Topic starter
12/06/2026 12:40 am
TL;DR: IT teams are being pushed to manage SaaS sprawl, onboarding, offboarding, and license control as a single governance problem, according to Josys. The issue is no longer only operational efficiency, because unmanaged app access and poor visibility now directly affect security, spend, and audit readiness.
Editorial analysis by NHI Mgmt Group, based on content published by Josys: “Run SaaS Right: Why IT Teams Are Going Pro with Josys”.
Key questions
Q: How should teams govern SaaS onboarding and offboarding across a large app estate?
A: They should treat SaaS onboarding and offboarding as lifecycle controls, not one-off admin tasks.
Q: Why does SaaS sprawl create security risk as well as cost pressure?
A: SaaS sprawl increases the number of accounts, roles, permissions, and integrations that must be governed.
Q: What are the signs that SaaS lifecycle management is failing?
A: Common warning signs include dormant accounts that still authenticate, old API or OAuth tokens that remain valid, external shares that no one owns, and privileged apps that have not been reviewed for a long time.
Practitioner guidance
- Map SaaS lifecycle ownership Assign clear owners for onboarding, offboarding, access approvals and licence review across each business application, then track completion against those owners rather than against IT alone.
- Reconcile access and usage data Compare who has access, who actively uses the app and which licences are still assigned so waste and residual access are visible in the same review cycle.
- Tie leaver workflows to app revocation Ensure offboarding removes access across the SaaS stack, including connected applications and shadow tools that do not sit inside the primary directory process.
Bottom line: SaaS lifecycle governance now sits at the intersection of access control, spend management and audit readiness, which makes it a programme issue rather than an admin task.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 10:05 am
SaaS lifecycle governance is now an identity governance problem, not an IT housekeeping problem. The article correctly treats onboarding, offboarding, access visibility and licence management as one operating model rather than four disconnected tasks. That shift matters because access decisions, spend decisions and audit evidence now share the same underlying data. Practitioners should stop treating SaaS administration as a support function and start treating it as a governance control plane.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should IT teams manage SaaS access and licence control separately or together?
A: They should manage them together. Licence control tells you what is being paid for, while access control tells you who can use it. Separating them usually leaves gaps where a user keeps access after the business case ends, or where an app remains funded without active governance.
👉 Read our full editorial: SaaS lifecycle governance is becoming an IT performance problem
This post was modified 1 day ago by NHI Mgmt Group