Topic starter
12/06/2026 12:30 am
TL;DR: Lean IT teams managing 20-plus SaaS apps through spreadsheets face delayed offboarding, painful quarterly access reviews, and hidden license waste, as illustrated by ebbo’s Josys case study. The real issue is not just inefficiency but the absence of centralised lifecycle control across apps, licenses, and access ownership.
Editorial analysis by NHI Mgmt Group, based on content published by Josys: “How ebbo™ Reduced Compliance Overhead and Reclaimed Hours of IT Time with Josys”.
By the numbers:
- Josys uncovered $5,000 in unused licenses tied to GitHub and Adobe during the first demo.
Key questions
Q: What breaks when SaaS access reviews rely on spreadsheets?
A: Spreadsheets freeze access data in time, so reviewers work from stale exports while roles, teams, and app usage keep changing.
Q: Why do delayed offboarding processes create security risk?
A: Delayed offboarding creates security risk because access can remain active after the business relationship ends.
Q: How can organisations tell whether SaaS access governance is actually working?
A: They should look for three signals: low numbers of orphaned accounts, consistent entitlement recertification, and rapid revocation when users change roles or leave.
Practitioner guidance
- Implement a single SaaS ownership register Maintain one authoritative view of each application, its business owner, and its access approver so reviews and offboarding do not depend on tribal knowledge.
- Automate offboarding for leavers Trigger deprovisioning workflows from HR or directory events so terminated users lose access across SaaS tools without manual portal-by-portal cleanup.
- Tie access reviews to live entitlement data Use current usage and owner confirmation as the basis for review decisions instead of stale spreadsheet exports and email chains.
Bottom line: Lean SaaS teams do not just lose time to manual admin work. They also lose governance consistency when access reviews and offboarding are spread across spreadsheets and isolated app consoles.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 9:46 am
Centralised lifecycle control is the real control plane for lean SaaS teams. When a two-person IT function has to manage more than twenty SaaS applications through spreadsheets, the governance model itself becomes the bottleneck. The issue is not simply efficiency loss. It is that access, license, and ownership decisions are no longer enforced by one operational system, so every joiner-mover-leaver event becomes a manual exception. Practitioners should treat unified lifecycle control as the baseline, not the optimisation.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between access review and offboarding in SaaS governance?
A: Access review confirms that existing permissions still match business need, while offboarding removes access when the user no longer needs it. Reviews are periodic assurance activities, but offboarding is a lifecycle action. A mature programme needs both, because review without removal leaves stale access in place.
👉 Read our full editorial: SaaS access reviews and offboarding are breaking lean IT teams
This post was modified 1 day ago by NHI Mgmt Group