Notifications
Clear all
Topic starter
12/06/2026 1:19 am
TL;DR: SaaS management fails when organisations rely on spreadsheets, weak visibility, and inconsistent lifecycle controls for apps, users, groups, and vendors, leaving security and compliance gaps across the stack, according to Zluri. The deeper issue is that SaaS governance is really identity governance across human access, privileged accounts, and third-party exposure, not a procurement list.
NHIMG editorial — based on content published by Zluri: SaaS Management 10 Policies to Ensure Reliable SaaS Management
By the numbers:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
Questions worth separating out
Q: How should teams govern SaaS access when employees change roles or leave?
A: Treat SaaS access as part of the identity lifecycle, not as a separate application task.
Q: Why do SaaS portfolios create so much hidden identity risk?
A: Because SaaS stacks grow faster than manual records can keep up with, especially when teams use spreadsheets and informal approvals.
Q: What do security teams get wrong about SaaS vendor risk?
A: They often treat vendor compliance as a procurement check instead of an ongoing governance issue.
Practitioner guidance
- Build a live SaaS inventory Replace spreadsheet-based tracking with a continuously updated inventory that records each application, owner, business purpose, and active user relationship.
- Tie SaaS offboarding to identity workflows Connect employee exit events and role changes to licence revocation, permission updates, and subscription transfer so access does not outlive the business need.
- Review external SaaS access on a schedule Apply access recertification to consultants, partners, and other external users, and remove access when the collaboration no longer requires it.
What's in the full article
Zluri's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step policy examples for discovery, lifecycle management, and SaaS access review
- Detailed controls for handling vendor compliance checks and shadow IT alerts
- Operational guidance on group cleanup, offboarding, and licence maintenance
- Specific SaaS management scenarios the vendor uses to illustrate policy decisions
👉 Read Zluri's SaaS management policies for visibility, lifecycle, and vendor risk →
SaaS governance gap: what IAM teams are missing in practice?
Explore further
12/06/2026 11:10 am
Spreadsheets are a symptom of governance failure, not just a tooling gap. Once SaaS portfolios span dozens or hundreds of applications, a static register cannot capture live ownership, access changes, or abandoned subscriptions. That means the organisation is making control decisions on stale data, which is how shadow IT and renewal waste become security exposure. The practitioner conclusion is simple: if the inventory is not live, the governance model is already behind.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- Only 1 in 4 organisations are already investing in dedicated NHI security capabilities, according to the same research.
A question worth separating out:
Q: How do organisations reduce SaaS risk without slowing business users down?
A: Use policy-driven guardrails that automate discovery, access review, offboarding, and group cleanup. That gives business users faster onboarding and better collaboration while keeping entitlements current. The balance comes from making identity controls operational, not manual.
👉 Read our full editorial: SaaS management policies expose the real identity governance gap
