SaaS sprawl is becoming an identity governance problem

At a glance

What this is: This study looks at how different industries manage SaaS and finds that sprawl, shadow IT, and weak tracking are turning SaaS growth into an identity governance issue.

Why it matters: It matters because every unmanaged SaaS app adds accounts, entitlements, and offboarding risk that IAM, IGA, and SaaS governance teams must bring under control.

By the numbers:

• Zluri surveyed 157 tech leaders across North America, South America, Europe, and Asia Pacific.
• 52% of the industries in the survey track SaaS data manually through dashboards within the application itself.
• 80% of survey respondents said they do not use any tool to track their SaaS usage.
• 30 to 40% of enterprise spending goes to shadow IT, according to Gartner research cited by Zluri.

Context

SaaS sprawl is the accumulation of too many applications, overlapping subscriptions, and unmanaged ownership across a SaaS estate. In identity terms, that creates a broader surface for access provisioning, privilege drift, and offboarding failure across every business unit using software outside a centrally governed process.

Zluri’s survey frames the problem through industry tracking habits, budget pressure, and security concerns rather than through product features alone. The underlying pattern is familiar to IAM and IGA teams: the more SaaS adoption is decentralised, the harder it becomes to know who has access, why they have it, and whether it should still exist.

For identity programmes, the key issue is not whether SaaS is growing, but whether joiner-mover-leaver controls and entitlement visibility are keeping pace. Where organisations rely on spreadsheets, dashboards, or employee feedback, identity governance becomes reactive instead of enforceable.

Key questions

Q: How should organisations govern SaaS sprawl across business units?

A: Assign clear application ownership, require periodic reconciliation between discovered apps and approved systems, and connect the results to joiner-mover-leaver processes. Without ownership and lifecycle linkage, each department can accumulate its own shadow stack and the central programme will only see the surface layer.

Q: Why does manual SaaS tracking fail as an identity control?

A: Manual tracking fails because it records perception, not authoritative access state. Dashboards, surveys, and expense reports can miss dormant accounts, shadow IT, and hidden integrations, so they cannot reliably support least privilege or offboarding. Identity teams need governed inventory and entitlement evidence instead of self-reported usage data.

Q: What breaks when SaaS offboarding is not tied to identity revocation?

A: The organisation keeps paying for applications after the business no longer needs them, and access can remain active even after the relationship should end. That creates budget leakage, audit exposure, and unnecessary access persistence. The failure is not just operational waste, but the loss of a reliable end state for application lifecycle management.

Q: What is the difference between SaaS configuration and SaaS governance?

A: SaaS configuration is the on or off state of a feature. SaaS governance is the policy, ownership, monitoring, and cleanup process that determines whether the feature can be used safely. A disabled setting may reduce exposure, but only governance ensures identities, content, and exceptions are managed over time.

Technical breakdown

Why SaaS sprawl creates identity governance drift

SaaS sprawl is more than app proliferation. Each new subscription creates another set of identities, roles, tokens, and admin paths that may sit outside the core IAM stack. When ownership is fragmented across departments, onboarding and offboarding become inconsistent, and entitlement reviews lose their source of truth. That is why SaaS adoption quickly becomes a governance problem rather than only a procurement problem. The control issue is lifecycle visibility: without a reliable inventory and ownership model, access decisions are made after the fact, not at issuance time.

Practical implication: map SaaS ownership to identity governance records before the next recertification cycle.

Why manual SaaS tracking fails at scale

Manual tracking through dashboards, spreadsheets, surveys, and expense reports can show what people say they use, but it does not reliably show what identities and permissions actually exist. Those methods lag behind vendor changes, hidden integrations, and self-service app adoption. They also struggle to distinguish active usage from dormant but still-authorised access. In governance terms, this means the programme sees consumption, not control. That gap matters because the access lifecycle is only as strong as the inventory behind it.

Practical implication: replace self-reported tracking with governed discovery and entitlement inventory.

Least privilege in SaaS depends on lifecycle enforcement

Least privilege is not just a permissions principle. In SaaS estates, it depends on whether access can be scoped at onboarding, adjusted when roles change, and removed cleanly at offboarding. Zluri’s findings show that least-privilege access is one of the most desired features because practitioners are trying to reduce excess access across a growing third-party toolset. Without lifecycle enforcement, unused subscriptions, duplicate apps, and shadow IT make the principle impossible to maintain consistently across teams and vendors.

Practical implication: align SaaS entitlement reviews with joiner-mover-leaver events rather than with ad hoc audits.

