SaaS operations management is becoming an identity governance problem

At a glance

What this is: This is an analysis of how SaaS operations management is turning into an identity governance discipline as organisations struggle to track apps, control spend, and revoke access cleanly.

Why it matters: IAM, IGA, and NHI teams need to treat SaaS sprawl as a lifecycle problem because app ownership, provisioning, and offboarding now affect both governance and breach exposure.

Context

SaaS operations management is the discipline of tracking, approving, renewing, and offboarding software that employees can now acquire outside traditional IT workflows. In practice, that makes it an identity governance problem because the same apps that create spend also create accounts, entitlements, and offboarding obligations.

The article argues that hybrid and remote work have accelerated direct app buying, while spreadsheet-based inventory and legacy SAM processes have not kept pace. That gap leaves organisations with incomplete visibility into who owns what, which licences are active, and whether access is removed when employment or app use ends.

Key questions

Q: What breaks when SaaS is adopted outside approved governance processes?

A: When SaaS is adopted outside approved governance processes, organisations lose the connection between application ownership, user access, and renewal accountability. That creates stale subscriptions, duplicate tooling, and unreviewed entitlements that persist beyond business need. The practical failure is not just overspend. It is the loss of a reliable control path for who approved the app and who can remove it.

Q: Why does SaaS sprawl increase non-human identity risk?

A: SaaS sprawl increases NHI risk because every new integration can create tokens, service accounts, OAuth grants, and delegated permissions that persist outside normal review cycles. Those identities often have more reach than human users and fewer lifecycle checks. The result is wider attack surface and harder-to-audit access paths.

Q: What signals show that SaaS governance is not working?

A: Look for delayed offboarding, repeated manual exports, inconsistent access review responses, and inactive accounts that still carry paid licenses. Those signals indicate that entitlement ownership and usage data are not reconciled often enough to support reliable governance.

Q: How should IAM teams and SaaSOps share responsibility for access control?

A: IAM should own the identity lifecycle rules, while SaaSOps should own the application inventory, renewal cadence, and business ownership data that make those rules actionable. The two functions need shared workflows for onboarding, access review, and offboarding. Without that split of responsibility, the organisation keeps either the licence record or the access record, but not both.

Technical breakdown

Why SaaS buying creates governance drift

When employees can buy apps directly, the procurement event no longer guarantees an identity record, an owner, or a deprovisioning path. SaaS then becomes a distributed access problem hidden inside expense workflows, shadow inventory, and duplicate subscriptions. The operational failure is not only waste. It is the absence of a system of record that ties application ownership to account lifecycle, renewal decisions, and entitlement removal across the organisation.

Practical implication: build a governed SaaS inventory that links each app to an owner, an access model, and a renewal date.

Why offboarding becomes the real control point

Offboarding is where SaaS operations and identity governance intersect most sharply. If a terminated employee still has active access, the organisation retains both financial exposure and data access risk. Manual revocation across many apps is brittle because identities are now spread across business-owned SaaS, not just centrally managed platforms. The control gap is lifecycle closure, not just access provisioning, because the risk appears when accounts outlive the relationship that created them.

Practical implication: make app-level offboarding part of the leaver process, not a separate SaaS admin task.

Why SAM alone does not solve SaaS governance

Traditional software asset management was built for centrally purchased software with predictable deployment and IT ownership. SaaS breaks that model because adoption is fragmented, renewal is recurring, and access is tied to users as much as to licences. That means the governance model has to combine procurement, asset visibility, and identity lifecycle control. Without that linkage, teams can count applications but still miss who can use them, who approved them, and who must revoke them.

Practical implication: extend SAM with identity-aware lifecycle controls instead of treating SaaS as a licence-only inventory problem.

Threat narrative

Attacker objective: The practical objective is to retain access to SaaS data and business workflows after the organisation believes the relationship has ended, while also hiding the true footprint of software use.

1. Entry occurs when an employee purchases or connects a SaaS app outside the normal IT intake process, creating an unmanaged application and identity footprint.
2. Credential and access exposure follows when the app is provisioned without a governed inventory entry, so accounts, licences, and permissions are not centrally tracked.
3. Escalation happens when redundant or dormant accounts remain active after role changes or termination, extending access beyond the approved business need.
4. Impact appears as data exposure, compliance gaps, and avoidable spend when offboarding fails to remove access across all SaaS applications.

