How can I use identity governance tools to audit who has access to what across our SaaS applications?

You can use identity governance and administration (IGA) tools to centralize visibility, reviews, and reporting across your SaaS apps. The basic goal is to connect each app, pull entitlement data, map users to access, and continuously certify that access is appropriate.

What to do

1) Connect your SaaS apps to the IGA platform

Use the tool’s connectors or APIs to integrate apps like:

• Microsoft 365
• Salesforce
• Google Workspace
• Slack
• Jira/Confluence
• AWS/Azure/GCP SaaS management if applicable
• HR system / identity source like Workday, Okta, Entra ID, or Google Directory

This lets the IGA tool ingest:

• Users
• Roles
• Groups
• Permissions
• Licenses
• App-specific entitlements
• Admin rights
• Shared mailbox/access permissions
• Resource-level access where supported

2) Normalize access into a common model

Different SaaS apps name permissions differently. IGA tools usually translate them into:

• Identities: who the user is
• Accounts: their app accounts
• Entitlements: groups, roles, licenses, permissions
• Access paths: how they got access, e.g. direct assignment, group membership, role inheritance

This is what makes cross-app auditing possible.

3) Build access inventories and reports

Create reports such as:

• Who has access to which applications
• Who has elevated/admin access
• Who has access to sensitive apps or data
• Which users have stale or orphaned access
• Which entitlements are assigned directly vs through roles/groups
• Cross-app access by person, team, or department

Good IGA tools let you filter by:

• Department
• Manager
• Location
• Role/job code
• Employment status
• Last login/activity
• Privileged access

4) Run access certifications

Set up periodic review campaigns where managers, app owners, or data owners certify:

• “Does this user still need access?”
• “Should this user keep this role/group?”
• “Should this admin privilege remain?”

Use:

• Quarterly reviews for critical apps
• Monthly reviews for privileged access
• Event-driven reviews for joiner/mover/leaver changes

5) Use lifecycle automation

Tie IGA to HR and directory events:

• Joiner: provision based on job role
• Mover: remove old access and grant new access
• Leaver: deprovision everything

This reduces audit findings because access becomes tied to business need.

6) Look for toxic combinations and policy violations

Set policies to detect things like:

• User has both approve and pay roles
• Admin access without MFA
• Contractor with full-time employee entitlements
• Access outside department/job function
• Inactive account with privileged access

7) Export evidence for audits

Most tools can generate audit-friendly evidence:

• Access review completion logs
• Attestation history
• Remediation actions taken
• Exception approvals
• Provisioning/deprovisioning records
• Segregation-of-duties violations

This is useful for SOX, SOC 2, ISO 27001, HIPAA, and internal audits.

Typical workflow

1. Integrate apps and directory/HR sources
2. Import identities and entitlements
3. Map access paths and owners
4. Define policies and certification campaigns
5. Review and remediate exceptions
6. Repeat continuously and report on trends

What to ask of the IGA tool

When evaluating or configuring one, make sure it supports:

• SaaS app connectors/APIs
• Role and entitlement discovery
• Access certification workflows
• Delegated reviews for app owners/managers
• Joiner/mover/leaver automation
• Privileged access visibility
• Policy/SoD checks
• Audit trail and reporting
• Identity graph or entitlement graph views
• Exportable evidence and dashboards

Practical tip

Start with your most critical apps:

• Finance
• HR
• CRM
• Source control
• Production/admin tools

Then expand to the rest of your SaaS estate. This gives you the biggest audit and security value fastest.

If you want, I can also give you:

1. a step-by-step implementation plan,
2. a sample audit report template, or
3. a tool comparison (e.g., SailPoint, Saviynt, Okta, Microsoft Entra ID Governance).