SaaS sprawl is breaking both identity governance and cost control

At a glance

What this is: This is an analysis of how late SaaS discovery breaks both cost control and identity governance by hiding applications until they are already embedded in use.

Why it matters: It matters because IAM, IGA, and finance teams cannot govern access, revoke accounts, or control spend for applications they have not discovered yet.

Context

SaaS sprawl is a visibility problem before it is a tooling problem. When applications enter an organisation through self-service signup, team adoption, or unmanaged purchasing, identity governance and cost management both start from incomplete inventories.

The article argues that traditional discovery arrives too late, often at SSO integration or finance reconciliation. For IAM, IGA, and SaaS management teams, that means access reviews, provisioning, offboarding, and spend control are all operating after the fact instead of at the point of adoption.

Key questions

Q: What breaks when SaaS applications are discovered too late?

A: Access reviews, offboarding, and spend control all become partial controls because they only operate on applications already known to IT. Late discovery means users have already created accounts, teams have embedded workflows, and Finance may already be paying for duplicate tools before governance can act.

Q: Why do SaaS sprawl and identity governance fail in the same place?

A: They both depend on discovery happening before control. If applications are only found at purchase or SSO integration, finance cannot manage spend early and security cannot govern access early. The shared failure is late visibility, which turns both disciplines into cleanup functions instead of preventive ones.

Q: How do you know if access reviews are actually covering your SaaS environment?

A: Compare the number of applications in review workflows with the number of applications employees actually use. If your IGA system covers only integrated tools, then review completion rates can look healthy while most access remains outside certification. Coverage, not workflow completion, is the real metric.

Q: Who should own SaaS discovery when cost control and IGA both depend on it?

A: Ownership usually sits with IT, but both Finance and Security are stakeholders because they consume the same inventory for different outcomes. The key is shared governance: one discovery process, one register, and one set of escalation paths for unmanaged applications.

Technical breakdown

Five-stage SaaS adoption hides applications before governance sees them

The article maps SaaS sprawl as a progression from signup to team adoption, purchase, IT discovery, and only then SSO integration. The important mechanism is timing: most governance systems observe the application after users have already created accounts, shared data, and embedded the tool in workflows. In identity terms, the inventory problem is upstream of the access problem. If an application is absent from discovery, it is absent from review, provisioning, and offboarding logic. That is why both SaaS management and IGA fail together rather than separately.

Practical implication: Build discovery earlier in the adoption chain, not just at integration or procurement stages.

Why access reviews and offboarding miss shadow SaaS applications

Identity governance depends on a complete application register, but SaaS sprawl fragments that register across Okta, finance records, browser usage, and informal team adoption. Access reviews only cover what is in the identity system, so certifications can look complete while large parts of the application estate remain invisible. Offboarding fails for the same reason: revocation workflows only touch known systems. The result is active accounts surviving after employment ends, not because the workflow broke, but because the application never entered the workflow boundary in the first place.

Practical implication: Treat incomplete application inventory as a governance defect, not an execution issue in access review or leaver processing.

SaaS management and IGA are failing the same discovery control

SaaS management and identity governance are often managed as separate disciplines, but this article shows they share one control dependency: early application discovery. Finance sees spend only after a charge appears, while security sees access only after an integration is created. That means duplicate tools, hidden subscriptions, and unmanaged accounts can accumulate in parallel. The article’s central finding is not that one team is behind the other. It is that both teams are blind to the same stage-one adoption event and therefore react to symptoms instead of controlling the source.

Practical implication: Align finance, IT, and IGA discovery signals into one shared application inventory and treat it as a control plane.

Threat narrative

Attacker objective: The underlying risk is not a single attacker but unchecked application adoption that produces hidden spend and ungoverned access at scale.

1. Entry occurs when an employee signs up for a SaaS tool with a corporate email address, often without IT or procurement involvement.
2. Escalation happens as the tool spreads to a team, accumulating accounts and business data outside approved governance workflows.
3. Impact appears when the application is discovered late, leaving duplicate spend, incomplete access reviews, and unreclaimed ex-employee accounts.

