How can teams keep SaaS access and spending under control?

Why This Matters for Security Teams

SaaS access and SaaS spend usually drift together. When application owners, identity teams, and procurement each hold a partial view, organisations end up paying for dormant licences while leaving stale access in place. That is not just wasted budget; it is also an access-control failure that widens the attack surface and complicates offboarding, audits, and incident response. NHI Management Group’s Ultimate Guide to NHIs shows why visibility and lifecycle control matter: only 5.7% of organisations have full visibility into their service accounts, and the same pattern appears in SaaS estates when ownership is unclear.

For security teams, the issue is not simply “too many licences.” The deeper problem is that access reviews often happen without usage evidence, so teams approve accounts that no longer serve a business purpose. The result is governance debt that accumulates quietly until audit findings, budget cuts, or a breach forces a cleanup. The OWASP Non-Human Identity Top 10 is relevant here because the same control gap appears whenever identities are provisioned faster than they are reconciled and retired. In practice, many security teams discover the problem only after a renewal cycle, an audit exception, or a former employee’s access is still active long after the app owner assumed it had been removed.

How It Works in Practice

The most effective control is a single reconciliation workflow that joins three records: app usage, assigned licences, and account activity. Security teams should not rely on any one record as authoritative. A licence seat can be assigned to a user who has not logged in for months, while a usage dashboard can miss delegated access, dormant admin roles, or service-style accounts attached to SaaS tooling. Current best practice is to treat these records as complementary evidence and reconcile them on a fixed cadence, with exception handling for regulated or business-critical systems.

A practical workflow usually includes:

• Ownership mapping for each SaaS application, including business owner, technical owner, and billing owner.
• Usage thresholds that distinguish active, lightly used, and dormant accounts.
• Licence reclaims when usage falls below policy thresholds for a defined period.
• Access removal when the account has no business justification, even if the licence remains available.
• Escalation paths for shared mailboxes, delegated admin roles, and contractor accounts that need explicit review.

Where identities behave like machine access rather than human users, the same logic should align to NHI lifecycle controls: issue only what is needed, time-bound access, and revoke aggressively when a workload is no longer required. That is why NHI governance guidance from Ultimate Guide to NHIs — Key Challenges and Risks matters even in SaaS settings, because stale tokens and forgotten integrations are often the hidden reason that “unused” accounts still carry risk. Teams should also compare reconcile results against vendor or identity-provider logs, then automate deprovisioning where policy allows.

These controls tend to break down when application ownership is decentralised across multiple business units because no single team can confidently approve removal or reclaim seats.

Common Variations and Edge Cases

Tighter SaaS control often increases operational overhead, requiring organisations to balance spend reduction against business continuity and user friction. The most common exception is a licensed account that looks idle but supports infrequent, high-value workflows such as audit approvals, legal holds, or emergency administration. Best practice is evolving here: there is no universal standard for how long an account may remain inactive before it is considered reclaimable, so policy thresholds should reflect the application’s criticality and the organisation’s tolerance for reactivation delays.

Another edge case is third-party access. Contractor, partner, and support accounts can distort both spend and access reviews because the “user” may not be on the payroll, yet the entitlement still consumes a paid seat. SaaS integrations add further complexity when API tokens or service accounts are counted as users in one system but as technical objects in another. That is why the same reconciliation approach should extend to connected identities, not just employee accounts. The broader lifecycle lessons in Ultimate Guide to NHIs — Standards help teams set cleaner deprovisioning and review expectations across both human and non-human access. For operational teams, the goal is not perfect optimisation; it is a repeatable process that removes obvious waste without breaking legitimate business use.

Where SaaS estates span many subsidiaries or shadow IT subscriptions, reconciliation often fails because the licence ledger and identity source of truth are managed in different systems with different ownership models.

Related resources from NHI Mgmt Group

• What frameworks should IAM teams use for SaaS governance and access control?
• How should teams keep SaaS access audit-ready across the employee lifecycle?
• How should security teams use access control models without creating entitlement sprawl?
• How should security teams connect SaaS contract review to access governance?