TL;DR: SaaS management fails when organisations rely on spreadsheets, weak visibility, and inconsistent lifecycle controls for apps, users, groups, and vendors, leaving security and compliance gaps across the stack, according to Zluri. The deeper issue is that SaaS governance is really identity governance across human access, privileged accounts, and third-party exposure, not a procurement list.
At a glance
What this is: This article frames SaaS management as an identity governance problem, arguing that weak visibility, lifecycle control, and vendor oversight leave SaaS environments exposed.
Why it matters: For IAM, IGA, and PAM teams, the takeaway is that SaaS cannot be governed as a procurement inventory because access, groups, privileges, and third-party exposure all need lifecycle control.
Context
SaaS management is the discipline of governing who and what can access cloud applications, what data they can reach, and when that access should change or end. The article argues that spreadsheets and manual records cannot keep pace with SaaS sprawl, especially when applications, users, groups, and vendor relationships all change continuously.
The governance gap is not just operational noise. When discovery is incomplete and lifecycle controls are inconsistent, organisations lose the ability to answer basic identity questions about entitlement ownership, privileged access, and third-party risk across their SaaS stack.
Key questions
Q: What breaks when SaaS access reviews rely on spreadsheets?
A: Spreadsheets freeze access data in time, so reviewers work from stale exports while roles, teams, and app usage keep changing. That creates entitlement drift and weak evidence for auditors. A better model is recurring review automation with current usage, department, and risk context, plus direct remediation from the review step.
Q: Why does multi-tenant SaaS management matter for identity lifecycle governance?
A: Because MSPs are doing lifecycle work at scale across many customers at once. Provisioning, access reviews, renewals, and offboarding all become governance processes rather than ad hoc support tasks. The value is consistency, but only if the workflows are formally defined and exceptions are tracked with the same discipline as privileged access.
Q: Why do group-based access models create hidden access risk in SaaS environments?
A: Group-based access models create hidden risk because they collapse many permissions into broad roles, which can leave users with access they do not need. In SaaS environments this is amplified by shadow apps, manual provisioning, and inconsistent app-level roles. The result is overexposure of data and a weaker control posture than the identity team expects.
Q: When should organisations treat a SaaS platform as an identity governance issue?
A: Whenever the platform mediates communication, recovery, delegated access, or machine-to-machine activity across many users or tenants. At that point, the platform is no longer just an application. It is part of the identity fabric, and its support paths, tokens, and trust relationships need lifecycle governance.
Technical breakdown
Why spreadsheet-based SaaS records fail governance
Spreadsheets can list subscriptions, but they do not model the identity relationships that make SaaS risky. A SaaS stack contains users, groups, roles, vendors, and apps, each with different ownership and revocation triggers. When those relationships are not continuously reconciled, security teams cannot tell whether an access path is active, stale, redundant, or orphaned. That is why SaaS management becomes an identity governance problem rather than a license-tracking exercise. The failure is structural: the record-keeping model is too static for cloud access that changes by role, department, task, and external dependency.
Practical implication: Treat SaaS inventory as governed identity data, not a spreadsheet of software purchases.
How user lifecycle controls map to SaaS access risk
The article ties SaaS governance directly to joiner, mover, and leaver control. Users need access assigned for their role, permissions adjusted as responsibilities change, and revocation when they leave or no longer need a tool. That lifecycle is the same governance pattern used across IAM and IGA, but SaaS makes it harder because entitlements are spread across many applications and often hidden from central view. Without lifecycle enforcement, licenses persist after employment changes, and access can outlive its business purpose.
Practical implication: Anchor SaaS governance in joiner-mover-leaver controls and verify that offboarding actually removes access, not just licenses.
Why vendor and group governance are part of identity governance
SaaS risk does not stop at employee accounts. The article highlights third-party access, app groups, and vendor compliance as part of the same governance surface. Groups can accumulate abandoned or redundant memberships, while external parties may retain access longer than their business need or contract allows. In parallel, vendor assurance matters because the organisation is implicitly inheriting the provider's control posture when it relies on that service. This is why SaaS governance spans entitlement hygiene, third-party lifecycle control, and supplier oversight in one model.
Practical implication: Extend governance reviews to groups, external collaborators, and vendor assurance, not just named user accounts.
Threat narrative
Attacker objective: The attacker or risky insider aims to reach SaaS data and controls through access paths the organisation cannot see, govern, or revoke reliably.
- Entry occurs when employees or third parties gain access to SaaS applications that are poorly inventoried or only tracked in spreadsheets.
- Credential and entitlement abuse follows when permissions, groups, or licenses remain active beyond their intended business need.
- Escalation happens when overbroad SaaS roles, shadow IT, or privileged accounts expose sensitive data or administrative functions.
- Impact is achieved through data leakage, compliance failure, insider misuse, or persistence of access after offboarding.
Breaches seen in the wild
- SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity governance, not software inventory, is the real SaaS management problem. SaaS environments fail when organisations treat subscriptions as assets to catalogue instead of access relationships to govern. Users, groups, external parties, and vendors all create entitlement paths that change faster than manual tracking can absorb. The practical consequence is that SaaS governance has to sit inside IAM and IGA discipline, not beside it.
