Topic starter
12/06/2026 9:59 pm
TL;DR: Clearer governance over shadow users, offboarding, and app sprawl is the practical shift as Josys’ March 2026 release unifies SaaS reporting, device visibility, action prioritisation, and workflow automation across discovered apps, MDM sources, and lifecycle triggers, with new RBAC controls and exportable reports for IT teams, rather than just more automation.
Editorial analysis by NHI Mgmt Group, based on content published by Josys: “Product Release Newsletter: March 2026”.
Key questions
Q: What breaks when SaaS discovery is not connected to governance workflows?
A: Discovery becomes reporting instead of control.
Q: Why do shadow users and unused licences become access risks as well as cost issues?
A: Because they often signal accounts or applications that still exist outside normal lifecycle control.
Q: How should teams decide which SaaS workflows to automate first?
A: Start with repetitive, high-volume, and time-sensitive workflows that create the most manual bottlenecks, especially app requests, renewals, and joiner-mover-leaver steps.
Practitioner guidance
- Consolidate SaaS, device, and license evidence Build a single operating view that links app discovery, license usage, security context, and device ownership before decisions are routed to remediation.
- Classify discovered apps before automation fires Require a policy decision on usage, risk, or compliance status before discovered-app workflows are allowed to trigger tickets, messages, or API actions.
- Prioritise shadow accounts and stale entitlements Use the action queue to separate high-risk access problems from low-value administrative work, then remove dormant accounts and unused licences through the same governance process.
Bottom line: SaaS governance weakens when discovery, classification, and action sit in separate systems.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
13/06/2026 12:28 am
Workflow timing is now a governance control, not an implementation detail. When onboarding, offboarding, and licence optimisation can run before, on, after, or at a precise time, the control surface shifts from review cadence to event alignment. That matters because governance failures in SaaS often come from delayed action rather than absent policy. Practitioners should treat execution timing as part of access governance design, not as a convenience setting.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: How should security teams govern workflow automation in SaaS-heavy environments?
A: Security teams should treat workflow automation as part of the identity control plane, not as a separate operations layer. Every automated step that assigns, renews, monitors, or revokes access should have an owner, evidence trail, and exception path. Without that structure, automation scales the wrong decision as efficiently as the right one.
👉 Read our full editorial: Josys March release tightens SaaS governance and workflow control