SaaS sprawl and shadow IT are now identity governance issues

At a glance

What this is: This analysis links SaaS sprawl and shadow IT to identity governance, arguing that uncontrolled app adoption turns cost management into access, ownership, and renewal control problems.

Why it matters: It matters because IAM and IGA teams cannot govern identities properly when applications are acquired and used outside approved procurement and access processes.

By the numbers:

• Organizations with over 1,000 employees use 500 software applications on average.

Context

SaaS sprawl becomes an identity governance issue when software is purchased, assigned, and renewed outside the controls that normally define ownership and accountability. In that state, the problem is no longer only spend efficiency. It becomes a question of who approved the app, who can access it, and who is responsible for removing it when it is no longer needed.

Shadow IT is the clearest signal that governance has fallen behind usage. When employees adopt software without approval, the organisation loses visibility into access paths, duplicate tools, and renewal exposure, which makes basic entitlement control harder across human users and the applications they consume.

Key questions

Q: What breaks when SaaS is adopted outside approved governance processes?

A: When SaaS is adopted outside approved governance processes, organisations lose the connection between application ownership, user access, and renewal accountability. That creates stale subscriptions, duplicate tooling, and unreviewed entitlements that persist beyond business need. The practical failure is not just overspend. It is the loss of a reliable control path for who approved the app and who can remove it.

Q: Why does shadow IT increase compliance and audit risk in regulated environments?

A: Shadow IT increases compliance risk because unapproved tools often sit outside formal controls for logging, retention, access review, and data handling. That makes it harder to prove who accessed data, where it moved, and whether required protections were applied. In regulated environments, the absence of visibility can turn routine collaboration into an audit finding or a reportable incident.

Q: How can teams tell whether SaaS sprawl is becoming an identity governance problem?

A: Look for mismatches between application count, active usage, and revocation speed. If apps keep renewing after adoption falls, if ownership is unclear, or if offboarding does not remove access quickly, SaaS sprawl has moved from cost inefficiency to governance exposure. That is the point where IAM and procurement must act together.

Q: Who should be accountable for app approval and renewal decisions?

A: Accountability should sit with a named business owner supported by IAM, procurement, and security teams. The owner justifies need, IAM governs access, and procurement controls the commercial commitment. Without that split of responsibility, organisations end up with duplicate tools, underused licences, and no one clearly responsible for retiring them.

Technical breakdown

Why SaaS sprawl becomes an identity governance problem

SaaS sprawl expands the number of applications, contracts, and user relationships that must be governed, but those relationships often sit outside the identity catalogue. That means access reviews, app ownership, and renewal controls are applied late, if at all. In practice, the governance gap is not the number of apps alone. It is the absence of authoritative records tying each app to a business owner, a user population, and a renewal decision path. Once that mapping is missing, entitlement drift and duplicate tooling become inevitable.

Practical implication: maintain authoritative app-to-owner and app-to-user mapping before attempting any spend or access rationalisation.

How shadow IT breaks approval and renewal control

Shadow IT is software usage without stakeholder approval, so the organisation cannot reliably know what was bought, who is using it, or when it renews. That breaks the normal lifecycle assumptions behind procurement, access governance, and offboarding. The issue is not just unauthorised spend. Untracked apps can persist with active accounts, stale permissions, and automatic renewals long after the business need has changed. In IAM terms, the app exists outside the control plane that should govern its identity relationships.

Practical implication: require discovery workflows that surface unapproved applications before renewal and entitlement decisions are made.

Why license optimisation and access control now overlap

The article shows that cost optimisation and access control are converging because unused or oversized licenses are also governance signals. If a user is overprovisioned, underutilised, or assigned the wrong tier, the organisation may be paying for access that no longer matches actual need. That makes SaaS spend management part of identity lifecycle management, not a separate finance exercise. The governance test becomes whether app usage, entitlement level, and renewal status are evaluated together rather than in isolated teams.

Practical implication: review license tiering, entitlement scope, and renewal dates in the same governance workflow.

NHI Mgmt Group analysis

SaaS sprawl creates an identity control plane problem, not just a budget problem. Once application growth outpaces governance, the organisation loses a clean record of who owns each app, who can use it, and who can revoke it. That turns procurement into a security dependency because identity decisions now sit outside the system of record. Practitioners should treat app proliferation as a governance design issue, not a software buying issue.

