TL;DR: Unchecked SaaS adoption creates visibility gaps, unmanaged credentials, inconsistent offboarding, and wasted licences as teams sign up for apps outside IT oversight, according to 1Password. The governance problem is not just inventory, but proving ownership and enforcing access lifecycle controls across SaaS, IAM, and compliance workflows.
At a glance
What this is: 1Password examines how unmanaged SaaS adoption creates inventory blind spots, access ownership confusion, and audit pain for IT and compliance teams.
Why it matters: IAM, IGA, and SaaS governance teams need a defensible inventory, repeatable access reviews, and offboarding workflows because app sprawl now creates both security exposure and operational waste.
Context
SaaS sprawl is a governance problem before it is a tooling problem. When teams adopt apps outside IT oversight, the organization loses a reliable view of what is in use, who owns access, and whether provisioning and deprovisioning are happening consistently.
For identity and access programmes, the issue sits at the intersection of SaaS inventory, offboarding, and quarterly access reviews. If applications are not tied into SSO or operational workflows, ownership gets murky and auditors are left with spreadsheets instead of evidence trails.
Key questions
Q: What breaks when SaaS is adopted outside approved governance processes?
A: When SaaS is adopted outside approved governance processes, organisations lose the connection between application ownership, user access, and renewal accountability. That creates stale subscriptions, duplicate tooling, and unreviewed entitlements that persist beyond business need. The practical failure is not just overspend. It is the loss of a reliable control path for who approved the app and who can remove it.
Q: Why do SaaS sprawl and unmanaged entitlements increase audit risk?
A: They increase audit risk because the evidence needed for certification is scattered across spreadsheets, inboxes, and disconnected tools. Auditors need a repeatable view of users, roles, apps, and offboarding actions. Without that, access reviews become inconsistent and the organisation cannot prove that control decisions were made and executed on time.
Q: How can teams tell whether SaaS governance is actually working?
A: Look for evidence that discovered applications can be assigned an owner, tied to an access policy, and removed through an enforced workflow. If the platform can only report on SaaS usage but cannot drive deprovisioning or entitlement review, governance is still fragmented.
Q: Should organisations manage software licenses and SaaS entitlements together?
A: Yes. In modern SaaS estates, license consumption and access entitlement are tightly linked, so separating them creates duplicate records and inconsistent decisions. Managing them together gives identity teams a single view of who can use an application, whether that access is justified, and when it should be revoked.
Technical breakdown
Why SaaS discovery fails without a governed inventory
SaaS discovery is not just a list-building exercise. The hard part is establishing a continuously accurate inventory that answers what apps exist, why they are in use, who is responsible for them, and which access paths they expose. When teams rely on ad hoc spreadsheets, the inventory quickly becomes stale because app creation, shadow adoption, and duplicate tooling continue after the sheet is updated. The result is a control gap between procurement, IT, and security. A governed inventory has to connect discovery to ownership, entitlement data, and lifecycle actions, otherwise it is only a snapshot of a moving target.
Practical implication: treat SaaS inventory as an identity control surface, not a spreadsheet task.
How SaaS access reviews break down in practice
Access reviews fail when the evidence for who can access what is scattered across email, spreadsheets, and point tools. In SaaS environments, the review problem is not only whether a user still needs access, but whether the application itself is tracked, whether the entitlement is still active, and whether the reviewer can see a clear owner for the decision. Without that chain, certification becomes a manual reconciliation exercise rather than a control. That weakens auditability and makes quarterly reviews vulnerable to stale data, incomplete scope, and inconsistent remediation.
Practical implication: centralise entitlement evidence before the review cycle starts.
Why offboarding and license reclamation need the same workflow
Offboarding and license optimisation are linked in SaaS because unused accounts, orphaned entitlements, and duplicate applications all represent lifecycle failure. If deprovisioning is handled separately from usage analysis, organisations keep paying for access that is no longer justified and may also leave credentials live in apps no longer monitored by IT. The operational problem is not simply waste, it is that lifecycle control has drifted away from the systems where access is created and removed. That makes cleanup slow, reactive, and hard to prove.
Practical implication: tie user departure, license reclaim, and app decommissioning to one governed process.
Threat narrative
Attacker objective: The practical objective is not a single breach, but uncontrolled access persistence, audit failure, and inefficient spending across the SaaS estate.
- Entry occurs when users adopt SaaS applications outside formal IT approval, creating unmanaged access paths that never enter the core inventory.
- Credential and entitlement sprawl develops as provisioning and deprovisioning become inconsistent across tools that are not connected to SSO or governance workflows.
- Impact follows when sensitive data, audit evidence, and unused licences accumulate in systems that security and compliance teams cannot reliably oversee.
