SaaS renewal management exposes the identity governance gap

At a glance

What this is: This is a SaaS renewal management guide arguing that better visibility, alerts, and prioritisation help organisations control renewals, costs, and license use.

Why it matters: It matters because renewal governance sits alongside IAM, IGA, and lifecycle management, where unclear ownership and stale access decisions create the same control gaps across human, machine, and service identities.

By the numbers:

• Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
• Only 5.7% of organisations have full visibility into their service accounts.
• 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems.

👉 Read Zluri's guide to SaaS renewal management and renewal optimisation

Context

SaaS renewal management is really a lifecycle governance problem. When organisations rely on manual tracking, auto-renewals, and scattered ownership, they lose visibility into who is using which applications, which subscriptions are redundant, and which contracts should be renegotiated or retired before renewal dates arrive.

That matters to IAM and IGA teams because renewal decisions reflect the same control failures seen in access governance: weak inventory, unclear accountability, and delayed review cycles. The article treats cost control as the headline, but the underlying issue is entitlement stewardship across a fast-growing SaaS estate.

Key questions

Q: How should organisations govern SaaS renewals in a mature identity programme?

A: Treat SaaS renewals as a lifecycle control, not just a finance process. Every subscription should have an owner, a current usage picture, and a renewal decision path that checks whether the tool still supports a business need. Where the application grants access or handles sensitive data, bring renewal approval into the same governance flow as access review and offboarding.

Q: Why do SaaS renewals create identity governance risk?

A: Because renewals keep software, data access, and integrations alive by default unless someone actively intervenes. If ownership is unclear or usage data is stale, organisations can renew redundant tools, preserve unnecessary permissions, and miss the moment to retire an application cleanly. That produces the same kind of lifecycle drift IAM teams work to prevent.

Q: What do teams get wrong about SaaS usage review?

A: They often treat usage review as a budgeting exercise instead of a governance signal. Usage data should tell you whether a subscription is still justified, whether it duplicates another tool, and whether access should be reduced before renewal. If the review happens after renewal, the organisation has already paid to preserve waste.

Q: Who should approve a SaaS renewal when the application carries user access?

A: The renewal should be approved by the business owner, the technical owner, and the team responsible for identity governance when the application exposes user access or sensitive data. That ensures the decision reflects operational need, access impact, and retirement risk, rather than vendor timing alone.

Technical breakdown

Why renewal calendars fail without identity and app ownership data

A renewal calendar only works when the organisation knows which application belongs to which business owner, which users depend on it, and whether the application is still active. The article correctly points out that spreadsheets and periodic updates become inaccurate as app counts rise. In practice, renewal management depends on inventory quality, usage telemetry, and a decision path that links procurement, IT, and security. Without those inputs, reminders are just notifications, not governance.

Practical implication: tie every renewal record to an accountable owner, live usage data, and a review workflow before renewal dates are allowed to auto-extend.

How auto-renewal turns SaaS contracts into standing access risk

Auto-renewal is not only a procurement issue. It creates standing exposure because an application or license can remain active long after business need has declined. That is structurally similar to access that persists without revalidation. In identity terms, the control problem is lifecycle drift: the entitlement remains live because nobody has a clear trigger to review, reduce, or remove it. Renewal governance therefore overlaps with recertification logic, even when the subject is a commercial contract rather than a login credential.

Practical implication: require explicit renewal approval for every subscription that carries user access, data exposure, or integrated identity permissions.

Why software usage review belongs in the access review cycle

Usage review is the renewal equivalent of access review. The article highlights that teams should compare actual usage against spend before renewing, which mirrors the IAM principle of validating whether an entitlement is still justified. For SaaS, that review needs to include dormant apps, duplicate tools, and shadow IT that may not be visible in finance systems. When usage data is weak, organisations renew based on assumption rather than evidence, and that produces the same kind of privilege creep seen in poorly governed identity programmes.

Practical implication: fold SaaS usage review into recertification and offboarding routines so stale applications are removed before renewal, not after.

NHI Mgmt Group analysis

Renewal management is an identity lifecycle problem disguised as procurement hygiene. The article focuses on cost savings, but the control failure it describes is broader: organisations do not know what they still own, who depends on it, or when it should be removed. That is the same governance weakness that drives access creep in identity programmes. The practitioner conclusion is simple: treat renewals as lifecycle decisions, not as calendar reminders.

