TL;DR: Most organisations still buy SaaS through a fragmented process that obscures renewals, licensing, approvals, and duplication, according to Zluri. The governance problem is not just cost control, but identity and access sprawl across the applications, contracts, and stakeholders that procurement now has to reconcile.
At a glance
What this is: This article explains how SaaS procurement services are positioned as a response to shadow IT, contract sprawl and duplicated applications across the buying lifecycle.
Why it matters: It matters because procurement process design now affects identity and access governance as much as cost control, especially when app ownership, approvals and renewals are distributed across teams.
Context
SaaS procurement becomes a governance problem when organisations cannot reliably see what is being bought, renewed, or duplicated across business units. In this article, Zluri frames the issue as a mix of pricing complexity, stakeholder approvals and weak visibility into the SaaS stack, which is exactly where shadow IT takes hold.
The underlying identity question is not just who approves spend. It is who can request, retain, renew, and remove access to applications that may sit outside central control. When procurement data, application inventory, and ownership records do not align, governance gaps become operational gaps.
Key questions
Q: How should security teams govern shadow IT in SaaS environments?
A: Security teams should govern shadow IT by treating it as unmanaged access, not just unsanctioned software. Start with continuous discovery, then map each app to owners, data types, delegated scopes, and revocation paths. The control goal is to reduce hidden access paths before they become business-critical dependencies.
Q: Why do SaaS buying decisions create access governance risk?
A: SaaS buying decisions create risk because each new application adds identities, permissions, and integrations that must be managed over time. If procurement happens without IAM input, teams usually discover the control gaps after users are already active. That leads to entitlement sprawl, unclear ownership, and delayed deprovisioning.
Q: What breaks when SaaS renewal management is disconnected from usage data?
A: Organisations keep paying for seats that no longer support a business need and preserve access that should have been removed. Without usage evidence, renewal becomes automatic entitlement persistence, which weakens access reviews and makes cleanup harder later.
Q: How should security teams implement identity governance in SaaS-heavy environments?
A: Start with a complete inventory of users, service accounts, integrations, and privileged entitlements across all major applications. Then enforce ownership, periodic review, and automatic deprovisioning when accounts become unused or unassigned. The goal is to make access changes traceable and reversible before stale privileges become a security issue.
Technical breakdown
Why fragmented SaaS buying creates shadow IT
SaaS buying is fragmented because procurement, IT, finance, legal and security each see only part of the transaction. That fragmentation hides duplicate applications, off-contract purchases, and renewals that slip through without clear ownership. In identity terms, the organisation loses a reliable link between the app, the account, the contract and the approver. Shadow IT then becomes less a rogue user problem and more a lifecycle visibility problem across the SaaS estate.
Practical implication: build a single view of app requests, approvals, renewals and ownership before trying to optimise cost.
How SaaS procurement overlaps with access governance
Procurement and identity governance intersect because every SaaS purchase eventually becomes an access problem. Licences, renewals and contract terms determine which users keep access, which apps get retired, and whether dormant subscriptions continue to carry active identities. When the process is unmanaged, organisations can end up paying for software that still has live accounts, unused licences, or overlapping entitlements. That is a governance failure, not just a financial one.
Practical implication: tie renewal decisions to user, licence and entitlement review so procurement does not outpace access governance.
Why app consolidation matters for control quality
App consolidation is not only a savings exercise. Removing redundant tools reduces the number of identity surfaces, approval paths and renewal obligations that security and procurement teams must govern. In a SaaS estate with overlapping features, two apps may solve the same business need while creating separate authentication, support and offboarding burdens. The more duplicate apps remain, the harder it becomes to maintain coherent lifecycle control over the environment.
Practical implication: use consolidation decisions to reduce both software waste and the number of identities and contracts to govern.
Breaches seen in the wild
- SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Shadow IT in SaaS procurement is a governance visibility failure before it is a buying failure. The article shows that fragmented purchasing leaves procurement, finance and security without a shared inventory of apps, licences and renewal obligations. That means the control gap is not just price negotiation, but the absence of authoritative ownership across the SaaS lifecycle. Practitioners should treat procurement visibility as an identity governance input, not a back-office reporting task.
Procurement workflows now shape the attack surface of SaaS estates. Every unmanaged app request, duplicate subscription and unsynchronised renewal creates another place where access can persist outside policy. This is why contract oversight, app discovery and entitlement review belong in the same operating model. The practitioner conclusion is straightforward: if the buying process is fragmented, access governance will be fragmented too.