Breaches seen in the wild
- Millions of Misconfigured Git Servers Leaking Secrets: Nearly 5 million misconfigured Git servers expose sensitive secrets and credentials online.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
SaaS sprawl is an identity governance problem disguised as an IT hygiene issue. Once users can create app access outside IT oversight, the organisation no longer has a clean joiner-mover-leaver record for SaaS. That breaks ownership, review, and deprovisioning discipline at the same time. The practitioner conclusion is that SaaS governance belongs inside the identity programme, not beside it.
Access review processes only work when the underlying entitlement inventory is trustworthy. If the reviewer cannot see every app, every owner, and every active entitlement, quarterly certification becomes a partial exercise with false confidence attached. That is why spreadsheets and inbox-based tracking fail at scale. The practical conclusion is that review quality depends on upstream discovery and entitlement normalisation.
Lifecycle control, not licence accounting, is the real control objective. The article shows that wasted spend and security exposure come from the same source: unmanaged SaaS adoption with weak provisioning and offboarding discipline. Once those lifecycle steps drift into manual work, the programme loses both governance evidence and financial control. The practitioner conclusion is that reclaim, deprovision, and auditability must be governed as one workflow.
The named concept here is SaaS ownership drift. That is the state where apps, entitlements, and accountability move faster than the identity programme can record them. It produces the exact conditions in which access reviews, offboarding, and renewal decisions stop lining up. The practitioner conclusion is to treat ownership drift as a measurable governance failure, not an admin inconvenience.
From our research library:
- 1 in 3 organisations encountered suspicious AI agent activity in 2025, and 99.4% experienced a SaaS or AI ecosystem incident.
What this signals
SaaS ownership drift: when app adoption outpaces identity governance, the programme stops knowing who is accountable for access, review, and removal. That is why SaaS management belongs in the same operational model as IAM and lifecycle governance, not in a separate admin workflow.
Access reviews, offboarding, and licence reclamation should be treated as one control chain. When those functions are split across different teams and systems, the organisation can still be busy without being governed, which is exactly how shadow SaaS becomes durable risk.
For practitioners
- Establish a governed SaaS inventory Track what apps are in use, why they are approved, who uses them, and who owns each one so the identity team can work from a current control list rather than a static spreadsheet.
- Tie access reviews to entitlement evidence Require a consolidated view of app ownership, user access, and active entitlements before quarterly certification starts so reviewers are not reconciling multiple disconnected sources.
- Automate offboarding and license reclaim Connect user departure, deprovisioning, and license removal into one workflow so access does not outlive the business need that created it.
- Audit unsanctioned SaaS outside SSO Find applications that were adopted without central oversight and assess whether they have clear ownership, review coverage, and supported deprovisioning paths.
Key takeaways
- Unchecked SaaS adoption creates a governance gap because the organisation cannot reliably prove which apps exist, who owns them, or how access is removed.
- The operational risk is paired with financial waste, since duplicate apps and unused licences accumulate when usage data and entitlement evidence are fragmented.
- The strongest control response is to connect discovery, access reviews, and offboarding into one lifecycle workflow that the identity programme can own.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | The article centres on SaaS access that outlives ownership and leaver workflows. |
| NHI-05 — Overprivileged NHI | Unreviewed SaaS entitlements and duplicate apps expand access beyond intended scope. | |
| NHI-09 — NHI Reuse | Shared apps, repeated licences, and duplicated tooling create reuse patterns that obscure ownership. | |
| Recommendation — Map SaaS offboarding to NHI-01 and remove access when users or apps are no longer approved. Review SaaS entitlements for excess access and reduce any permissions that exceed business need. Inventory repeated SaaS tools and separate ownership so one app's access model does not mask another's. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The core governance issue is proving and managing who has access to which SaaS resources. |
| Recommendation — Apply PR.AA-05 to maintain current SaaS entitlements and remove stale permissions after role changes. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article highlights account lifecycle drift, orphaned access, and manual entitlement cleanup. |
| Recommendation — Use CIS-5 to centralise account lifecycle actions and revoke unused SaaS access promptly. | ||
Key terms
- SaaS Entitlement Drift: SaaS entitlement drift is the gradual mismatch between assigned access, actual usage, and current business need across a software estate. It appears when provisioning, renewal, and offboarding are managed separately, leaving stale permissions in place long after they stop serving a valid purpose.
- Access review evidence: Access review evidence is the record that shows an entitlement was examined, assessed, and either retained or removed for a reason. Strong evidence includes the reviewer, the date, the decision, and any remediation path, which is what makes governance auditable rather than assumed.
- SaaS Lifecycle Governance: SaaS lifecycle governance is the set of controls that manage applications from onboarding through access assignment, renewal, and decommissioning. It matters because the security value of SaaS management depends on whether the organisation can prove ownership, revoke access, and retire unused tools on demand.
- Licence Reclamation: Licence reclamation is the removal or downgrade of software entitlements that are no longer justified by usage. In identity governance terms, it is a lifecycle action based on observed need, and it becomes more effective when usage telemetry is reliable enough to trigger automated review or deprovisioning.
Deepen your knowledge
NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 11, 2026.
Updated on October 10, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org