Topic starter
12/06/2026 1:25 am
TL;DR: SaaS expansion, remote work, and employee-led app adoption have made shadow IT harder to see and govern, while David Foxen argues that many organisations still rely on manual processes, spreadsheets, and incomplete approvals, according to Zluri. The practical problem is not software convenience but fragmented visibility across procurement, finance, and security.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “Software Asset Management with the SAM Beast David Foxen”.
Key questions
Q: What breaks when SaaS purchases bypass central procurement and IT approval?
A: When SaaS purchases bypass central approval, organisations lose the link between buying authority, asset inventory, and access ownership.
Q: Why do shadow SaaS apps create IAM risk?
A: Shadow SaaS creates IAM risk because access can exist outside approved onboarding, review, and offboarding processes.
Q: What signals show that SaaS governance is not working?
A: Look for delayed offboarding, repeated manual exports, inconsistent access review responses, and inactive accounts that still carry paid licenses.
Practitioner guidance
- Correlate procurement, finance, and security records Join approved purchase data, expense claims, and security review results so unsanctioned SaaS can be identified before it becomes a blind spot.
- Build continuous SaaS discovery into the governance workflow Use discovery sources that expose new applications, owners, and access paths instead of relying on periodic spreadsheet reconciliations.
- Assign an owner to every SaaS application Require each app to have a business owner, a technical owner, and a removal trigger so offboarding is possible when the service is no longer sanctioned.
Bottom line: Shadow SaaS becomes a governance failure when unsanctioned applications create identities and access paths that ITAM cannot see or revoke.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
12/06/2026 11:21 am
Shadow SaaS is an identity governance problem before it is a software asset problem. The article's core pattern is that application sprawl becomes access sprawl the moment users can buy tools outside formal approval. That means the control failure is not simply missing inventory, but missing ownership of the identities and permissions created by each unsanctioned app. Practitioners should treat SaaS discovery as a governance issue, not a procurement clean-up exercise.
A question worth separating out:
Q: Should organisations manage shadow SaaS through ITAM, IAM, or both?
A: They need both, but not as separate workstreams. ITAM tracks what exists and what it costs, while IAM determines who can use it, administer it, and revoke it. If those disciplines do not share the same approval and offboarding process, unsanctioned SaaS will continue to slip through governance gaps.
👉 Read our full editorial: Shadow SaaS and identity sprawl are outpacing ITAM controls
This post was modified 4 days ago by NHI Mgmt Group