I'm noticing that SaaS tools are popping up all over our organization, primarily through marketing, sales, and operations, often without any input from IT or security. While our SASE tool helps identify these connections, it leaves me wondering how to effectively offboard users when I have no control over those networks. How can we manage users—or rather identities—who have created accounts using their corporate email addresses but haven't gone through the proper onboarding process?
6 Answers
A solid approach is to establish governance and enforcement policies. If something isn't blocked, it’s essentially allowed, whether it's a website or SaaS tool. Create a clear policy and make sure it's enforced.
What does your corporate policy say about this? If there's no formal policy, it’s going to be chaotic. Ensure there's a mandatory purchasing workflow in place to comply with regulations. This should involve legal review and keeping IT, finance, and legal in the loop for any new SaaS purchases.
This really boils down to being a policy and procurement issue. If IT wasn’t involved in the deployment, it's not your responsibility to manage it. Accept that and direct any concerns back to marketing, operations, or sales who have set it up.
This is a common headache for IT teams. I suggest checking out Stitchflow, which I helped to create. It's a fully managed solution that provides SCIM-like deprovisioning, even for apps that don’t have SSO. It can help discover apps and manage those hidden accounts by linking them to corporate emails. It's made to tackle exactly this type of issue!
Honestly, I just ignore those unauthorized SaaS users. It's less of a headache that way!
Make single sign-on (SSO) a must for any SaaS tools. If possible, implement provisioning and deprovisioning through SCIM to streamline the process.
Definitely relevant to what the OP is facing!