Topic starter
12/06/2026 1:20 am
TL;DR: Decentralised SaaS purchasing creates duplicate subscriptions, unused licences, and weaker access governance because departments add tools faster than IT can inventory or review them, according to Zluri. The real issue is not cost alone: unmanaged SaaS expands the identity surface, complicates offboarding, and leaves security teams blind to who still has access.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “SaaS Subscription Management: A Detailed Guide”.
Key questions
Q: What breaks when SaaS subscriptions are managed only by finance or procurement?
A: Access governance breaks because licence ownership is not the same as entitlement ownership.
Q: Why do shadow SaaS apps create IAM risk?
A: Shadow SaaS creates IAM risk because access can exist outside approved onboarding, review, and offboarding processes.
Q: How can teams tell whether SaaS subscription management is actually working?
A: It is working when procurement, access, and usage data reconcile cleanly and renewal decisions are based on current entitlement need rather than invoice history alone.
Practitioner guidance
- Build a unified SaaS inventory Connect procurement records, admin ownership, user assignments, and usage telemetry so each subscription can be evaluated in one place.
- Align SaaS renewals to access review Require a review of active users and business ownership before any renewal is approved, especially where departments bought the app outside central IT.
- Revoke orphaned access on a schedule Remove access for dormant subscriptions, departed staff, and unused licences as part of the normal offboarding and recertification cycle.
Bottom line: Decentralised SaaS buying creates governance blind spots because no single team can reliably connect subscriptions, user access, and renewals.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
12/06/2026 11:11 am
Shadow app governance is an identity problem before it is a spend problem: decentralised SaaS buying turns access into an unowned asset. Once departments can subscribe independently, the organisation loses a single authority for entitlement review, revocation, and evidence of who should still have access. The result is not just duplicate licences but governance blind spots that outlive the original purchase decision. Practitioners should treat every unmanaged subscription as an unmanaged identity boundary.
A few things that frame the scale:
- The average enterprise SaaS platform connects to 42 or more third-party applications through OAuth tokens, API keys, webhooks and automation platforms.
A question worth separating out:
Q: Who should own SaaS governance when finance, IT, and IAM all have a stake?
A: Ownership should be shared, but accountability needs one process owner who can force closure across procurement, access, and lifecycle tasks. Finance can validate spend, IT can confirm technical shutdown, and IAM can verify revocation. Without a single workflow, applications linger and access residue remains.
👉 Read our full editorial: SaaS subscription management exposes the identity gap in shadow apps
This post was modified 4 days ago by NHI Mgmt Group