Notifications
Clear all
Topic starter
12/06/2026 1:20 am
TL;DR: Decentralised SaaS purchasing creates duplicate subscriptions, unused licences, and weaker access governance because departments add tools faster than IT can inventory or review them, according to Zluri. The real issue is not cost alone: unmanaged SaaS expands the identity surface, complicates offboarding, and leaves security teams blind to who still has access.
NHIMG editorial — based on content published by Zluri: SaaS Management SaaS Subscription Management: A Detailed Guide
Questions worth separating out
Q: How should security teams govern SaaS sprawl across departments?
A: Security teams should treat SaaS sprawl as an identity and lifecycle issue, not only a procurement issue.
Q: Why does SaaS subscription management matter to IAM teams?
A: Because every subscription introduces accounts, admins, roles, and permissions that can outlive the business need for the tool.
Q: What breaks when SaaS subscriptions are managed only by finance or procurement?
A: Access governance breaks because licence ownership is not the same as entitlement ownership.
Practitioner guidance
- Build one SaaS inventory tied to ownership Map every subscription to a business owner, technical owner, renewal date, and entitlement source so the estate can be governed as a control surface, not a spreadsheet.
- Link renewal reviews to access certification Require every renewal decision to confirm whether the application still has valid users, valid approvers, and a current offboarding path for leavers and dormant accounts.
- Integrate SaaS governance with IAM and IGA Feed application discovery into identity workflows so access requests, role changes, and removals are visible alongside licence usage and contract status.
What's in the full article
Zluri's full guide covers the operational detail this post intentionally leaves for the source:
- Step-by-step SaaS inventory and discovery workflows for distributed departments
- Renewal and vendor-management workflows for subscription decisions and contract timing
- Usage-monitoring and reporting mechanics for licence optimisation and consolidation
- Automation patterns for onboarding, renewals, and compliance reporting
👉 Read Zluri's guide to SaaS subscription management and optimisation →
SaaS subscription sprawl: what it means for IAM and access control?
Explore further
12/06/2026 11:11 am
SaaS subscription management is now an identity governance problem, not just a spend problem. The article focuses on cost optimisation, but the deeper issue is that every unsanctioned or poorly tracked SaaS app introduces its own identities, entitlements, and offboarding duties. That means procurement sprawl becomes access sprawl, and access sprawl becomes governance blind spots. Organisations should treat subscription oversight as part of identity control, not as a separate software asset exercise.
A few things that frame the scale:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing how slowly remediation can lag behind exposure.
A question worth separating out:
Q: Who should be accountable for SaaS lifecycle governance?
A: Accountability should sit with both the business owner and the identity team, with clear security oversight. The business owner justifies the subscription, while IAM or IGA teams ensure access is reviewed, offboarded, and auditable when the tool is renewed or retired.
👉 Read our full editorial: SaaS subscription management exposes the identity gap in shadow apps
