Topic starter
12/06/2026 12:25 am
TL;DR: OnLoop reduced wasted SaaS spend, improved app visibility, and automated offboarding after replacing spreadsheet-driven access tracking with Josys, according to Josys. The underlying lesson is that shadow SaaS, stale access, and audit prep debt are identity governance problems, not just IT housekeeping.
Editorial analysis by NHI Mgmt Group, based on content published by Josys: “How OnLoop Enhanced SaaS Visibility and Boosted IT Efficiency with Josys”.
Key questions
Q: How do teams replace spreadsheet-based SaaS tracking with governed visibility?
A: Teams need automated discovery, ownership assignment, and entitlement reconciliation so the application inventory reflects current access rather than a stale manual record.
Q: Why do delayed offboarding processes create security risk?
A: Delayed offboarding creates security risk because access can remain active after the business relationship ends.
Q: What are the signs that SaaS app permission governance is failing?
A: Common warning signs include users approving apps outside policy, security teams lacking visibility into permission changes, and integrations with broad access that no one can explain.
Practitioner guidance
- Implement continuous SaaS discovery Build an authoritative inventory of applications, users, and license state so shadow apps and unsanctioned tools are surfaced without relying on spreadsheets.
- Automate leaver offboarding workflows Connect offboarding to identity and application revocation so former employees and contractors lose access on schedule rather than after manual follow-up.
- Assign clear application ownership Require every SaaS app and license pool to have a named business or IT owner who can attest to access, usage, and renewal decisions.
Bottom line: The core risk is not SaaS sprawl alone, but the governance blind spots it creates around access, ownership, and removal.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 9:38 am
Hidden SaaS is an identity governance problem before it is a software inventory problem: The article shows that OnLoop's core issue was not simply tool sprawl, but the absence of a trustworthy record of who had access to what. That kind of gap breaks joiner, mover, and leaver governance because the organisation cannot enforce lifecycle decisions against assets it cannot see. The practitioner conclusion is straightforward: SaaS discovery belongs inside identity governance, not as a separate housekeeping task.
A few things that frame the scale:
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
A question worth separating out:
Q: What does strong SaaS identity governance change for compliance teams?
A: It turns audit prep from a manual chase into a repeatable evidence process. Compliance teams can answer questions faster when entitlement data, ownership, and offboarding history come from governed systems rather than spreadsheets. That reduces rework, lowers the chance of inconsistent evidence, and makes access control decisions easier to defend.
👉 Read our full editorial: SaaS visibility and offboarding gaps still create hidden identity risk
This post was modified 1 day ago by NHI Mgmt Group