Notifications
Clear all
Topic starter
10/06/2026 9:11 pm
TL;DR: SaaS user management centralises onboarding, permissions, offboarding, and usage visibility across apps, but the guide also shows why spreadsheet-based administration becomes error-prone as environments scale and SaaS sprawl grows, according to Zluri. The governance problem is not the absence of tooling alone, but the lack of durable identity lifecycle control across human and non-human access paths.
NHIMG editorial — based on content published by Zluri: SaaS Management SaaS User Management: A Comprehensive Guide for 2026
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
Questions worth separating out
Q: How should security teams manage SaaS user access across multiple applications?
A: They should treat SaaS access as a governed lifecycle problem, not a collection of app-by-app admin tasks.
Q: Why do SaaS environments increase identity and access risk?
A: SaaS environments multiply access points, admin consoles, and permission models, which makes it easy for access to drift away from business need.
Q: What breaks when SaaS offboarding is handled manually?
A: Manual offboarding usually breaks because it depends on people remembering every application, integration, and delegated account that needs removal.
Practitioner guidance
- Replace spreadsheet registers with a system of record Tie SaaS account ownership, role assignment, and de-provisioning to a governed source of truth so the same record drives provisioning, recertification, and revocation across all applications.
- Map SaaS permissions to standard roles and attributes Define a limited role catalogue and attribute policy set so application permissions can be reviewed consistently instead of being recreated manually in each app admin console.
- Automate offboarding from authoritative lifecycle events Trigger access removal from HR or identity change events, then reconcile app-level accounts and integration credentials to catch orphaned access that manual workflows miss.
What's in the full article
Zluri's full guide covers the operational detail this post intentionally leaves for the source:
- Step-by-step SaaS user management workflow examples for onboarding, permission changes, and de-provisioning
- Operational guidance on dashboard-based app inventory and license usage tracking
- Examples of self-service account management and support deflection patterns
- Vendor-side discussion of scaling user records across larger SaaS estates
👉 Read Zluri's guide to SaaS user management for access and lifecycle control →
SaaS user management and access sprawl: what teams are missing?
Explore further
10/06/2026 10:02 pm
Spreadsheet governance is not SaaS user management, it is access debt. The article’s central promise is centralisation, but the real failure mode is that manual records cannot keep pace with app proliferation, role churn, and offboarding. Once access records live in spreadsheets, the organisation loses assurance that permissions, ownership, and removal events are synchronized. Practitioners should treat every manual access register as unresolved governance debt.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
A question worth separating out:
Q: How can organisations tell whether SaaS access governance is actually working?
A: They should look for three signals: low numbers of orphaned accounts, consistent entitlement recertification, and rapid revocation when users change roles or leave. If access remains valid across apps after a lifecycle event, governance is not working even if dashboards look complete.
👉 Read our full editorial: SaaS user management exposes the limits of spreadsheet governance
