Why should SaaS apps and identities count as assets?

What counts as a SaaS or identity asset?

On the SaaS side: every application people use, whether IT approved it or not, the OAuth tokens that connect apps to each other, browser extensions with access to data, and the licences you pay for. On the identity side: every human account, and every non-human one, such as service accounts, API keys and automation identities.

Axonius describes discovering sanctioned, unsanctioned and unmanaged SaaS, including shadow apps, OAuth tokens and risky extensions, and human and non-human identities across directories, cloud, SaaS and infrastructure. ServiceNow's Software Asset Management covers SaaS sprawl with SSO integration for Okta and Microsoft Entra ID. JupiterOne lists users and applications among the asset classes in its graph.

Why can agents and scans not see them?

A SaaS app runs on someone else's infrastructure. A service account is a row in a directory. Neither has a network interface on your network or a device to install an agent on. The evidence of their existence lives in APIs: the identity provider's sign-in logs, the SSO catalogue, the SaaS vendor's admin API, and sometimes the browser or endpoint telemetry that shows which apps people open.

That is why the finder adds points to CAASM aggregation when you tick SaaS applications and identities: the connector approach is the one that reads those APIs.

What gaps matter most?

• Orphaned accounts. Accounts belonging to people who left, or service accounts nobody can explain.
• Stale access. Accounts that have not been used in months but still have access.
• Unapproved apps. Apps holding company data that nobody reviewed.
• Unused licences. Not a security gap, but a cost one, and often the easiest way to fund the work.

How do you start without boiling the ocean?

Begin with the identity provider and SSO, because they already know most apps and accounts in use. Add the two or three SaaS applications that hold the most sensitive data, then the cloud accounts. Review orphaned and stale accounts first, since closing them reduces risk quickly and needs no new purchase. Only then widen to browser extensions and OAuth tokens, where the volume is high and the judgement calls are harder.

Who owns the fixes?

Rarely one team. The identity team owns accounts, procurement owns licences, security owns risky apps, and each business unit owns the apps it bought. Many owners is a strong signal for an inventory that can route gaps to the right person, which is why the finder triggers the workflows check when you say owners are often unknown.

What next?

If SaaS and identities are a large part of your estate, tick them in question 01 of the finder and read CAASM aggregation.