What breaks when SaaS sprawl is not in your identity catalogue?

Why This Matters for Security Teams

When SaaS applications are missing from the identity catalogue, identity governance stops matching the real environment. Access reviews only certify what is visible, provisioning workflows only assign what is known, and offboarding only revokes a partial inventory. That creates a blind spot in the control plane, not just a documentation gap. The practical risk is larger than missed hygiene: shadow SaaS can retain active sessions, delegated tokens, and OAuth grants long after the organisation believes access has been removed. This is why catalog completeness is a security control, not an admin task. The issue shows up across review, joiner-mover-leaver, and privileged access workflows, especially when employees adopt tools without central approval. NIST frames this kind of visibility and governance problem inside the broader NIST Cybersecurity Framework 2.0, where asset management and access governance are foundational rather than optional. NHIMG research on the Ultimate Guide to NHIs shows that only 5.7% of organisations have full visibility into their service accounts, which is the same governance failure pattern, just applied to machine access. In practice, many security teams discover the gap only after an audit exception, a breach review, or a failed offboarding cycle has already exposed it.

How It Works in Practice

A complete identity catalogue should function as the system of record for every SaaS application that can issue, store, or inherit access. That means the catalogue must support discovery, ownership, risk classification, and lifecycle state, not just a name and business unit. When saas sprawl is unmanaged, downstream controls become conditional: access reviews can only attest to known applications, provisioning can only follow approved catalog entries, and offboarding can only revoke what has been mapped. Practitioners usually need three linked mechanisms:

• Discovery from multiple sources, including SSO logs, expense reports, browser telemetry, CASB data, and vendor integrations.
• Ownership assignment so every application has a named business owner and security control owner.
• Lifecycle enforcement so new SaaS cannot enter production use without registration, review, and a defined offboarding path.

This is also where NHI governance becomes relevant, because many SaaS tools expose API keys, service accounts, and delegated OAuth tokens that behave like non-human identities. The Top 10 NHI Issues and the 52 NHI Breaches Analysis both reinforce the same operational point: if the application is invisible, the credentials inside it are usually invisible too. That is how access reviews become ceremonial, because certifiers cannot revoke what they do not know exists. Best practice is evolving toward continuous catalogue reconciliation, where identity records, SaaS discovery, and entitlement data are compared routinely rather than only during quarterly review cycles. These controls tend to break down in environments with decentralized procurement and self-service admin rights because business units can create new SaaS relationships faster than security can inventory them.

Common Variations and Edge Cases

Tighter SaaS catalog governance often increases friction for business teams, so organisations have to balance discovery coverage against approval speed and user experience. That tradeoff is real, especially in product, sales, and marketing environments where teams adopt tools quickly to meet delivery demands. Current guidance suggests a few edge cases deserve special handling. First, freemium and trial applications may never appear in procurement systems but can still store corporate data and tokens. Second, embedded SaaS inside larger platforms can hide in plain sight if the catalogue only tracks primary contracts. Third, M&A activity often introduces entire application portfolios that are operational before they are fully inventoried. In those cases, governance needs a temporary containment model, not just a retrospective cleanup. The most important exception is delegated access through third-party integrations. A SaaS app may look low risk on paper while still holding high-impact OAuth grants into email, files, CRM, or source code systems. That is why the Salesloft OAuth token breach and the Snowflake breach matter here: the catalogue gap is not just about missing app names, it is about missing paths to data. When SaaS sprawl outpaces inventory controls, the identity record stops being authoritative and becomes only an estimate.

Related resources from NHI Mgmt Group

• What breaks when departments adopt SaaS tools without identity review?
• What breaks when cross-border identity assurance is not harmonised?
• What breaks when identity evidence is not recorded end to end?
• What breaks when FIM or SCM is used without identity governance?