Notifications
Clear all
Topic starter
12/06/2026 12:17 am
TL;DR: Manual spreadsheet audits cannot keep pace with hundreds of SaaS applications, leaving access reviews static, error prone, and difficult to defend in compliance checks, according to JumpCloud. The real issue is that access governance has outgrown point-in-time processes, and identity teams need continuous visibility, not periodic reconstruction.
NHIMG editorial — based on content published by JumpCloud: updated guidance on automating user access audits in SaaS environments
By the numbers:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities.
Questions worth separating out
Q: What breaks when user access audits stay in spreadsheets?
A: The review process becomes a stale snapshot instead of a live control.
Q: Why do SaaS environments make manual access reviews harder to govern?
A: SaaS estates fragment identity data across many applications, each with its own users, groups, and permission model.
Q: How do teams know whether access review is actually working?
A: Look for evidence that approvals, removals, and exceptions are recorded in the same workflow and can be sampled later.
Practitioner guidance
- Replace spreadsheet audits with governed entitlement workflows Consolidate SaaS access data into a system that can continuously ingest current entitlements, route review tasks, and record remediation outcomes in one audit trail.
- Bind recertification to revocation execution Do not stop at reviewer approval.
- Prioritise privileged and dormant access first Focus review cycles on admin roles, shared accounts, and accounts with no recent use because those are the entitlements most likely to persist unnoticed across SaaS sprawl.
What's in the full article
JumpCloud's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step explanation of how its unified platform consolidates access data across SaaS applications.
- Specific examples of how Directory Insights can surface permissions that no longer match role or function.
- Operational framing for how automated review workflows reduce the manual effort of audit preparation.
- The article's own product-level guidance on moving from spreadsheet reviews to centralized access management.
👉 Read JumpCloud's article on automating SaaS user access audits →
Spreadsheet access audits in SaaS: what IAM teams are missing?
Explore further
12/06/2026 9:26 am
Spreadsheet audits are a control illusion once SaaS sprawl crosses a certain threshold. The control still exists on paper, but it no longer produces trustworthy evidence because the data is already stale by the time the review is complete. That makes the failure one of governance visibility, not just administrative inconvenience. Practitioners should treat spreadsheet-based access review as an expired operating model, not a lighter-weight version of proper identity governance.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to The 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI, even as autonomous adoption accelerates across infrastructure and identity programmes.
A question worth separating out:
Q: Who should own access governance when SaaS sprawl is the problem?
A: Ownership should sit with the identity and security function, but the workflow must involve application owners and managers who can validate whether access is still needed. If governance lives only in IT administration, it turns into a reporting task instead of a business control. Shared accountability is what makes review decisions defensible.
👉 Read our full editorial: Spreadsheet-based access audits are failing SaaS identity governance
