How should organisations reduce SaaS spend without weakening identity governance?

Why This Matters for Security Teams

Reducing SaaS spend is not just a finance exercise when identities are tied to every subscription, integration, and admin role. If app ownership, usage, and offboarding are managed separately, organisations often cancel the wrong licenses while leaving dormant accounts, over-privileged admins, and stale OAuth grants in place. That creates hidden exposure and undermines control over access lifecycles. Current guidance from the NIST Cybersecurity Framework 2.0 supports tying governance to asset and access visibility rather than treating spend cuts as a standalone procurement action.

NHI Management Group research shows why this matters operationally: in the State of Non-Human Identity Security, 85% of organisations reported a lack of full visibility into third-party vendors connected via OAuth apps. That same visibility gap is what makes SaaS rationalisation risky, because teams cannot confidently distinguish unused software from actively relied-upon access paths.

In practice, many security teams encounter risky access only after a renewal or offboarding decision has already been made, rather than through intentional identity-led review.

How It Works in Practice

The strongest approach is to connect four control points into one lifecycle model: discovery, ownership, usage, and offboarding. Discovery identifies what is actually in use, including shadow SaaS and machine-to-machine integrations. Ownership assigns a business steward who can answer whether the app is still needed. Usage evidence shows whether the license, token, or service account is active. Offboarding then removes access, not just the invoice line item. This is consistent with the lifecycle emphasis in Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs.

Practically, organisations should merge finance and identity evidence before any renewal decision. Useful signals include last login, last API call, assigned owner, connected OAuth scopes, admin privilege, and whether the account is human or non-human. If the app supports SSO or SCIM, deprovisioning can be automated. If it uses API keys or service accounts, the process should include secret revocation and replacement planning. This aligns with identity-led governance in Ultimate Guide to NHIs — Regulatory and Audit Perspectives.

• Map every SaaS app to an owner, a cost centre, and an access path.
• Use identity data to prove whether a license is truly active before renewal.
• Review OAuth scopes and admin entitlements separately from seat counts.
• Automate offboarding so spend reduction also removes dormant access.

For identity governance, the key is not just reducing seats but proving that access is no longer needed. That means linking renewal decisions to entitlement reviews and secret hygiene, not to procurement spreadsheets alone. These controls tend to break down in large federated environments with weak app ownership because no single team can verify whether the software is unused or merely invisible.

Common Variations and Edge Cases

Tighter SaaS control often increases coordination overhead, requiring organisations to balance savings against business agility. That tradeoff is real, especially where departments buy their own tools or where procurement owns renewals but IAM owns access. Best practice is evolving, but current guidance suggests that finance-led cuts should never bypass identity evidence. Otherwise, cost savings may be temporary while access sprawl remains untouched.

Edge cases matter. Shared licenses can look inactive even when a team relies on them intermittently. Service accounts may appear unused because they run on schedules, not interactive logins. OAuth-connected apps may not have seats at all, yet they can expose sensitive data through persistent tokens. This is why the question is broader than software shelfware. It is a lifecycle governance problem that touches Top 10 NHI Issues and the identity controls behind them.

Where there is no universal standard yet, organisations should treat renewal suppression, access removal, and owner attestation as separate but linked steps. In high-risk environments, the safest savings often come from removing redundant integrations and dormant privileged accounts before cutting core business licenses.

Related resources from NHI Mgmt Group

• How should security teams reduce identity sprawl without weakening governance?
• How can organisations reduce wasted SaaS spend without weakening access control?
• How can organisations reduce SOX compliance costs without weakening control quality?
• How can organisations reduce identity risk without replacing every legacy system?