Topic starter
12/06/2026 12:50 am
TL;DR: SaaS sprawl, poor utilisation, and inconsistent offboarding create operational, compliance, and security risk across discovery, onboarding, training, promotion, and retirement, according to Zluri. The underlying issue is not tooling alone but governance discipline: who owns each app, who can access it, and how unused software is removed safely.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “Do You Know Your SaaS Stack?”.
By the numbers:
- About 35% of SaaS spend is not utilized optimally, according to the article.
Key questions
Q: What breaks when SaaS access is not tied to lifecycle controls?
A: Access persists after the business need has ended, which means former employees, stale integrations, and unused permissions can still reach data.
Q: Why do unused SaaS apps still create security risk after renewal is cancelled?
A: Unused apps often retain admin roles, OAuth grants, API keys, or embedded integrations even after business use declines.
Q: What are the signs that SaaS lifecycle management is failing?
A: Common warning signs include dormant accounts that still authenticate, old API or OAuth tokens that remain valid, external shares that no one owns, and privileged apps that have not been reviewed for a long time.
Practitioner guidance
- Assign named SaaS ownership Require each SaaS application to have a business owner and an identity owner before it is approved, so access, adoption, and retirement decisions have clear accountability.
- Tie onboarding to access governance Record the initial user set, approval path, and integration dependencies when a SaaS app is onboarded, then use that record as the baseline for future reviews.
- Review utilisation before promotion Use utilisation signals to confirm whether a SaaS app still supports a live business need before expanding access, training effort, or license spend.
Bottom line: SaaS app management is an identity governance problem because ownership, access, and retirement must be controlled together across the full application lifecycle.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
12/06/2026 10:20 am
SaaS lifecycle governance is identity governance by another name: Once software access is granted, the real control question becomes who owns it, who can change it, and when it must be removed. The article is right to frame discovery, onboarding, promotion, and offboarding as one sequence because identity risk moves with the application, not with procurement alone. Practitioners should treat every SaaS record as an access object with a lifecycle.
A few things that frame the scale:
- The average enterprise SaaS platform connects to 42 or more third-party applications through OAuth tokens, API keys, webhooks and automation platforms.
A question worth separating out:
Q: How should teams handle SaaS offboarding and data retention together?
A: Treat offboarding as a combined access and data event. Remove user and integration access, confirm what data must be retained for legal or regulatory reasons, and document who approved the retirement. If those decisions are separated, the app may be gone while the risk remains.
👉 Read our full editorial: SaaS app management lifecycle exposes the identity governance gap
This post was modified 4 days ago by NHI Mgmt Group