Topic starter
11/06/2026 10:59 pm
TL;DR: Shadow apps, access requests, over-privileged users, and audit pressure are converging into a visibility and control problem across SaaS estates, with Gartner’s 2025 SaaS Management Platforms recognition for Zluri underscoring the issue according to Zluri; the real issue is not just SaaS sprawl but the identity surface it creates for human, machine, and lifecycle governance.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “Zluri Recognized as a Leader in the 2025 Gartner® Magic Quadrant™ for SaaS Management Platforms”.
Key questions
Q: What breaks when SaaS renewals are handled without identity context?
A: Renewal decisions become detached from whether the app is still in use, who owns it and whether stale accounts remain.
Q: Why do shadow apps create IAM and IGA risk instead of just inventory noise?
A: Shadow apps create IAM and IGA risk because they introduce unmanaged entitlement paths outside normal onboarding, review, and offboarding controls.
Q: How should teams prioritise SaaS governance when audits and access requests are both growing?
A: Teams should prioritise the control that links access requests, usage evidence, and offboarding into one lifecycle view.
Practitioner guidance
- Map SaaS discovery to entitlement ownership Build a single inventory that links each application to its owning team, access model, and offboarding path so discovery becomes governance input rather than a spreadsheet.
- Rework access reviews around usage evidence Require usage, business owner, and role context before certification so reviewers are not asked to approve stale or inherited access blindly.
- Close joiner-mover-leaver gaps across SaaS Tie onboarding, role changes, and leaver processing to the applications that hold productive access so revocation happens from the authoritative record, not from memory.
Bottom line: SaaS management becomes an identity governance issue when access, ownership, and offboarding are no longer visible across the full application estate.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/06/2026 7:27 am
Identity sprawl is the real SaaS risk, not application count. The article is strongest when it shifts the discussion from shadow IT to access governance, because unmanaged applications become dangerous only when identities accumulate without clear ownership or review. That is an IAM and IGA problem first, and a software-management problem second. Practitioners should evaluate SaaS control by how quickly they can answer who has access, why, and whether it still belongs.
A few things that frame the scale:
- The average enterprise SaaS platform connects to 42 or more third-party applications through OAuth tokens, API keys, webhooks and automation platforms.
A question worth separating out:
Q: What is the difference between SaaS configuration and SaaS governance?
A: SaaS configuration is the on or off state of a feature. SaaS governance is the policy, ownership, monitoring, and cleanup process that determines whether the feature can be used safely. A disabled setting may reduce exposure, but only governance ensures identities, content, and exceptions are managed over time.
👉 Read our full editorial: Gartner’s SaaS management recognition spotlights identity sprawl risk