Notifications
Clear all
Topic starter
23/06/2026 9:21 pm
TL;DR: Manual SaaS access approvals slow IT teams, create bottlenecks, and leave room for inconsistent review, while self-service and automated workflows can improve speed and visibility according to Zluri. The governance issue is not request volume itself, but whether approval logic is tied to policy, inventory, and lifecycle controls.
NHIMG editorial — based on content published by Zluri: Lifecycle Management How To Optimize User Access Requests & Approvals for SaaS Tools
Questions worth separating out
Q: How should security teams streamline SaaS access requests without weakening governance?
A: Use self-service for standard requests, but keep the decision logic anchored in role, ownership, and policy data.
Q: When does automated access approval create more risk than it reduces?
A: Automation becomes risky when approval rules are based on weak identity data, stale role definitions, or incomplete SaaS inventory.
Q: What do IAM teams get wrong about self-serve access portals?
A: They often treat the portal as the control, when it is only the user interface.
Practitioner guidance
- Map request types to entitlement classes Separate routine SaaS access from privileged, regulated, or exception-based requests so each path has a different approval rule and review owner.
- Bind approvals to authoritative identity data Use role, department, application ownership, and seniority attributes as the inputs to approval logic instead of relying on free-text justification.
- Create a pre-approved application catalogue Limit self-serve requests to applications that have already been reviewed for policy fit, ownership, and baseline risk.
What's in the full article
Zluri's full article covers the operational detail this post intentionally leaves for the source:
- The exact self-serve employee app-store workflow for requesting SaaS access.
- The approval-routing model that uses roles and seniority to trigger decisions.
- The way desktop and browser agent status is exposed to support access operations.
- The procurement and SaaS buying workflow for apps that are not already in the catalogue.
👉 Read Zluri's article on optimising SaaS access requests and approvals →
SaaS access requests and approvals: where IAM teams still lose time?
Explore further
25/06/2026 2:37 am
Self-service access only improves governance when the underlying entitlement model is already controlled. The article correctly shows that employee-facing request portals can reduce ticket volume, but the governance value comes from the policy layer behind the portal. If approved apps, approver roles, and request conditions are not grounded in authoritative identity data, self-service simply moves manual error into a faster interface. Practitioners should treat the portal as an execution surface, not the control itself.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to Ultimate Guide to NHIs.
- 92% of organisations expose NHIs to third parties, which means access governance increasingly extends beyond employee workflows into supplier-controlled identity paths.
A question worth separating out:
Q: How do organisations know if access request automation is actually working?
A: Look for shorter fulfilment times, fewer manual escalations, and fewer approvals that later need correction. Good automation should also improve traceability by showing who approved what, under which rule, and whether the access remains appropriate over time.
👉 Read our full editorial: Self-serve SaaS access requests still need stronger identity controls
