Why do SaaS sprawl and app renewals matter to identity governance?

Why This Matters for Security Teams

SaaS sprawl turns identity governance into a moving target. Every new application can add users, roles, API keys, service accounts, and approval workflows that security teams must track across procurement, onboarding, renewal, and retirement. If renewals are handled as a finance-only decision, access can persist after the business case ends, duplicate tools can keep shadow entitlements alive, and audit evidence fragments across admin consoles. That is why identity governance has to reach into app portfolio management, not sit beside it.

NHI Management Group’s Ultimate Guide to NHIs notes that only 20% of organisations have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them. That matters in SaaS environments because renewals often preserve the very connections that should have been removed at disposal. The governance gap is not just about human users; it is also about every app-created identity that survives the contract cycle. Current guidance from the NIST Cybersecurity Framework 2.0 treats identity as a core control plane, which fits SaaS lifecycle risk well.

In practice, many security teams discover stale access only after a renewal has already been approved and the old app has continued quietly authorising work.

How It Works in Practice

The operational fix is to connect SaaS governance to identity governance at three points: intake, renewal, and disposal. At intake, each application should be classified by the identities it creates or consumes, including SSO assignments, delegated admin roles, OAuth grants, SCIM connections, and machine-to-machine credentials. At renewal, the app owner should not only justify spend but also confirm which identities are still required, which entitlements can be removed, and whether any integration secrets need rotation. At disposal, access removal must be a controlled deprovisioning event rather than an informal uninstall.

The strongest programmes tie procurement records to identity inventories and require evidence that access has been reviewed before renewal is approved. This is especially important for third-party connections. NHI Management Group’s State of Non-Human Identity Security reports that 85% of organisations lack full visibility into third-party vendors connected via OAuth apps. In SaaS sprawl, that means an application can look harmless in a renewal spreadsheet while still carrying live downstream access into other systems.

• Inventory every SaaS app alongside its human and non-human identities.
• Map each renewal to an access review, not just a budget approval.
• Revoke dormant OAuth grants, API keys, and admin roles before contract extension.
• Require offboarding evidence for decommissioned apps, including secrets rotation where needed.

Practitioners often use the lifecycle framing in Ultimate Guide to NHIs together with controls from the OWASP Non-Human Identity Top 10 to make renewal decisions measurable. These controls tend to break down when SaaS ownership is fragmented across departments because no single team can prove which identities were created, approved, or retired.

Common Variations and Edge Cases

Tighter SaaS renewal controls often increase administrative overhead, so organisations have to balance access reduction against procurement speed and business autonomy. That tradeoff is real, especially in departments that adopt point solutions faster than central IT can review them. Best practice is evolving, but the general direction is clear: app renewals should be treated as identity events, not just commercial renewals.

Edge cases usually appear in federated environments, where one SaaS platform is both a business application and an identity broker for others. In those cases, a renewal can preserve hidden trust relationships even when the visible app is no longer in active use. Another common exception is vendor-managed admin access, where a contract may continue to justify privileged support accounts unless the offboarding checklist explicitly removes them. The Top 10 NHI Issues is useful here because it frames excessive privilege, poor rotation, and weak lifecycle hygiene as linked failure modes rather than isolated problems.

There is no universal standard for this yet, but mature programmes increasingly require every renewal to answer three questions: who still needs access, which machine identities remain active, and what evidence proves deprovisioning happened where needed. That discipline becomes especially important when SaaS tools are duplicated across teams, because duplicate apps often mask duplicate entitlements until audit or incident response reveals them.

Related resources from NHI Mgmt Group

• Why do SaaS renewals often create identity governance problems?
• Why is it important to integrate identity and data governance?
• Why do dashboards matter in NHI governance?
• Why do application testing tools matter for NHI governance?