Topic starter
10/06/2026 9:12 pm
TL;DR: Shadow IT grows when employees buy SaaS outside IT, leaving no reliable visibility into app use, access, or offboarding, according to Zluri’s analysis of discovery and SaaS management tools. The governance problem is not just software sprawl, but unmanaged identity sprawl across apps, licenses, and entitlements.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “6 Tools for Eliminating Shadow IT that Actually Works”.
Key questions
Q: What breaks when shadow IT sits outside identity governance controls?
A: Access reviews, offboarding, and privileged approval workflows lose reliability when shadow IT is outside the system of record.
Q: Why do shadow IT apps create identity and spend risk at the same time?
A: Shadow IT creates two problems at once.
Q: How do teams know when SaaS discovery is producing actionable results?
A: They should look for a catalog that is both broad and clean, with accepted applications carrying enough metadata to support policy and licensing actions.
Practitioner guidance
- Link SaaS discovery to authoritative identity sources Correlate SSO, identity provider, finance, and direct app integration signals so discovered applications are tied to named users and access state.
- Build offboarding around discovered SaaS accounts Make deprovisioning a required output of discovery so a departing user cannot keep access to unsanctioned or forgotten SaaS services.
- Reconcile licenses against real usage and access Compare allocated licenses, active logins, and permission tiers to find abandoned subscriptions, unused seats, and overbroad access.
Bottom line: Shadow IT becomes dangerous when SaaS usage escapes identity governance, because access and offboarding cannot be reliably enforced across the estate.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
10/06/2026 10:02 pm
Shadow IT is fundamentally a SaaS identity governance failure, not a discovery failure. Discovery matters, but only because it is the entry point to governing access, entitlements, and lifecycle state across SaaS applications. If the organisation can inventory apps but cannot connect them to identities and offboarding, the core control problem remains unresolved. Practitioners should treat discovery as the first step in SaaS governance, not the endpoint.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should organisations do when shadow IT is already widespread across departments?
A: When shadow IT is widespread, organisations should establish a governance framework that defines approved software, procurement rules, usage expectations, and decommissioning steps. They should pair that policy with continuous discovery, employee education, and centralised SaaS management so shadow usage can be reduced without blocking legitimate productivity needs.
👉 Read our full editorial: Shadow IT discovery is really a SaaS identity governance problem
This post was modified 4 days ago by NHI Mgmt Group