What’s a practical way to spot SaaS use in remote clients?

If clients already use Microsoft security tools, I’d first check what visibility Defender for Cloud Apps can provide from their onboarded devices. That may give you a starting point without adding another vendor, but don’t treat it as a complete inventory: coverage depends on which devices and activity are actually reporting.

For a repeatable service, test it with a few clients and compare the results with what you know is in use. Also check licensing and whether its reporting is clear enough to share with non-technical contacts.

A SaaS management tool that combines browser-extension data with other signals sounds closer to what you’re after than a full traffic-inspection setup. The extension can help surface apps that don’t use company sign-in, while other sources can fill in gaps. Check how it handles multiple client environments, what users have to install, and whether the reports are easy to explain.

I’d trial a couple of options against the same small group before committing. Ask specifically what it can see when someone uses a personal account or an unmanaged device, since those are easy places for coverage to fall short.

A traffic-inspection proxy can give broader visibility, but it’s a lot of infrastructure and cost if all you want is an app inventory. For remote users, it also means getting their traffic through that service and deciding how much inspection is acceptable. I’d reserve that route for clients who already need those controls.

Use several imperfect signals rather than expecting one tool to find everything. Identity-provider logs show apps using company sign-in, expense data can reveal paid subscriptions, and device or browser reporting may catch some of the rest. Personal purchases that aren’t expensed can still be missed, so make the limits clear in any client report.