TL;DR: Decentralised SaaS purchasing creates duplicate subscriptions, unused licences, and weaker access governance because departments add tools faster than IT can inventory or review them, according to Zluri. The real issue is not cost alone: unmanaged SaaS expands the identity surface, complicates offboarding, and leaves security teams blind to who still has access.
At a glance
What this is: This is a SaaS subscription management guide that argues fragmented purchasing creates visibility, licensing, and access-control gaps across shadow apps.
Why it matters: It matters because IAM and IGA teams cannot govern access they cannot inventory, and SaaS sprawl turns procurement drift into an identity governance problem.
Context
SaaS subscription management is the discipline of discovering, governing, and optimising software subscriptions across the business. In this article, the underlying issue is not simply overspend; it is that decentralised buying creates shadow apps, duplicated entitlements, and unclear ownership of who still has access.
That matters for identity governance because subscription inventory and access inventory are now the same problem. When departments buy tools independently, joiner-mover-leaver processes, recertification, and offboarding lose coverage across the SaaS estate, leaving teams unable to prove who has active access to which app.
Key questions
Q: What breaks when SaaS subscriptions are managed only by finance or procurement?
A: Access governance breaks because licence ownership is not the same as entitlement ownership. Finance can see spend, but it usually cannot see who has access, who approved it, or whether dormant users and admins were removed when the application stopped being used.
Q: Why do shadow SaaS apps create IAM risk?
A: Shadow SaaS creates IAM risk because access can exist outside approved onboarding, review, and offboarding processes. When business teams adopt apps without central visibility, security teams lose the ability to enforce least privilege, inspect entitlements, or revoke access consistently across the SaaS estate.
Q: How can teams tell whether SaaS subscription management is actually working?
A: It is working when procurement, access, and usage data reconcile cleanly and renewal decisions are based on current entitlement need rather than invoice history alone. If you still discover active users only after a renewal, or if offboarding does not remove access across all SaaS apps, the control is incomplete. The signal is evidence of continuous inventory, not periodic clean-up.
Q: Who should own SaaS governance when finance, IT, and IAM all have a stake?
A: Ownership should be shared, but accountability needs one process owner who can force closure across procurement, access, and lifecycle tasks. Finance can validate spend, IT can confirm technical shutdown, and IAM can verify revocation. Without a single workflow, applications linger and access residue remains.
Technical breakdown
Discovery and inventory fail when SaaS grows department by department
SaaS subscription management begins with discovery, but discovery breaks down when purchasing is decentralised. Each department may create its own subscription, billing record, and admin path, so IT sees invoices without necessarily seeing identities, licences, or actual usage. The technical issue is not just missing software records. It is a fractured control plane where access, billing, and ownership sit in different systems and no single record shows whether a subscription is active, idle, or orphaned.
Practical implication: build a complete SaaS inventory that joins procurement, access, and usage data before licence or entitlement decisions are made.
Access controls and offboarding become inconsistent across shadow apps
The article repeatedly links SaaS sprawl to security vulnerabilities because unmanaged subscriptions can retain active users long after business need has changed. In practice, this is an identity lifecycle failure: the application remains live, the entitlement remains valid, and the organisation has no reliable signal that access should be removed. Where SaaS owners are outside IT, onboarding and renewal are often handled without the same approval, logging, or deprovisioning discipline as core identity systems.
Practical implication: tie SaaS subscription management to joiner-mover-leaver and access review workflows so dormant subscriptions do not preserve dormant access.
Automation helps only when it governs renewals, usage, and compliance together
The article treats automation as the mechanism that makes SaaS management scalable, but automation is only useful when it covers the full lifecycle: discovery, renewal tracking, usage monitoring, and policy enforcement. Point solutions that automate reminders or reports do not solve the governance gap if no one can correlate usage with licences and access rights. The deeper architecture requirement is continuous reconciliation between what was purchased, what is assigned, and what is actually being used.
Practical implication: automate reconciliation between subscription data, entitlement data, and usage data so teams can act before renewals roll over.
Breaches seen in the wild
- SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Shadow app governance is an identity problem before it is a spend problem: decentralised SaaS buying turns access into an unowned asset. Once departments can subscribe independently, the organisation loses a single authority for entitlement review, revocation, and evidence of who should still have access. The result is not just duplicate licences but governance blind spots that outlive the original purchase decision. Practitioners should treat every unmanaged subscription as an unmanaged identity boundary.
