List approved AI apps, define which users may access them, and make policy checks part of SaaS monitoring so unsanctioned adoption is visible quickly.
• Connect SaaS data to IGA workflows Route shadow IT findings, inactive users, and app-risk signals into access reviews and deprovisioning workflows so the control plane can act.

Key takeaways

• SaaS management now matters to identity governance because app visibility alone does not answer whether access is still warranted.
• The article's core shift is from counting applications to governing entitlements, inactive accounts, and shadow AI usage in one model.
• Practitioners should evaluate SaaS platforms by how well they feed access review, deprovisioning, and policy enforcement workflows.

Key terms

• SaaS Management Platform: A SaaS management platform is a visibility and optimisation layer for cloud software use. It helps teams discover applications, track utilisation, and understand spend patterns, but it does not by itself enforce access policy, revoke permissions, or manage identity lifecycle state.
• Shadow IT: Shadow IT is the use of applications or services outside formal enterprise approval or visibility. In SaaS environments, it often includes department-purchased tools and unsanctioned integrations that create hidden identity, data, and access paths the security team cannot readily govern.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Entitlement Governance: Entitlement governance is the discipline of deciding who or what should have access, for how long, and under what business justification. It spans human users, non-human identities, and automated workflows, making it a core control layer for SaaS, cloud infrastructure, and lifecycle management.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.