TL;DR: Manual SaaS tracking works only for very small environments, but spreadsheet-based records quickly become inaccurate as app counts, ownership, renewals, and license details grow, according to Zluri. The governance gap is that spreadsheets cannot surface unapproved apps or automate discovery, so visibility and control fall behind business growth.
At a glance
What this is: This article argues that spreadsheet SaaS trackers stop being dependable once app sprawl, ownership, and renewal data expand beyond a very small environment.
Why it matters: IAM and IGA teams need a governed SaaS inventory because manual records cannot reliably support access oversight, app approval checks, or renewal control at scale.
Context
Spreadsheet SaaS tracking is a manual inventory problem: one person or team tries to keep ownership, renewals, licenses, and spend current in a file that does not update itself. Zluri argues that this approach can work for very small environments, but it becomes fragile as employee counts and application counts rise.
The governance gap is not just administrative effort. When the record of SaaS apps is incomplete or stale, IT and security teams lose a dependable view of what is approved, who owns it, and where commercial or compliance risk is accumulating.
Key questions
Q: When does spreadsheet SaaS tracking stop being reliable?
A: It stops being reliable when the environment is large or dynamic enough that ownership, renewals, and licenses change faster than people can update the file. At that point, the spreadsheet becomes a lagging record, not an operating control, and teams need discovery and workflow-based governance instead of manual maintenance.
Q: Why do shadow SaaS apps create IAM risk?
A: Shadow SaaS creates IAM risk because access can exist outside approved onboarding, review, and offboarding processes. When business teams adopt apps without central visibility, security teams lose the ability to enforce least privilege, inspect entitlements, or revoke access consistently across the SaaS estate.
Q: What are the biggest mistakes teams make with SaaS app tracking?
A: The biggest mistakes are treating a spreadsheet as a live system of record, failing to assign accountable app ownership, and relying on manual updates for renewals and license changes. Those mistakes turn routine administration into control drift, because the inventory no longer matches the actual SaaS estate.
Q: How should security teams control SaaS renewals without losing visibility across departments?
A: Security teams should treat renewals as a shared governance checkpoint, not a finance-only event. Build one inventory that connects application ownership, usage, invoice data, and contract terms, then require a named approver before any renewal continues. That approach reduces uncontrolled spend and keeps access-bearing services from persisting without review.
Technical breakdown
Why spreadsheet inventories drift out of date
A spreadsheet is a static record, while SaaS estates are dynamic. New subscriptions appear outside normal procurement paths, owners change, renewals move, licenses are upgraded or abandoned, and departments add tools without central coordination. Because the file does not reconcile itself with live identity, spend, or access data, the inventory quickly becomes a lagging approximation rather than an authoritative system of record.
Practical implication: Use a live inventory source for SaaS discovery instead of treating a spreadsheet as the control plane.
Why unapproved apps create governance blind spots
The article highlights a core limitation of spreadsheet tracking: it cannot identify unapproved apps in use across the business. That matters because shadow SaaS creates both security exposure and compliance uncertainty. If the app is invisible, it is also difficult to assess whether it has the right owner, whether data is being handled appropriately, or whether access should be removed when the business need ends.
Practical implication: Tie SaaS inventory to discovery inputs from identity, finance, and endpoint activity so unknown apps are surfaced instead of inferred.
What app sprawl does to renewal and license control
As the number of apps grows, the operational burden is no longer simple record keeping. Teams must track subscription costs, renewal dates, app ownership, and department category across many services, and manual entry makes errors more likely. In practice, that means renewal decisions are made from stale data, duplicate or abandoned licenses persist, and spend control becomes reactive rather than governed.
Practical implication: Consolidate renewal, ownership, and license data into a managed workflow that can be reviewed before contracts and entitlements renew.
Breaches seen in the wild
- SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Spreadsheet tracking is a temporary control, not a governance system: it can document SaaS usage only while the environment is small enough for manual upkeep to stay current. Once app sprawl accelerates, the record stops being authoritative and starts lagging the estate. The practical conclusion is that SaaS governance needs discovery and ownership controls, not just documentation.