Manual renewal tracking creates the same blind spots as unmanaged identity inventories. Spreadsheets work only while the application estate is small and stable. Once usage changes faster than review cycles, the organisation is left renewing subscriptions it no longer needs and missing ones it still relies on. That is a governance model built on stale state, and stale state is exactly what identity teams try to eliminate. The practitioner conclusion is to anchor renewals in a live system of record.

Auto-renewal is a standing access decision that outlives business need. The renewal clause assumes the current state will remain valid unless someone intervenes, which is the same premise behind many over-retained entitlements. That premise fails in dynamic SaaS estates where users change, tools overlap, and subscriptions lose relevance quickly. The implication is not just better approval routing. It is a rethink of what counts as justified persistence in the application and identity lifecycle.

SaaS renewal sprawl is the governance twin of NHI sprawl. The operational pattern is familiar: more assets, weaker visibility, delayed review, and growing waste. The difference is that SaaS renewals expose commercial and access entitlements at the same time, which makes ownership discipline more important than tooling volume. The practitioner conclusion is to unify procurement, IAM, and IGA review logic before the renewal estate becomes unmanageable.

Access review cycles must extend to subscriptions, not just accounts. If teams only recertify user access, they miss the commercial layer that keeps software and its privileges alive. The article shows why renewal decisions need data on usage, redundancy, and business value. That is exactly where identity governance should meet software governance. The practitioner conclusion is to make renewal approvals part of access certification wherever SaaS carries meaningful data or integration risk.

From our research:

• Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
• 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage, according to the Ultimate Guide to NHIs.
• Renewal governance should be treated as a lifecycle control problem, not just a cost problem, because stale entitlements and unused subscriptions create the same persistence risk that NHI offboarding failures create.

What this signals

Renewal discipline will increasingly be measured as part of identity governance maturity. As SaaS estates expand, the boundary between procurement, access review, and offboarding keeps narrowing. Teams that cannot reconcile usage, ownership, and renewal status will continue to preserve dormant entitlements that should have been removed earlier, and that weakens both cost control and security posture.

NHI sprawl and SaaS sprawl now share the same failure pattern. In both cases, organisations accumulate assets faster than they can review them, then rely on stale records to justify continued access. The practical signal is to unify inventory, review, and retirement processes across applications, service accounts, and other machine identities so the same governance gap does not repeat in different forms.

Service-account visibility remains a useful benchmark for renewal governance discipline. Our research shows only 5.7% of organisations have full visibility into their service accounts, which is a reminder that incomplete visibility is usually the first control failure. When an organisation cannot see every identity it governs, it will also struggle to see every subscription it keeps alive.

For practitioners

• Build a single renewal system of record Link each SaaS contract to a business owner, technical owner, renewal date, usage profile, and data sensitivity rating so renewals are never decided from spreadsheets alone.
• Require evidence-based renewal review Before any auto-renewal can proceed, require current usage data, active user counts, and a justification for keeping the subscription in service.
• Fold renewals into access recertification Review applications that provide user access or hold sensitive data through the same lifecycle governance cadence used for access reviews and offboarding.
• Separate dormant tools from active business services Flag applications with declining usage so procurement can remove, downgrade, or consolidate them before the renewal window closes.
• Set approval thresholds for auto-renewal exceptions Escalate subscriptions with high spend, broad user access, or third-party integrations for explicit sign-off rather than allowing silent continuation.

Key takeaways

• SaaS renewal management is fundamentally a lifecycle governance issue, because renewal decisions preserve access, spend, and operational risk at the same time.
• The article’s core warning is that manual tracking and auto-renewal leave organisations renewing software on stale assumptions rather than current need.
• The strongest control move is to connect renewal approval to ownership, usage evidence, and access recertification before the renewal window closes.

Key terms

• SaaS Renewal Management: The process of reviewing, approving, renegotiating, or ending software subscriptions before they renew automatically. In governance terms, it combines ownership, usage evidence, and contract timing so organisations do not preserve unnecessary spend or access by default.
• Lifecycle Governance: The discipline of controlling how identities, subscriptions, and privileges are created, reviewed, continued, and retired. For SaaS, it means renewal decisions are tied to current business need, not just vendor dates or historical usage patterns.
• Auto-renewal Clause: A contract condition that extends a subscription unless the customer acts within a defined window. In identity and access terms, it creates persistence pressure because services and their embedded access can continue even after business need has faded.
• Usage Review: A governance check that compares actual application use against cost, ownership, and business value before continuation. It is stronger than simple spend analysis because it can justify reduction, consolidation, or retirement of software that is still technically active.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.

This post draws on content published by Zluri: SaaS Management SaaS Renewal Management, a guide to optimizing SaaS renewals. Read the original.