Who should own subscription app review and offboarding?

Why This Matters for Security Teams

Subscription app review and offboarding is not a clerical cleanup task. It is the point where organizations decide whether an app still has a business need, whether its access is still justified, and whether any secrets, tokens, or delegated permissions should be revoked. When that ownership is vague, reviews drift into app-team convenience, while offboarding becomes an afterthought. NIST’s NIST Cybersecurity Framework 2.0 treats access governance as an ongoing control, not a one-time approval.

For NHI programs, the stakes are higher because subscriptions often contain machine credentials, service principals, and OAuth grants that outlive the person who requested them. NHIMG’s NHI Lifecycle Management Guide makes the lifecycle point explicit: review and revocation must be managed as part of identity governance, not by informal user discretion. That is especially important when account data, SaaS entitlements, or privileged integrations are involved. In practice, many security teams discover stale subscriptions only after a token leak, billing dispute, or failed deprovisioning has already exposed the gap.

How It Works in Practice

The most defensible operating model is to assign ownership to identity or access governance, with privacy and procurement as required consults when personal data or contract terms are involved. That team defines the control standard, the evidence required for approval, the cadence for periodic review, and the offboarding trigger that forces removal of access. Application owners can validate business need, but they should not be the final control owner because they rarely have a complete view of downstream entitlements.

Practically, the workflow should separate four decisions:

• Does the subscription still have a documented business purpose?
• Which identities, roles, or service accounts are bound to it?
• Are any secrets, API keys, or delegated OAuth scopes attached?
• What gets revoked, retained, or archived at offboarding?

This is where lifecycle discipline matters. NHIMG’s Top 10 NHI Issues highlights how easily standing access persists when ownership is unclear. A strong program ties subscription review to joiner-mover-leaver events, vendor renewal dates, and access recertification cycles. Current guidance suggests that the governance owner should also require evidence of revocation, not just a ticket closure, because closure alone does not prove access removal.

For SaaS subscriptions with machine identities, the same control should include inventory of tokens, service accounts, and admin consent grants. If procurement owns the commercial relationship, it should still hand off technical offboarding to identity governance so renewal pressure does not override revocation discipline. These controls tend to break down in decentralized SaaS environments where every department can buy software independently and no single team maintains a complete entitlement inventory.

Common Variations and Edge Cases

Tighter central ownership often increases process overhead, requiring organizations to balance faster team-level purchasing against stronger revocation control. That tradeoff is real, especially in fast-moving product groups and research environments where subscriptions are created and abandoned quickly. Best practice is evolving, but the current direction is clear: the control owner should be consistent, while the operational inputs can vary by risk.

For low-risk tools with no personal data and no privileged integrations, a lighter review path may be acceptable, provided the identity team still owns the policy and the offboarding trigger. For regulated data, shared workspaces, or subscriptions that embed API keys, the review should be stricter and evidence-based. The Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs is useful here because it frames offboarding as a lifecycle event, not a mailbox task.

There is no universal standard for this yet, but the practical rule is simple: app owners can attest to use, procurement can enforce contract boundaries, privacy can assess data exposure, and identity governance should own the decision to keep or kill access. This model breaks down when subscription ownership is buried in shared admin accounts or when no inventory exists for the credentials attached to the app.

Related resources from NHI Mgmt Group

• Who should own redundant app cleanup and offboarding?
• Who should own OAuth app and service account cleanup?
• Who should own approval authority for app access requests?
• When should organizations review their NHI policies?