SaaS visibility and offboarding gaps still create hidden identity risk

At a glance

What this is: This is a SaaS governance case study showing that limited visibility, manual spreadsheets, and delayed offboarding left hidden access and waste in OnLoop's application estate.

Why it matters: It matters because IAM teams need reliable control over SaaS access, ownership, and leaver removal before shadow apps and stale accounts turn into audit and security gaps.

Context

SaaS visibility is the control problem here: if teams cannot see which applications are in use, they cannot govern who has access, who owns the license, or when access should end. In fast-moving environments, spreadsheet tracking tends to lag reality almost immediately, which makes offboarding and audit preparation harder at the same time.

For IAM and governance teams, the issue is not just software sprawl. It is lifecycle control over human access to business applications, including joiner, mover, and leaver handling, ownership assignment, and evidence for compliance reviews. When those controls are manual, hidden SaaS usage becomes hidden identity risk.

Key questions

Q: How do teams replace spreadsheet-based SaaS tracking with governed visibility?

A: Teams need automated discovery, ownership assignment, and entitlement reconciliation so the application inventory reflects current access rather than a stale manual record. The goal is not just listing apps, but proving who uses them, who owns them, and whether each one is approved. That gives IAM teams a control base for access reviews, offboarding, and audit evidence.

Q: Why do delayed offboarding processes create security risk?

A: Delayed offboarding creates security risk because access can remain active after the business relationship ends. Former users may still reach email, files, CRM, or admin tools, which expands the window for data theft or disruption. The issue is not the departure itself, but the period during which stale access still works.

Q: What are the signs that SaaS app permission governance is failing?

A: Common warning signs include users approving apps outside policy, security teams lacking visibility into permission changes, and integrations with broad access that no one can explain. If administrators cannot see app security settings or changes are not reviewed promptly, the organisation is operating with blind spots that attackers can exploit through consent phishing or existing integrations.

Q: What does strong SaaS identity governance change for compliance teams?

A: It turns audit prep from a manual chase into a repeatable evidence process. Compliance teams can answer questions faster when entitlement data, ownership, and offboarding history come from governed systems rather than spreadsheets. That reduces rework, lowers the chance of inconsistent evidence, and makes access control decisions easier to defend.

Technical breakdown

Why spreadsheet-based SaaS tracking fails

Spreadsheets are static records in a dynamic environment. They can list applications, users, and licenses, but they do not continuously reconcile usage, ownership, or access state. That means the record is already stale the moment a team updates it, especially when employees experiment with new tools or departments buy apps outside central oversight. In identity terms, the organisation loses inventory confidence before it loses control, and that gap widens as the SaaS estate grows.

Practical implication: move from manual tracking to automated SaaS discovery and reconciliation so inventory reflects actual access.

How delayed offboarding creates residual access

Offboarding is a lifecycle control, not an administrative afterthought. If a leaver or contractor retains access after departure, the organisation keeps an unnecessary trust relationship alive across collaboration, productivity, and data-sharing systems. In SaaS environments, this risk is amplified by federated login, shared team spaces, and app-specific permissions that do not disappear when HR records change. The key failure is persistence of access after accountability has ended, which is an avoidable governance gap.

Practical implication: tie leaver workflows to SaaS revocation events so access is removed when employment or contract status changes.

Why audit readiness depends on ownership and evidence

SOC 2 readiness is difficult when nobody can quickly prove who has access, which tools are approved, or whether unused licenses are being reclaimed. Compliance evidence becomes a manual chase across IT, Finance, and business owners, and that slows response when auditors ask for access history or control proof. The technical issue is not only evidence collection, but the absence of authoritative system-of-record data for software entitlements and ownership.

Practical implication: maintain authoritative app ownership and entitlement records so audit evidence can be produced without spreadsheet reconstruction.

Threat narrative

Attacker objective: The practical objective is to preserve access, reduce detection, or exploit blind spots created by unmanaged SaaS accounts and stale entitlements.

1. Entry occurs through unmanaged SaaS adoption, where teams add apps faster than central inventory can track them.
2. Credential and access exposure follows when offboarding lags and former contractors or users keep valid access to business systems.
3. Impact appears as hidden access risk, unused license spend, and slower compliance preparation because no one has a reliable control view.

