Unsanctioned SaaS and shadow IT are problems every organization deals with. When procuring a new SaaS tool is a few clicks, an email, and a credit card away, it’s never been easier for unsanctioned apps to increase across the business. Often, this is outside IT’s line of sight, outside security controls, and outside standard provisioning/deprovisioning processes.

This isn’t driven by bad intent. Employees and business units are bringing new tools into the business to increase their productivity, and it’s helping the business move forward. Unfortunately, modern work is happening faster than traditional controls were designed to handle. And that gap is where risk, wasted spend, and compliance issues emerge.

Why uncovering unsanctioned SaaS matters

Unsanctioned SaaS tools create three distinct problems for organizations:

Security risks. Apps that aren’t connected to SSO or IAM can store sensitive company data. Since these tools aren’t incorporated into standard identity and security processes, access to these applications often persist after employees leave, ultimately expanding the attack surface. When applications live outside of IT’s visibility and control, it becomes difficult to manage and revoke access.

Wasted spend. When you don’t have visibility into the SaaS apps being used, employees could be using redundant applications.  As a result, the company could be paying for overlapping tools for the same job. Over time, SaaS spend grows because no one has a full picture, not necessarily because the business actually needs more software.

Compliance concerns. Most deprovisioning processes rely on HRIS or IdP triggers. That works for apps that are managed by IT that are behind SSO. But unsanctioned SaaS falls through the cracks, creating access risks and compliance gaps. 

The big problem is that unsanctioned SaaS isn’t an edge case, it’s become the default state of modern work environments.

Why is it so hard to discover unsanctioned SaaS?

Shadow IT is one of those problems that just seems to perpetuate and never quite go away. That’s not because IT is failing, it’s because the tools many IT teams rely on weren’t built to address this reality.

IAM and SSO were designed for managed apps. They’re great for applications that IT already knows about, but they don’t discover new apps that employees and business units signed up for without IT’s knowledge. While these tools are great for removing access to tools being SSO, they often don’t remove the licenses themselves, leading to overspending.

SaaS ownership is decentralized. Ownership of individual tools are spread across teams and budgets. Finance sees spend, but not utilization; security sees risk, but not context; and IT is stuck trying to connect the dots across all of it.

Manual processes don’t scale. Point-in-time audits go stale the moment they’re finished. Spreadsheets can’t keep up with joiners, leavers, contractors, and AI tools appearing every week. The environment changes faster than humans can track it.

Fundamentally, you can’t tackle a continuous problem with point-in-time or manual solutions. 

How 1Password SaaS Manager uncovers unsanctioned SaaS tools

1Password SaaS Manager helps IT teams regain control of their SaaS ecosystem, without adding friction for employees.

• Continuously uncover new SaaS apps used across the business, automatically. This provides IT with an always-updated inventory of apps, users, and licenses. No manual audits required.

• Extend governance beyond SSO and support automated joiner and leaver workflows. 1Password SaaS Manager ensures access is revoked and licenses are reclaimed, even for apps that aren’t connected to your IdP. 

• Reduce risk and spend at the same time by surfacing unused licenses and redundant tools. 1Password SaaS Manager helps IT and Finance make better decisions by providing up-to-date visibility at renewal time.

Most importantly, 1Password SaaS Manager closes the gap between how people actually work and how access is governed. Employees keep the flexibility they need, and IT regains the visibility and control it’s responsible for.