Topic starter
12/06/2026 1:19 am
TL;DR: SaaS sprawl is pushing app selection, provisioning, renewal, and offboarding into a dedicated operations function, while unmanaged buying and manual inventory create spending and security risk, according to Zluri. The governance issue is no longer just software control but lifecycle control across users, apps, and access paths.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “Role & Responsibilities of SaaSOps Manager (With JD)”.
Key questions
Q: What breaks when SaaS is adopted outside approved governance processes?
A: When SaaS is adopted outside approved governance processes, organisations lose the connection between application ownership, user access, and renewal accountability.
Q: Why does SaaS sprawl increase non-human identity risk?
A: SaaS sprawl increases NHI risk because every new integration can create tokens, service accounts, OAuth grants, and delegated permissions that persist outside normal review cycles.
Q: What signals show that SaaS governance is not working?
A: Look for delayed offboarding, repeated manual exports, inconsistent access review responses, and inactive accounts that still carry paid licenses.
Practitioner guidance
- Build a SaaS system of record Maintain a continuously updated inventory of SaaS apps, owners, business purpose, and renewal dates so access and spend decisions are made from one authoritative source.
- Tie offboarding to every SaaS app Add application-by-application revocation steps to joiner-mover-leaver workflows so a leaver is removed from each SaaS account, not just the core directory.
- Separate approved apps from expense-led apps Flag software bought outside IT intake and require retrospective owner assignment, access review, and renewal decision before it stays active.
Bottom line: SaaS governance fails when app ownership and account ownership diverge, because the organisation can no longer prove who should have access or who can revoke it.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
12/06/2026 11:10 am
SaaS operations has become an identity lifecycle function, not a software admin function: once employees can acquire apps directly, the control problem shifts from purchasing to ownership, access, and offboarding. The organisation no longer fails only when it overspends. It fails when it cannot prove which identities are attached to which SaaS instances and who is responsible for closing them. The implication is that SaaSOps and IAM must be governed together.
A question worth separating out:
Q: How should IAM teams and SaaSOps share responsibility for access control?
A: IAM should own the identity lifecycle rules, while SaaSOps should own the application inventory, renewal cadence, and business ownership data that make those rules actionable. The two functions need shared workflows for onboarding, access review, and offboarding. Without that split of responsibility, the organisation keeps either the licence record or the access record, but not both.
👉 Read our full editorial: SaaS operations management is becoming an identity governance problem
This post was modified 4 days ago by NHI Mgmt Group