Identity and access programmes need to account for commercial lifecycle events. Renewal terms, cancellation checkpoints and stakeholder approvals determine whether users keep access, whether apps are decommissioned, and whether duplicate tools remain active. The SaaS procurement process is therefore part of NHI governance in the broad sense of managing application-bound access over time. Security teams should stop treating procurement as separate from lifecycle control.
Duplicate SaaS tools create governance drag that scales faster than budget waste. The real burden is that every overlapping app adds another set of users, permissions, evidence trails and offboarding steps. That creates a broader control surface for recertification, offboarding and audit response. The named concept here is procurement-to-access drift: when buying decisions and access decisions diverge, governance loses coherence and control quality falls.
Centralised SaaS discovery is the only durable answer to shadow IT procurement. Zluri’s model points to a deeper truth: without accurate discovery, no team can govern renewals, rationalise applications or reconcile contract data with active use. The practitioner implication is to anchor procurement processes to inventory, ownership and lifecycle evidence before any optimisation effort begins.
From our research library:
- The average enterprise SaaS platform connects to 42 or more third-party applications through OAuth tokens, API keys, webhooks and automation platforms.
What this signals
Procurement-to-access drift: When buying, renewal and offboarding decisions are separated, organisations create a governance gap that can outlive the original business need. Security teams should treat SaaS procurement records as part of the identity control plane, not as a separate finance workflow.
Shadow IT in SaaS is rarely just an unsanctioned app problem. It is usually an ownership and lifecycle problem, where no one can prove who approved the tool, who still uses it, or who is responsible for retiring it.
The practical shift is toward connected SaaS governance, where discovery, procurement, entitlement review and renewal management operate as one process. That is how teams reduce duplicate applications without creating blind spots in access management.
For practitioners
- Map procurement to application ownership Create one record that links each SaaS request to the approver, business owner, contract owner and renewal date so no app sits outside governance.
- Review renewals against active usage Require licence and entitlement review before renewal decisions so dormant subscriptions and duplicate tools are identified before money is committed.
- Consolidate overlapping SaaS functions Use feature overlap analysis to retire duplicate tools, reduce redundant identities and simplify offboarding across the SaaS estate.
- Document approval checkpoints end to end Capture finance, legal and security checkpoints in the same workflow so shadow purchases cannot bypass mandatory governance steps.
- Tie discovery to renewal planning Update the SaaS inventory before each renewal window so procurement decisions reflect current usage, ownership and business need.
Key takeaways
- The article shows that SaaS procurement complexity can obscure app ownership, renewals and approvals, which is where shadow IT begins to harden into governance debt.
- The main risk is not only overspending on software, but also preserving duplicate tools and unmanaged access paths across the SaaS estate.
- The right response is to connect procurement records with inventory, usage and entitlement review so commercial decisions and access decisions stay aligned.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OC-03 — Internal and External Stakeholders | This article centers on cross-functional ownership across procurement and security. |
| ID.AM-01 — Physical Devices and Systems Inventoried | SaaS discovery and inventory are the basis of the article's governance gap. | |
| Recommendation — Define shared accountability for SaaS requests, renewals and retirements across procurement and security teams. Maintain an authoritative SaaS inventory before approving renewals or new purchases. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article links procurement choices to licence sprawl and ongoing access control. |
| Recommendation — Tie SaaS licence decisions to account management so unused access does not survive renewals. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Duplicate or unneeded SaaS tools persist when offboarding is not tied to procurement. |
| Recommendation — Revoke app access and retire subscriptions when business need ends. | ||
Key terms
- Shadow IT: Shadow IT is the use of applications or services outside formal enterprise approval or visibility. In SaaS environments, it often includes department-purchased tools and unsanctioned integrations that create hidden identity, data, and access paths the security team cannot readily govern.
- SaaS Lifecycle Governance: SaaS lifecycle governance is the set of controls that manage applications from onboarding through access assignment, renewal, and decommissioning. It matters because the security value of SaaS management depends on whether the organisation can prove ownership, revoke access, and retire unused tools on demand.
- Application Ownership: Application ownership is the assignment of accountability for approving, funding, governing, and retiring a software application. Effective ownership links budget responsibility to access responsibility, which is essential when renewals, offboarding, and access reviews need a clear decision-maker.
- License Rationalisation: License rationalisation is the practice of matching paid software entitlements to actual business use so organisations stop paying for excess capacity. In identity terms, it also helps reveal which accounts or integrations still have access even after the need has ended.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 12, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org