Notifications
Clear all
Topic starter
12/06/2026 12:27 am
TL;DR: Enterprise SaaS is expanding toward 85% of software spend, while shadow IT already accounts for 29% of IT security concerns, according to JumpCloud. The practical shift is that SaaS management now functions as identity governance for apps, accounts, and access, not just license cleanup.
NHIMG editorial — based on content published by JumpCloud: best SaaS management platforms for IT teams
By the numbers:
- SaaS adoption is at an all-time high, with almost 85% of all enterprise software expected to be SaaS applications.
- Shadow IT accounts for 29% of IT security concerns.
Questions worth separating out
Q: How should security teams govern SaaS apps that employees adopt outside IT approval?
A: Start by treating SaaS adoption as an identity event, not just an application event.
Q: Why do SaaS sprawl and shadow IT create identity risk?
A: Because every unsanctioned app can introduce an unsanctioned account, OAuth grant, or personal login path.
Q: How can teams tell whether SaaS access control is actually working?
A: Look for evidence that unapproved apps are being detected, personal accounts are being flagged, and former-employee access is being removed during offboarding.
Practitioner guidance
- Map discovery sources to one identity control owner Assign browser, connector, SSO, and OAuth discovery outputs to a named control owner so unidentified applications do not drift between IT, IAM, and security teams.
- Block personal-account access for sanctioned SaaS Detect non-corporate login patterns and force reauthentication or denial when users attempt to access approved applications with personal email addresses.
- Tie offboarding to SaaS account revocation Make deprovisioning a required step in joiner-mover-leaver workflows so former employees, shared accounts, and unused licences are removed together.
What's in the full article
JumpCloud's full guide covers the operational detail this post intentionally leaves for the source:
- Platform-by-platform comparison tables showing discovery methods, account insights, and license management coverage.
- Vendor-specific notes on where each tool leans toward security enforcement, cost optimisation, or workflow automation.
- Implementation detail on warning and blocking controls for unapproved apps.
- Practical examples of how JumpCloud ties identities, devices, and SaaS accounts together.
👉 Read JumpCloud's guide to the best SaaS management platforms for IT teams →
SaaS sprawl and access control: what IAM teams need to act on?
Explore further
25/06/2026 2:38 am
SaaS management is now a control plane problem, not a tooling niche. Once enterprises run most software through SaaS, discovery and access enforcement become core identity functions rather than optional optimisation layers. The guide shows that app visibility, user-account matching, and blocking logic sit on the same governance path as IAM. Practitioners should therefore treat SaaS management as part of the identity operating model, not a separate software category.
A few things that frame the scale:
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
A question worth separating out:
Q: What is the difference between SaaS management and IAM?
A: IAM governs identities and access decisions across systems, while SaaS management focuses on discovering, governing, and optimising cloud applications in use. In practice, the two overlap when SaaS platforms enforce app access, tie accounts to identities, and support lifecycle controls.
👉 Read our full editorial: SaaS management now sits inside identity governance, not beside it
