Ask any business owner how many cloud applications the company uses and you’ll get a number. The real figure, once you count what individual employees and departments have signed up for, is reliably a multiple of it. That gap has a name — SaaS sprawl — and it costs you three ways: subscriptions nobody uses, company data scattered across services nobody secures, and departed employees whose accounts nobody closed because nobody knew they existed. Governance sounds heavy; at small-business scale it’s an inventory, a decision rule, and three habits. Here’s the whole program.
How the sprawl happens (and why it’s nobody’s fault)
Every SaaS product is designed to be adopted in five minutes with a work email and a credit card — that’s the business model. Marketing needs a design tool by Friday; a PM likes a scheduling app; someone signs up for a free tier that quietly becomes a paid one. Each decision is individually reasonable. Collectively they produce a company whose data and spending live in dozens of places, most invisible to whoever answers for security and budget. The fix isn’t banning initiative — prohibition just drives sign-ups to personal emails, where you’ll never find them. The fix is visibility plus a lightweight sanctioned path.
Step one: find out what you actually have
Three sources triangulate the truth in an afternoon: the money — twelve months of card and bank statements, searching the recurring charges (this alone finds most of it, including the tools paying for themselves on expense reports); the identity trail — if your team signs into apps with Microsoft or Google accounts, the admin console lists every application that’s been granted access, which surfaces the free tools no invoice reveals; and asking — one short survey, amnesty explicitly included: “what do you use to get work done that IT didn’t set up?” You want honest answers more than you want tidy ones.
The output is one sheet: app, what it’s for, who owns it, cost, renewal date, what data it holds, and how people sign in. Congratulations — most companies have never seen this list.
Step two: sort it with one question per app
For each discovery: keep, consolidate, or kill. Keep what’s earning its seat — and put it on the renewal calendar so pricing changes stop arriving as surprises. Consolidate the duplicates: three project tools and two e-signature services is the normal finding, and picking one of each funds real things (the same license-drift logic as your Microsoft stack). Kill the zombies — paid tiers nobody’s opened in months. Then apply the security lens to the keepers: anything holding Restricted data gets promoted to the first-class citizens’ tier — MFA or single sign-on required, an owner named, and a place in the backup conversation, because SaaS vendors run the service, not your data protection.
Step three: the three habits that keep it solved
A sanctioned path for new tools. One sentence of policy: “Before signing up for a work app, run it past [name] — answer inside two days.” The two-day promise is what makes people comply; a slow approval process is how shadow IT was invented. The check itself is short: does the vendor look responsible, what data will it hold, do we already own something that does this?
Sign-in through company identity wherever possible. When apps authenticate via your Microsoft or Google accounts instead of standalone passwords, you get the master switch: visibility of every connected app, MFA inherited automatically, and — the big one — access that dies when the employee’s account does.
SaaS on the offboarding checklist, by name. The scattered-accounts problem is worst at departure: the standalone logins to the design tool, the scheduling app, the client portal — each one a live credential walking out the door. The inventory sheet is what makes closing them possible; company-identity sign-in is what makes it automatic.
The bottom line
You can’t secure, budget, or offboard what you can’t list. One afternoon of discovery, one keep/consolidate/kill pass, and three standing habits turn SaaS from a sprawl that grows in the dark into a portfolio someone actually manages. The money saved on zombie subscriptions typically pays for the effort several times over — the closed security gaps are the part you’ll never see, which is exactly the point.