Topic starter
12/06/2026 12:52 am
TL;DR: Enterprises still rely on spreadsheets for SaaS management, even though only 20% use SaaS management platforms and manual tracking leaves access, usage, and compliance decisions inconsistent, according to Zluri. The deeper issue is that SaaS sprawl turns identity governance into a visibility problem, not just a tooling problem.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “Managing SaaS in an Enterprise”.
Key questions
Q: What breaks when SaaS access reviews rely on spreadsheets?
A: Spreadsheets freeze access data in time, so reviewers work from stale exports while roles, teams, and app usage keep changing.
Q: Why does SaaS sprawl increase non-human identity risk?
A: SaaS sprawl increases NHI risk because every new integration can create tokens, service accounts, OAuth grants, and delegated permissions that persist outside normal review cycles.
Q: How can teams tell whether SaaS governance is actually working?
A: Look for evidence that discovered applications can be assigned an owner, tied to an access policy, and removed through an enforced workflow.
Practitioner guidance
- Build a definitive SaaS inventory Create a continuously reconciled inventory that ties application ownership, access paths, business unit usage, and procurement records together.
- Extend joiner, mover, and leaver workflows to SaaS Ensure provisioning, access change, and offboarding steps include application entitlements, not only directory accounts.
- Use usage telemetry for access review Review feature-level and department-level usage to identify dormant applications, redundant tooling, and entitlements that no longer have a business justification.
Bottom line: SaaS sprawl weakens governance when application inventory, ownership, and offboarding fall behind actual adoption.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
12/06/2026 10:23 am
SaaS sprawl is a governance problem before it is a tooling problem: The core failure is not the lack of another dashboard, but the absence of a reliable control plane for application identity, access ownership, and offboarding. Once application ownership fragments across IT and the business, even well-intentioned controls degrade into partial records and delayed decisions. Practitioners should treat SaaS inventory as an identity governance asset, not a procurement spreadsheet.
A few things that frame the scale:
- The average enterprise SaaS platform connects to 42 or more third-party applications through OAuth tokens, API keys, webhooks and automation platforms.
A question worth separating out:
Q: Should organisations prioritise SaaS discovery or access review first?
A: Discovery should come first when the app estate is poorly understood, because you cannot govern what you cannot see. But access review must follow quickly, otherwise discovery becomes a static inventory exercise. The right sequence is discover, assign ownership, then recertify or remove access.
👉 Read our full editorial: SaaS sprawl exposes the gaps in enterprise identity governance
This post was modified 4 days ago by NHI Mgmt Group