Shadow IT is a lifecycle failure, because an unapproved app is usually an ungoverned identity relationship. Approval, assignment, renewal, and offboarding are supposed to be linked. When employees bypass the request process, those links break, and the organisation inherits stale access, duplicate services, and unmanaged renewals. The implication is that lifecycle control must extend to applications themselves, not only to user accounts.

License tiering is now a proxy for entitlement quality. Oversized plans, unused subscriptions, and redundant tools all indicate that access decisions are not being matched to business need. That does not merely waste spend. It signals that governance and usage telemetry are disconnected, which weakens both auditability and least privilege. Practitioners should read SaaS utilisation as an entitlement signal, not just a finance metric.

App ownership is the missing named concept in many SaaS governance programmes. Without a clear owner for each application, no one can certify access, justify renewal, or retire redundant tools with confidence. This is the core governance gap the article exposes, and it is why SaaS management belongs inside identity governance rather than beside it. Teams should make ownership assignment a prerequisite for any SaaS approval or renewal.

Identity governance must now extend across human users and their software subscriptions. The article shows that unmanaged SaaS adoption changes the governance surface by expanding both entitlement volume and decision latency. That makes access control, renewal oversight, and application rationalisation part of the same control problem. Practitioners should align procurement, IAM, and spend management around one authoritative application inventory.

From our research library:

• The average enterprise SaaS platform connects to 42 or more third-party applications through OAuth tokens, API keys, webhooks and automation platforms.

What this signals

App ownership is the governance control that SaaS sprawl exposes most clearly. When applications can be purchased and used without an accountable owner, access review, renewal, and offboarding all become harder to execute. The practical response is not just rationalising spend, but making every SaaS app part of the identity control plane.

Shadow IT weakens the assumptions behind lifecycle governance. A tool that exists outside procurement and access workflows can remain active long after the original user or use case has changed. That means governance programmes need discovery and ownership assignment before they can claim effective oversight of the software estate.

For practitioners

• Establish authoritative SaaS inventory Create and maintain a single inventory of approved applications, owners, user groups, contract dates, and renewal terms so governance has one source of truth.
• Tie access decisions to app ownership Require every application to have a named business and technical owner before it is approved, assigned, or renewed, so access reviews have a clear accountable party.
• Review licence tiering against actual usage Compare assigned plan levels with observed usage and downgrade users whose activity does not justify premium tiers, especially for high-cost collaboration and productivity tools.
• Detect and challenge shadow IT early Use discovery workflows to surface unapproved applications before auto-renewal, then decide whether to approve, consolidate, or retire them based on actual business need.
• Align procurement, IAM, and spend governance Run procurement approvals, entitlement reviews, and renewal decisions through a shared governance process so duplicate apps and stale subscriptions do not persist unnoticed.

Key takeaways

• SaaS sprawl is an identity governance issue because the number of apps now exceeds the visibility and accountability many teams have for them.
• Shadow IT breaks the link between approval, access, and renewal, which leaves organisations with stale subscriptions and unmanaged entitlements.
• Teams need a shared inventory, named ownership, and usage-based review if they want to govern both spend and access effectively.

Key terms

• SaaS Sprawl: SaaS sprawl is the uncontrolled spread of software-as-a-service applications across teams and business units. It creates fragmented ownership, duplicated functionality, and weak visibility into who can access what. For IAM and NHI teams, the main risk is not only cost but persistent entitlements that outlive business need.
• Shadow IT: Shadow IT is the use of applications or services outside formal enterprise approval or visibility. In SaaS environments, it often includes department-purchased tools and unsanctioned integrations that create hidden identity, data, and access paths the security team cannot readily govern.
• Application Ownership: Application ownership is the assignment of accountability for approving, funding, governing, and retiring a software application. Effective ownership links budget responsibility to access responsibility, which is essential when renewals, offboarding, and access reviews need a clear decision-maker.
• License Tiering: License tiering is the practice of assigning users to the software plan that matches their actual needs and usage. When tiering is misaligned, it often signals both waste and entitlement drift, because access is broader or costlier than required.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.