Lifecycle control is the dividing line between managed SaaS and unmanaged access. The article's strongest point is that joiner, mover, and leaver logic still applies in SaaS, but the control surface is wider because each app carries its own roles and revocation logic. When permissions are not re-evaluated as roles change, access becomes a lingering business risk rather than a temporary productivity choice.
SaaS groups create hidden privilege aggregation if they are not continuously reviewed. Group sprawl is not just an organisational problem, it is an authorization problem that can quietly widen access far beyond individual intent. Abandoned, redundant, and empty groups are a clear signal that entitlement governance is lagging behind application growth, and that lag is exactly where misuse and leakage start.
Vendor oversight now belongs in the identity stack. SaaS providers are part of the access chain, not external to it. When security and compliance status are not tracked alongside application access, organisations lose sight of the trust conditions they are inheriting from every third-party service. The right governance model treats supplier assurance as a standing identity control, not a procurement checkbox.
Shadow IT is really shadow identity. Unapproved SaaS use creates unknown accounts, unknown entitlements, and unknown data paths. That is why discovery, approval, and revocation have to be connected: without them, the organisation cannot answer who has access, why they have it, or whether the access is still justified. The governance gap is an identity gap that shows up as SaaS sprawl.
From our research library:
- The average enterprise SaaS platform connects to 42 or more third-party applications through OAuth tokens, API keys, webhooks and automation platforms.
What this signals
Discovery has to be treated as an identity control, not a cataloguing task. When SaaS visibility is incomplete, the organisation cannot reliably govern entitlements, offboarding, or third-party access. That makes discovery the first control point for reducing SaaS sprawl and entitlement drift.
SaaS governance fails when lifecycle ownership is fragmented. Joiner-mover-leaver processes, group reviews, and vendor approvals need to operate as one governance chain. If they do not, the business ends up with access that is technically active but administratively unowned.
For practitioners
- Establish a single SaaS entitlement inventory Map every application to the users, groups, admins, and external parties that can access it, then reconcile that inventory against HR and procurement records.
- Tie SaaS offboarding to access removal Make leaver processing revoke application access, group membership, and vendor-shared entitlements, not just close the employee record.
- Review SaaS groups for privilege creep Identify abandoned, redundant, and empty groups, then validate whether any active group still matches a current business purpose.
- Extend governance to third-party access Require approval, expiry, and periodic review for consultants, partners, and vendors who use SaaS applications containing company data.
- Track vendor compliance as an access control input Use security certifications and compliance status as part of application approval and renewal decisions, especially where the vendor hosts sensitive data.
Key takeaways
- SaaS management becomes an identity governance problem when organisations cannot see who has access, how access changes, or when it should end.
- The article links poor discovery, weak lifecycle control, and unmanaged groups to higher security and compliance risk across the SaaS stack.
- Treating SaaS as an identity surface makes offboarding, group review, and vendor assurance part of the same governance model.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | The article repeatedly ties SaaS risk to failing to revoke access when people leave. |
| NHI-05 — Overprivileged NHI | The post warns about excessive permissions, preset roles, and broad access across SaaS tools. | |
| NHI-10 — Human Use of NHI | The article shows how employees and outsiders interact with SaaS credentials, groups, and app access. | |
| Recommendation — Apply NHI-01 by revoking SaaS access, groups, and vendor-shared entitlements during offboarding. Apply NHI-05 by reviewing SaaS roles and removing permissions that exceed the user's business need. Apply NHI-10 by preventing unmanaged human access paths from becoming persistent SaaS entitlements. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article centers on controlling SaaS permissions, entitlements, and authorization scope. |
| Recommendation — Use PR.AA-05 to govern SaaS entitlements with review, approval, and revocation controls. | ||
| CIS Controls v8 | CIS-5 — Account Management | SaaS lifecycle, group, and revocation issues are classic account management failures. |
| Recommendation — Use CIS-5 to centralise SaaS account lifecycle review and remove dormant or unnecessary access. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Poor SaaS governance expands credential exposure and enables movement across apps. |
| Recommendation — Map risky SaaS access paths to TA0006 and TA0008 so detection focuses on exposed accounts and cross-app movement. | ||
Key terms
- SaaS Lifecycle Governance: SaaS lifecycle governance is the set of controls that manage applications from onboarding through access assignment, renewal, and decommissioning. It matters because the security value of SaaS management depends on whether the organisation can prove ownership, revoke access, and retire unused tools on demand.
- Shadow IT: Shadow IT is the use of applications or services outside formal enterprise approval or visibility. In SaaS environments, it often includes department-purchased tools and unsanctioned integrations that create hidden identity, data, and access paths the security team cannot readily govern.
- Joiner-Mover-Leaver Lifecycle: The joiner-mover-leaver lifecycle describes the access changes that should happen when a person or account is created, changes role, or exits the organisation. It is the basic operating model for keeping entitlements aligned to current need, and it becomes critical when automation replaces manual ticket handling.
- Privilege Creep: Privilege creep is the gradual accumulation of access rights beyond what an identity actually needs. It usually happens when permissions are added for convenience and never removed. For NHIs, privilege creep expands blast radius and makes old credentials far more dangerous than their original purpose suggests.
Deepen your knowledge
NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity governance programme, it is worth exploring.
Published by the NHIMG editorial team on June 11, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org