Documenting SaaS Sprawl: Finding the Tools Your Company Actually Uses

Ask IT how many SaaS tools the company uses and you'll get a number. The real number is higher. It's always higher.

Marketing has three tools nobody approved. Finance subscribed to something last spring. A project manager signed up with a company card and the account recovery goes to their personal email. None of it is malicious. All of it is invisible.

The risk isn't that these tools exist. It's that they exist and nobody knows: unknown data in unknown systems, accounts that survive offboarding, renewals nobody negotiates, and a security surface you can't defend because you can't see it.

Why this is a documentation problem

You can't secure what you don't know exists. You can't shut off access for a departing employee in a system you've never heard of. You can't answer a security questionnaire honestly, or a data-breach question at all, when the tool inventory is a guess.

SaaS sprawl documentation is not glamorous. It's a list. But it's the list that turns "we think we know what's running" into "here's what's running, who owns it, and how we'd turn it off."

How to find what's actually in use

No single source finds everything. Four of them together find most of it:

The expense reports. Start here. Monthly card statements and expense reimbursements surface most paid tools in an hour. Look for the small recurring charges: $12 a month, every month, to a vendor nobody recognizes.

The identity provider. If you run SSO through Entra, Google Workspace, or Okta, the sign-in and consent logs show which third-party apps people actually authenticate to, including OAuth grants to tools that never went through IT.

The network. DNS queries and egress logs show the services devices are talking to. Noisier, but it catches the free-tier tools that never touch an expense report.

The people. Ask department heads what their team actually uses to get work done. Which brings up the most important part:

Amnesty beats audit

If discovery feels like an investigation, people hide tools, and hidden is the one thing you can't afford.

Frame it the other way: nobody is in trouble, nothing gets taken away by default, IT just needs to know what's running so security and offboarding work. The goal is a known inventory, not an approved one. Approval conversations can come later, tool by tool, once you can see the landscape.

The teams that get honest answers are the ones that make disclosure cheap and confiscation rare.

What to record about each tool

One record per tool, eight fields:

• Name and vendor
• Business owner. The person in the department who answers for it. Not IT.
• What it does, in one sentence
• Who has access, roughly: a team, a department, three people
• How people sign in. SSO, shared account, personal emails. Personal-email accounts are your offboarding gap; flag them.
• What data lives in it. Customer data, financials, just scheduling? This field is what makes the inventory useful in a security review.
• Cost and renewal date
• How to kill it. Who can export the data, cancel the subscription, and delete the accounts.

That last field is the one nobody writes and everybody eventually needs, either at offboarding, at renewal, or the day the vendor has a breach.

Keeping it current

A sprawl inventory decays like any other documentation. Two mechanisms keep it alive:

A quarterly sweep. Rerun the expense-report and identity-provider checks. New charges and new OAuth grants against the inventory take an hour a quarter.

An intake path easier than going rogue. If getting a tool acknowledged takes a two-minute form, people use it. If it takes a committee, they use the company card. The intake path is not a gate; it's a registration desk.

Start with the list you can build today

Pull last month's card statements this week. You'll find tools you didn't know about, a subscription that should have been canceled a year ago, and at least one renewal worth renegotiating.

That's the pattern with sprawl: the first pass pays for itself, and every pass after that is maintenance. The only losing move is continuing to guess.