How should security teams implement IGA when SaaS discovery and spend visibility are both needed?

Why This Matters for Security Teams

Security teams are being asked to solve two problems that only look separate: governance of who can access SaaS and visibility into which SaaS actually exists. If IGA operates only on the app catalog, shadow IT stays outside review. If SaaS management operates only as a finance or procurement exercise, access risk stays outside control. The operating model has to unify both or the organisation ends up with clean certifications on incomplete data. Current guidance aligns with this: inventory, ownership, and access control are one security issue, not two. That is why controls in NIST SP 800-53 Rev 5 Security and Privacy Controls matter as much as discovery workflows in NHI Lifecycle Management Guide. NHI Management Group also notes in Ultimate Guide to NHIs — Key Challenges and Risks that visibility gaps are a recurring cause of governance failure. In practice, many security teams encounter app sprawl only after access reviews, budget cuts, or a breach has already exposed the inventory gap.

How It Works in Practice

The practical model is to build one control plane with two inputs: authoritative identity data and continuous SaaS telemetry. IGA remains the system of record for joiner, mover, leaver, role assignment, attestations, and evidence. SaaS management enriches that record with app discovery, seat usage, owner mapping, SSO connection status, and contract or spend context. Together, they let teams answer three questions at once: what exists, who can use it, and what it costs. A workable sequence usually looks like this:

• Ingest app discovery from SSO, finance, browser telemetry, procurement, and security logs.
• Normalize each app to a single owner, business purpose, and risk tier.
• Link identities to actual usage so access reviews can target active and dormant accounts differently.
• Trigger deprovisioning or step-up review when an app is unapproved, duplicate, or unused.
• Feed savings outcomes back to finance so remediation is visible as spend reduction, not only risk reduction.

This model also improves evidence quality for auditors because it ties access decisions to usage and cost. That is especially useful when teams need to justify removing dormant licenses, since revocation can be shown as both a governance and budget action. NHIMG’s Top 10 NHI Issues is useful here because poor lifecycle control and missing ownership are common root causes in identity programs. The control logic should also map to access-review expectations in NIST and to the least-privilege discipline reflected in the broader identity guidance from NIST SP 800-53 Rev 5 Security and Privacy Controls. These controls tend to break down when finance, IAM, and security each maintain separate app lists because no single team can prove which list is current.

Common Variations and Edge Cases

Tighter governance often increases operational overhead, so organisations have to balance the speed of SaaS onboarding against the cost of deeper validation. That tradeoff becomes real in mergers, fast-growing startups, and departments that buy tools outside procurement. Best practice is evolving, but there is no universal standard for exactly how much discovery confidence is enough before an app enters IGA. Some edge cases matter more than others:

• Shadow apps with no SSO: discovery may find usage, but IGA cannot certify access cleanly until ownership is assigned.
• Shared or service accounts: spend data may show seats, while identity data hides the actual human or team responsible.
• Freemium and self-serve tools: finance visibility is often weak, so security must lean on telemetry and browser-based discovery.
• Multiple business units using the same app differently: one entitlement model may not fit all, so roles need local context.

The right answer is usually not to force every app into the same workflow, but to set governance tiers. High-risk or high-spend apps get stricter attestation and removal rules, while low-risk apps may only need periodic discovery and owner confirmation. NHI Management Group’s research on the Snowflake breach and Salesloft OAuth token breach shows why access visibility and asset visibility cannot be separated for long. In environments with decentralized purchasing and weak SSO adoption, discovery-driven governance becomes noisy enough that teams struggle to keep access reviews actionable.

Related resources from NHI Mgmt Group

• What do security teams get wrong about SaaS spend visibility?
• How should security teams implement continuous data discovery for GDPR compliance across SaaS, cloud, and AI tools?
• How should security teams implement unstructured data discovery across SaaS, cloud, and AI workflows?
• How should security teams implement AI agent discovery across browser, endpoint, OAuth, and SaaS environments?