Breaches seen in the wild

• Millions of Misconfigured Git Servers Leaking Secrets: Nearly 5 million misconfigured Git servers expose sensitive secrets and credentials online.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Late discovery is the shared failure mode behind SaaS cost waste and identity blind spots. This article shows that finance and security are reacting to the same upstream inventory gap, just at different points in the lifecycle. Traditional SaaS management sees charges too late, while IGA sees applications only after SSO integration. The practitioner conclusion is that discovery timing, not just catalogue quality, determines whether either programme can govern reality.

Application inventory is now an identity control, not just an asset-management artefact. When teams adopt SaaS tools before procurement or SSO, the application itself becomes the missing object in provisioning, access review, and offboarding. That means identity governance cannot be treated as a downstream certification exercise. The control boundary starts at discovery, because everything after that depends on whether the tool is known to the programme.

SaaS sprawl creates governance debt that compounds across finance and IAM. Duplicate tools, trial accounts, and departmental purchases do not stay isolated costs. They also become parallel identity domains with their own users, data, and revocation gaps. The implication for practitioners is that SaaS governance should be measured as a lifecycle problem, not a reconciliation problem. If discovery starts at Stage 5, both cost control and access control are already behind.

Shared discovery is the named concept this article surfaces: the point where finance and identity teams use one application view. Without that shared view, one team sees spend while the other sees access, and neither sees the full operational picture. The practical consequence is that governance must be built around first sighting of the application, not around whichever system happens to catch it last.

Offboarding completeness depends on knowing where the application exists, not just who left. The article’s examples show that leaver workflows are only as strong as the application inventory behind them. Former employees remain a risk when applications live outside the identity system. The practitioner takeaway is that offboarding assurance should be measured against total application exposure, not against the subset already integrated into IAM.

From our research library:

• Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.

What this signals

Shared discovery is now the control point that links SaaS management and identity governance. Once applications are visible only after purchase or SSO integration, both finance and IAM teams inherit cleanup work instead of prevention. For programmes that still separate SaaS inventory from identity inventory, that split is increasingly artificial.

Early application discovery changes the shape of both remediation and assurance. When teams see tools at signup or first team adoption, they can stop duplicate spend before it hardens and can include the same app in provisioning and offboarding workflows before accounts proliferate.

Application visibility should be treated as a lifecycle control. The practical signal for practitioners is whether a new tool can enter spend controls, access reviews, and leaver processes before it becomes embedded. If not, the organisation is managing the symptom rather than the cause.

For practitioners

• Implement stage-one SaaS discovery Add browser, endpoint, CASB, and finance signals so new applications are visible before they become embedded in team workflows.
• Unify finance and identity inventories Reconcile procurement records, expense data, and IdP inventories into one application register that both Finance and IGA teams can use.
• Expand access reviews beyond SSO-connected tools Measure review coverage against the total application estate, not only the systems already integrated into Okta or another identity provider.
• Test offboarding against unknown applications Run leaver scenarios that assume an application was adopted outside governance and verify whether account revocation still works.
• Track duplicate-tool concentration by function Identify where multiple teams are using separate project, design, or collaboration tools so consolidation can be prioritised with evidence.

Key takeaways

• SaaS sprawl creates a single visibility gap that damages both cost control and identity governance.
• Late discovery means access reviews, provisioning, and offboarding all run against an incomplete application estate.
• Earlier discovery shifts teams from reactive cleanup to preventive control over spend and access.

Key terms

• SaaS Sprawl: SaaS sprawl is the uncontrolled spread of software-as-a-service applications across teams and business units. It creates fragmented ownership, duplicated functionality, and weak visibility into who can access what. For IAM and NHI teams, the main risk is not only cost but persistent entitlements that outlive business need.
• Application Discovery: Application discovery is the process of identifying which software and services are actually in use, including unsanctioned or shadow applications. In lifecycle governance, it helps teams align access decisions with the real application estate instead of relying only on a static catalogue.
• Access review coverage: Access review coverage measures how much of the real application estate is actually included in certification workflows. A review can be executed correctly and still fail if it only covers integrated tools, because untracked applications remain outside the decision set and outside accountability.
• Offboarding Completeness: The extent to which departure handling removes access across every connected system, not just the primary directory or SSO layer. Complete offboarding includes revocation, ownership transfer, licence cleanup, and confirmation that no downstream trust remains active.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.