Subscription inventory and access inventory must converge: a list of contracts is not a control unless it also tells you which identities are entitled to the service. SaaS environments often separate procurement, admin, and security ownership, which makes renewal decisions blind to access risk. That is why licence optimisation and identity governance cannot be run as separate programmes. Practitioners need one operational view of purchase, assignment, and usage.
Identity surface sprawl: the most useful concept in this article is that every unsanctioned or loosely governed SaaS app expands the organisation's identity surface, not just its application count. Each added app introduces another set of admins, tokens, users, and offboarding obligations. In NHI terms, this is the same governance pattern seen in sprawl elsewhere: more assets, weaker ownership, and a larger gap between access granted and access actually needed. Practitioners should measure SaaS growth as an identity exposure metric, not a software catalogue metric.
Lifecycle governance is the only durable answer to SaaS sprawl: renewal reminders, dashboards, and cost reports help, but they do not replace ownership discipline. The article shows that the hard part is keeping access aligned with business need as subscriptions change hands across departments. That is an IAM and IGA problem with procurement symptoms, not the other way around. Practitioners should anchor SaaS management to lifecycle controls, not periodic clean-up exercises.
From our research library:
- The average enterprise SaaS platform connects to 42 or more third-party applications through OAuth tokens, API keys, webhooks and automation platforms.
What this signals
SaaS subscription management is becoming an identity governance discipline, not a simple software cost exercise. When departments can create apps without central oversight, the programme needs one view of procurement, entitlement assignment, and offboarding or the identity surface will keep expanding.
Identity surface sprawl: every unmanaged SaaS application adds another access boundary, another admin path, and another lifecycle obligation. That shifts the governance question from how to reduce spend to how to maintain control over access across tools that were never designed to share a common identity model.
For practitioners
- Build a unified SaaS inventory Connect procurement records, admin ownership, user assignments, and usage telemetry so each subscription can be evaluated in one place.
- Align SaaS renewals to access review Require a review of active users and business ownership before any renewal is approved, especially where departments bought the app outside central IT.
- Revoke orphaned access on a schedule Remove access for dormant subscriptions, departed staff, and unused licences as part of the normal offboarding and recertification cycle.
- Separate sanctioned from shadow apps Classify applications by ownership and approval status so security teams can prioritise the tools with no central governance or lifecycle control.
Key takeaways
- Decentralised SaaS buying creates governance blind spots because no single team can reliably connect subscriptions, user access, and renewals.
- The operational risk is broader than overspend, because shadow apps can preserve access long after the business need has ended.
- SaaS subscription management has to converge with identity lifecycle controls if organisations want to govern access across a fragmented SaaS estate.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Unmanaged SaaS subscriptions keep access alive after business need changes. |
| NHI-05 — Overprivileged NHI | Decentralised app ownership often leaves admins and users with more access than necessary. | |
| Recommendation — Tie SaaS offboarding to subscription ownership so dormant access is removed when the app is no longer needed. Review SaaS entitlements for excess privileges and remove broad admin access that outlives the use case. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about governing who can still access SaaS applications. |
| Recommendation — Reconcile SaaS entitlements against active business need and revoke access that is no longer authorised. | ||
| CIS Controls v8 | CIS-5 — Account Management | SaaS sprawl creates account lifecycle and ownership problems across many applications. |
| Recommendation — Centralise account lifecycle management so SaaS users and admins are provisioned and removed consistently. | ||
| MITRE ATT&CK | TA0006; TA0040 — Credential Access; Impact | Shadow SaaS access can be abused to retain credentials and widen downstream impact. |
| Recommendation — Map unmanaged SaaS access to credential exposure paths and prioritise controls that reduce persistence and blast radius. | ||
Key terms
- SaaS Subscription Management: The practice of discovering, controlling, and optimising software subscriptions across an organisation. It combines procurement, licence usage, access governance, renewal tracking, and offboarding so subscription decisions reflect both business need and security responsibility.
- Shadow app: A shadow app is an OAuth or GitHub App that exists in the environment without clear ownership or active oversight. These integrations are risky because they can retain broad permissions quietly, making it hard to judge whether the access is still needed or still appropriate.
- Identity Surface: The identity surface is the full set of credentials, tokens, tool permissions, and delegated identities an AI agent can use during execution. It matters because agents often do not operate through a single account, and partial visibility into that surface creates false confidence about control coverage.
- Entitlement review: A governance process that checks whether users, service accounts or systems still need their access. For modern identity programmes, the limitation is timing: if reviews happen too late or too rarely, access may already have been misused before the review occurs.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 11, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org