Notifications
Clear all
Topic starter
10/06/2026 11:50 pm
TL;DR: Unsanctioned SaaS apps increasingly sit outside SSO, IAM, and standard deprovisioning, leaving sensitive data, wasted licenses, and compliance gaps behind, according to 1Password. The core problem is not just discovery, but the fact that traditional identity controls were designed for managed apps, not continuously changing shadow IT.
NHIMG editorial — based on content published by 1Password: Unsanctioned SaaS and shadow IT create hidden access and spend risk
Questions worth separating out
Q: What breaks when SaaS apps are used outside SSO and central IAM?
A: The main failure is lifecycle control.
Q: Why do unsanctioned SaaS apps create both security and cost risk?
A: They create both risks because unmanaged apps can retain sensitive data access while also carrying duplicate or unused licenses.
Q: How do security teams know if SaaS governance is actually working?
A: Look for evidence that discovery is continuous, offboarding reaches unmanaged apps, and renewal decisions reflect live usage.
Practitioner guidance
- Establish continuous SaaS discovery Inventory apps, users, and licenses on an ongoing basis so shadow IT does not depend on periodic manual audits.
- Extend deprovisioning beyond SSO-connected apps Map every offboarding path to the apps where access can persist locally, then verify revocation and license reclamation actually reach those tools.
- Unify security and finance views of SaaS usage Use shared reporting for active accounts, redundant tools, and unused licenses so renewal decisions reflect both risk and spend.
What's in the full article
1Password's full post covers the operational detail this post intentionally leaves for the source:
- How 1Password SaaS Manager continuously discovers unsanctioned apps across the business
- How automated offboarding and license reclamation are handled for apps outside the IdP
- How the product surfaces unused licenses and redundant tools for renewal decisions
- How the workflow connects IT, security, and finance views of SaaS usage
👉 Read 1Password's analysis of unsanctioned SaaS and shadow IT governance →
Shadow SaaS sprawl: what IAM teams are missing in access governance?
Explore further
12/06/2026 6:12 am
Shadow SaaS creates an identity perimeter that the enterprise did not design for. The article shows that modern app adoption now happens faster than traditional provisioning and deprovisioning can follow. That means the governance boundary has moved from the managed application estate to the unmanaged purchase path, where access control, auditing, and ownership are all weaker. Practitioners should treat unsanctioned SaaS as a first-class identity surface, not as a side issue for IT hygiene.
A few things that frame the scale:
- 1 in 4 organisations are already investing in dedicated NHI security capabilities, with an additional 60% planning to do so within the next twelve months, according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities.
A question worth separating out:
Q: What should organisations do first when shadow SaaS keeps appearing?
A: Start with discovery and ownership. Identify which business units are introducing tools, confirm how those apps are provisioned and deprovisioned, and then close the gap between application usage, access removal, and license recovery.
👉 Read our full editorial: Unsanctioned SaaS access exposes a governance gap in IAM controls