Shadow SaaS is the real failure mode here: a spreadsheet cannot reveal what it cannot see, which means unapproved applications remain outside review until an incident or audit exposes them. That is a visibility problem with direct IAM consequences, because access, ownership, and vendor risk all depend on knowing the application actually exists.
SaaS lifecycle governance belongs in the identity programme: app ownership, renewals, license status, and approval state are not separate admin tasks, they are part of the same governance chain that IAM and IGA teams already manage for access. When those records are maintained manually, the programme inherits stale data as a structural weakness.
App sprawl turns small-data discipline into control debt: the longer a spreadsheet survives as the primary SaaS record, the more hidden cleanup work accumulates in approvals, renewals, and license reconciliation. That debt eventually shows up as missed renewals, duplicate spend, and unmanaged applications, so practitioners should treat manual tracking as a transition state, not an operating model.
From our research library:
- The average enterprise SaaS platform connects to 42 or more third-party applications through OAuth tokens, API keys, webhooks and automation platforms.
What this signals
Control debt builds quickly when SaaS governance depends on manual entry: every new app, owner change, and renewal date adds another point where the spreadsheet can fall behind the environment. For IAM and IGA teams, the signal is clear: governance needs to shift from record keeping to live discovery and accountable ownership before the inventory becomes untrustworthy.
App sprawl is not just a finance issue, it is an identity governance issue: once the number of SaaS tools grows beyond what teams can manually reconcile, approval state and ownership become the controls that matter most. Practitioners should expect shadow apps, duplicate subscriptions, and stale renewals to surface whenever those controls are not embedded in the operating model.
For practitioners
- Establish a governed SaaS inventory Create a single source of truth for SaaS ownership, renewal dates, license counts, and department mapping so the record can be reviewed as part of normal governance.
- Add discovery inputs beyond manual entry Feed SaaS records from SSO, finance, and endpoint signals so new applications are surfaced even when no one updates the spreadsheet.
- Assign an accountable owner for every app Require every SaaS record to have a business owner, a technical owner, and a renewal owner so accountability does not disappear as the estate grows.
- Review unapproved and duplicate apps on a schedule Use regular governance reviews to remove abandoned tools, rationalise duplicate subscriptions, and validate whether each app still has a business purpose.
- Move renewal decisions off static spreadsheets Track contract dates and license usage in a workflow that supports pre-renewal review, because stale rows are a common source of overspend and missed control points.
Key takeaways
- Spreadsheet-based SaaS tracking fails when the environment grows faster than manual updates can keep up.
- The core risk is not only overspend, but also invisible apps, unclear ownership, and stale renewal decisions.
- Practitioners need discovery-fed inventory and accountable ownership if they want SaaS governance to remain reliable.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CSA Cloud Controls Matrix, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | SaaS inventory and ownership are identity governance concerns in cloud services. |
| Recommendation — Map SaaS ownership and approval state to IAM governance and keep the inventory continuously reconciled. | ||
| NIST CSF 2.0 | ID.AM-01 — Asset Inventory | The article is fundamentally about maintaining an accurate application inventory as the estate grows. |
| Recommendation — Maintain a live inventory of SaaS assets and reconcile it against discovery sources on a regular cadence. | ||
| CIS Controls v8 | CIS-5 — Account Management | Renewals, ownership, and app access all depend on accountable account and application management. |
| Recommendation — Assign accountable owners for SaaS applications and review them before renewals and access changes. | ||
Key terms
- SaaS Inventory: A SaaS inventory is the authoritative record of which cloud applications an organisation uses, who owns them, and how they are accessed. In mature governance, it is more than a list because it supports renewal, certification, offboarding, and security review decisions.
- Shadow SaaS: Shadow SaaS is the set of unauthorised or unreviewed software-as-a-service tools used outside central security governance. These applications often bypass normal identity controls, making them difficult to inventory, monitor, and harden against credential-based abuse.
- Control Debt: Control debt is the accumulation of weak, custom, or poorly owned security decisions that make future governance harder. In identity programmes, it appears when exceptions, one-off workflows, and legacy process assumptions become embedded in the access model and are expensive to unwind later.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 11, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org