Breaches seen in the wild

• SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

SaaS operations has become an identity lifecycle function, not a software admin function: once employees can acquire apps directly, the control problem shifts from purchasing to ownership, access, and offboarding. The organisation no longer fails only when it overspends. It fails when it cannot prove which identities are attached to which SaaS instances and who is responsible for closing them. The implication is that SaaSOps and IAM must be governed together.

Lifecycle closure is the real security boundary in SaaS sprawl: the article correctly points to offboarding as a high-risk moment because access can persist after employment ends or app use changes. That is not a marginal admin issue. It is the point where account governance either ends cleanly or becomes a latent exposure path. Practitioner teams should treat every SaaS app as an identity surface with a revocation obligation.

Legacy SAM misses the identity dimension of SaaS: counting licences and spend is useful, but it does not answer who approved access, who still has it, or whether dormant accounts remain reachable. SaaS governance now requires a system of record that joins inventory, entitlement, renewal, and deprovisioning in one operational view. The discipline is maturing from asset control into access control.

Identity surface management is the right named concept for SaaS governance: the SaaS estate is not just a portfolio of applications, it is an expanding surface of users, tokens, permissions, renewals, and offboarding states. That surface is only secure when ownership and lifecycle data stay synchronised. Organisations that cannot map that surface will keep treating symptoms instead of governing the cause.

Cross-functional ownership is now mandatory because no single team owns the whole lifecycle: procurement sees spend, IT sees tooling, and security sees risk, but SaaS governance fails when those views stay separate. The article reflects a broader market reality: SaaSOps is emerging because lifecycle accountability spans multiple teams. Practitioners should interpret that as a governance design problem, not a tooling preference.

What this signals

Identity surface management is the more accurate frame for SaaS governance because the problem now spans applications, accounts, licences, renewals, and offboarding states. Teams that only measure spend will miss the access paths that remain live after business need has changed.

SaaS operations is becoming the coordination layer between procurement, IAM, and security because direct app buying creates lifecycle gaps that no single function can close alone. The practical test is whether every application has a named owner, a renewal decision point, and a revocation path that actually gets used.

For practitioners

• Build a SaaS system of record Maintain a continuously updated inventory of SaaS apps, owners, business purpose, and renewal dates so access and spend decisions are made from one authoritative source.
• Tie offboarding to every SaaS app Add application-by-application revocation steps to joiner-mover-leaver workflows so a leaver is removed from each SaaS account, not just the core directory.
• Separate approved apps from expense-led apps Flag software bought outside IT intake and require retrospective owner assignment, access review, and renewal decision before it stays active.
• Track dormant licences and unused accounts Review licence utilisation and active user lists together so dormant spend and dormant access are remediated in the same governance cycle.
• Create a SaaS renewal calendar Use a shared renewal calendar that forces review of business value, account ownership, and entitlement cleanup before contracts auto-renew.

Key takeaways

• SaaS governance fails when app ownership and account ownership diverge, because the organisation can no longer prove who should have access or who can revoke it.
• The article points to unmanaged buying, duplicate subscriptions, and dormant licences as evidence that spreadsheet-led control is not keeping pace with SaaS growth.
• The control that matters most is lifecycle closure, especially offboarding that reaches every SaaS account rather than stopping at the directory.

Key terms

• SaaS operations management: SaaS operations management is the discipline of controlling how software subscriptions are acquired, owned, renewed, and removed across the organisation. In identity terms, it is also a lifecycle function because every application decision affects who or what still has access and whether that access remains legitimate.
• Identity Surface: The identity surface is the full set of credentials, tokens, tool permissions, and delegated identities an AI agent can use during execution. It matters because agents often do not operate through a single account, and partial visibility into that surface creates false confidence about control coverage.
• Lifecycle Closure: Lifecycle closure is the discipline of making sure access does not only get granted and adjusted, but also removed when the business need ends. In identity governance, it means provisioning, change, review, and revocation are treated as one control loop rather than separate tasks.
• Shadow SaaS: Shadow SaaS is the set of unauthorised or unreviewed software-as-a-service tools used outside central security governance. These applications often bypass normal identity controls, making them difficult to inventory, monitor, and harden against credential-based abuse.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.