Topic starter
10/06/2026 9:46 pm
TL;DR: SaaS sprawl, shadow IT, and fragmented access governance are pushing organisations toward platforms that combine discovery, lifecycle automation, and review workflows, according to Zluri. KuppingerCole’s executive view highlights that SaaS management and IGA now need to operate as one control plane, not separate programmes.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “A summary of KuppingerCole's Executive View on Zluri’s SMP and IGA”.
Key questions
Q: How should security teams govern access across SaaS sprawl?
A: Security teams should govern SaaS sprawl with one inventory, one policy model, and one review process that covers both human and non-human access.
Q: Why do periodic access reviews fail in dynamic SaaS environments?
A: Periodic reviews fail because they assess yesterday’s entitlement snapshot while access is changing every day.
Q: What breaks when offboarding does not fully remove directory access?
A: The directory stops reflecting current business reality.
Practitioner guidance
- Map the full SaaS estate before certifying access Tie discovery sources, application catalogs, and entitlement records together so hidden applications do not fall outside review and offboarding workflows.
- Connect onboarding and offboarding to SaaS entitlements Use lifecycle workflows that provision and revoke access across individual SaaS applications, not just in the upstream directory.
- Make access reviews entitlement-aware Require reviewers to see the application, the granted entitlement, and the business context so certifications can drive remediation instead of simple attestation.
Bottom line: SaaS management and IGA are converging because the same application sprawl that creates software waste also creates identity governance gaps.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
12/06/2026 6:26 am
Unified SaaS governance is becoming an identity control problem, not a procurement problem. Once SaaS adoption outpaces central IT visibility, the same control gap appears in discovery, lifecycle management, and access review. That shifts the programme from software rationalisation to identity governance across the SaaS estate. Practitioners should treat app inventory as a prerequisite for access control, not a separate operational task.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: What breaks when organisations try to rely on IGA alone for SaaS governance?
A: Relying on IGA alone leaves unmanaged SaaS outside standard joiner, mover, leaver processes and periodic access reviews. Former employees may retain access, risky apps may stay active, and app owners may never review permissions. In practice, the break point is not the IGA workflow itself but the gap between governed applications and the wider SaaS estate.
👉 Read our full editorial: SaaS management and IGA are converging around identity control
This post was modified 4 days ago by NHI Mgmt Group