Breaches seen in the wild

• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
• Klue OAuth Supply Chain Breach: OAuth tokens compromised in Klue integration breach affecting 700+ organisations via Salesforce data access chain.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Hidden SaaS is an identity governance problem before it is a software inventory problem: The article shows that OnLoop's core issue was not simply tool sprawl, but the absence of a trustworthy record of who had access to what. That kind of gap breaks joiner, mover, and leaver governance because the organisation cannot enforce lifecycle decisions against assets it cannot see. The practitioner conclusion is straightforward: SaaS discovery belongs inside identity governance, not as a separate housekeeping task.

Spreadsheets create a control lag that scale quickly outgrows: Manual tracking can work briefly in a small startup, but it fails as soon as tool adoption becomes decentralised. Every manual update adds delay between real-world change and governance action, which is exactly when stale access and forgotten apps accumulate. The field lesson is that governance quality depends on continuous reconciliation, not periodic clean-up.

Automated offboarding is the minimum viable control for SaaS lifecycle risk: The article makes clear that leaver access is where hidden risk becomes actionable risk. When access revocation depends on memory or follow-up, former users can remain inside collaboration and business systems long after accountability has ended. The implication for practitioners is that offboarding must be event-driven and authoritative, not a best-effort checklist.

Audit readiness exposes whether identity governance is real or performative: SOC 2 preparation in the article is not presented as a paperwork exercise, but as a stress test for control quality. If access records, ownership, and entitlement history cannot be produced quickly, then the programme is relying on manual reconstruction rather than governed evidence. The conclusion is that audit readiness is a by-product of operational identity discipline, not a separate compliance workflow.

SaaS visibility and offboarding debt is a measurable identity blast radius: Once teams lose sight of applications, they also lose sight of who can act inside them, who owns them, and how quickly access can be removed. That expands the blast radius of everyday mistakes such as forgotten apps, lingering contractors, and unowned licenses. Practitioners should treat visibility debt as a governance exposure that widens until discovery and offboarding are automated.

From our research library:

• 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
• Read next: Identity Visibility and Intelligence Platforms (IVIP) Guide

What this signals

Visibility debt becomes governance debt: When SaaS inventory is incomplete, teams do not just miss unused apps. They also lose the ability to prove ownership, review access, and remove entitlements with confidence. That makes identity governance dependent on reconstruction rather than control.

Access review and offboarding need the same source of truth: If leaver workflows, license ownership, and application inventory live in different spreadsheets, each process breaks in a different way. Automated reconciliation is what keeps access decisions aligned with actual usage, not with outdated records.

Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs. The same visibility gap shows up in SaaS estates when teams cannot reliably tell which accounts, apps, and licenses still matter.

For practitioners

• Implement continuous SaaS discovery Build an authoritative inventory of applications, users, and license state so shadow apps and unsanctioned tools are surfaced without relying on spreadsheets.
• Automate leaver offboarding workflows Connect offboarding to identity and application revocation so former employees and contractors lose access on schedule rather than after manual follow-up.
• Assign clear application ownership Require every SaaS app and license pool to have a named business or IT owner who can attest to access, usage, and renewal decisions.
• Prepare SOC 2 evidence from system records Use governed entitlement and access logs as the source of truth for audit responses instead of reconstructing history from ad hoc spreadsheets.

Key takeaways

• The core risk is not SaaS sprawl alone, but the governance blind spots it creates around access, ownership, and removal.
• The article shows that manual spreadsheets quickly become stale, which leaves offboarding lagging and audit prep reactive.
• Automated discovery and event-driven revocation are the controls that most directly reduce hidden identity risk in SaaS environments.

Key terms

• SaaS Discovery: SaaS discovery is the process of identifying all sanctioned and unsanctioned software-as-a-service applications in use across the organisation. It matters because cloud assurance increasingly depends on seeing where apps share data, what permissions they hold, and which identities can reach them.
• Offboarding Workflow Automation: Offboarding workflow automation uses systems and rules to coordinate termination tasks across HR, IT, and security. It can trigger notifications, revoke access, track progress, and record evidence without relying on manual follow-up. The goal is consistent execution, faster completion, and stronger compliance documentation across every employee exit.
• License Assignment: License assignment is the process of attaching an Office 365 service plan to a user account so the user can access enabled features. It depends on the account being created correctly and on usage location being set, because licensing determines which services are activated and whether the tenant can allocate subscriptions properly.
• Audit-Ready Evidence: Audit-ready evidence is access proof that can be retrieved directly from the control system without manual reconstruction. It should show who approved access, what policy they used, when the decision occurred, and whether any exceptions or compensating controls were applied.

Deepen your knowledge

NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.