Breaches seen in the wild

• SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

SaaS sprawl is now an identity control problem, not only a procurement problem. Once business units can adopt applications faster than governance can inventory them, the identity surface expands faster than recertification and offboarding can keep up. That changes the centre of gravity for IAM teams: the issue is no longer just who bought the app, but who can still access it after the business case has changed. Practitioners should treat SaaS growth as a governance drift indicator, not a usage metric alone.

Manual tracking creates the illusion of control while leaving entitlement reality unresolved. Dashboards, expense reports, and surveys may help finance or operations, but they do not create authoritative identity evidence. The result is a control environment that knows what was purchased, not what is active, over-privileged, or abandoned. That is why SaaS governance has to move toward lifecycle-linked inventory and entitlement visibility, with identity records as the source of truth.

Least privilege becomes measurable only when SaaS ownership and access are linked. The article’s emphasis on least-privilege access as a desirable feature shows that practitioners understand the problem, but desire alone does not enforce it. The real issue is the missing governance chain between app discovery, access approval, and offboarding. In practice, teams should judge SaaS programmes by how quickly they can remove unnecessary access after the business need disappears.

Shadow IT should be treated as an identity debt signal. Unmanaged SaaS adoption does not just create duplication, it accumulates access paths that are hard to enumerate and harder to retire. Over time, that debt weakens joiner-mover-leaver discipline and makes access reviews less reliable. The practitioner takeaway is to collapse SaaS oversight, entitlement governance, and lifecycle management into one operating model rather than three disconnected processes.

Named concept, identity surface sprawl: When SaaS growth outpaces governance, every app adds another identity boundary, another offboarding dependency, and another place where privilege can persist unnoticed. That is the structural risk this study exposes, and it is exactly why SaaS governance must be owned as part of the identity programme, not as a separate software spend exercise.

From our research library:

• The average enterprise SaaS platform connects to 42 or more third-party applications through OAuth tokens, API keys, webhooks and automation platforms.

What this signals

Identity teams should treat SaaS adoption as a lifecycle signal. When departments can add cloud apps without central visibility, the issue is not just software bloat. It is a sign that access governance, ownership assignment, and offboarding are too far removed from where the work is happening.

Least privilege in SaaS depends on operational evidence, not policy intent. The practical test is whether the organisation can prove which accounts are active, which subscriptions are redundant, and which entitlements should be removed. If that evidence is missing, the control is aspirational rather than real.

For practitioners

• Build a governed SaaS inventory Create a single inventory that ties each application to an owner, an access model, and a renewal date so discovery feeds governance instead of finance alone.
• Link SaaS onboarding and offboarding to identity lifecycle events Require joiner, mover, and leaver triggers to update SaaS access rather than letting departments manage accounts independently.
• Replace self-reported usage tracking with authoritative entitlement data Use system-generated access and usage evidence to identify dormant access, duplicate apps, and exceptions that spreadsheets cannot reliably show.
• Prioritise least-privilege reviews for shadow IT apps Focus first on SaaS tools that were adopted outside central procurement or IAM oversight because those are the least likely to have clean ownership and offboarding.

Key takeaways

• SaaS sprawl expands the identity attack surface by multiplying accounts, permissions, and offboarding dependencies across business units.
• The survey shows that manual tracking is still common, which means many organisations are managing SaaS with incomplete or delayed access evidence.
• Identity teams should anchor SaaS governance in lifecycle-linked inventory, entitlement review, and least-privilege enforcement rather than in spreadsheet oversight.

Key terms

• SaaS Sprawl: SaaS sprawl is the uncontrolled spread of software-as-a-service applications across teams and business units. It creates fragmented ownership, duplicated functionality, and weak visibility into who can access what. For IAM and NHI teams, the main risk is not only cost but persistent entitlements that outlive business need.
• Shadow IT: Shadow IT is the use of applications or services outside formal enterprise approval or visibility. In SaaS environments, it often includes department-purchased tools and unsanctioned integrations that create hidden identity, data, and access paths the security team cannot readily govern.
• Least Privilege: A security principle requiring that every identity, human or non-human, is granted only the minimum permissions necessary to perform its function. Least privilege is the single most effective control for reducing NHI blast radius.
• Joiner-Mover-Leaver Lifecycle: The joiner-mover-leaver lifecycle describes the access changes that should happen when a person or account is created, changes role, or exits the organisation. It is the basic operating model for keeping entitlements aligned to current need, and it becomes critical when automation replaces manual ticket handling.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.