Every team adopts software. Marketing signs up for a design tool, sales connects a prospecting extension to the CRM, and an engineer starts a free trial of a log viewer with a work email. Each one is a vendor holding company data, usually with no review, no owner on record, and no plan for removing it.
That is SaaS sprawl. It is rarely the result of bad intentions. Buying software has become faster than reviewing it, and most teams are measured on getting work done, not on keeping a vendor inventory accurate.
The goal is not to stop teams adopting tools. It is to know what you have, decide which tools stay, and make the approved path quicker than the workaround. This article covers how to find the apps, triage them, retire the ones you do not need, and keep the inventory current.
Why sprawl is a compliance problem
Each unmanaged app creates gaps that auditors and customers look for.
Inventory. ISO/IEC 27001:2022 Annex A control 5.9 expects an inventory of information and other associated assets, with owners. Control 5.23 covers information security for the use of cloud services, including how they are acquired, used, managed and exited.
Vendor management. SOC 2 CC9.2 expects vendor risk to be assessed and managed. An app holding customer data that never went through review is a vendor nobody assessed.
Access. Apps outside SSO keep their own accounts. When someone leaves, those accounts often survive, because nobody knew they existed.
Privacy. If an app processes personal data on your behalf, it may belong in your record of processing activities and on your sub-processor list.
The common failure is the same in each case: an obligation attached to a tool nobody knew to include.
Finding what you already have
No single source finds everything. Combine several, and expect each to catch apps the others miss.
Your identity provider. The application catalog and sign-in logs show every app connected to SSO. It is the easiest list to get and the least complete, because sprawl lives mostly outside SSO.
OAuth grants. Your email and collaboration suite's admin console lists third-party apps users have authorized, with the scopes granted. This is where broad access hides: a small tool with read access to every mailbox.
Finance records. Card transactions, expense claims and accounts payable show what is being paid for, including apps bought on personal cards and claimed back.
Endpoint and network data. If you run an endpoint agent or have DNS or proxy logs, they can show which services are in regular use.
Team leads. Ask each team what they use. A short list from each manager catches tools that left no other trace.
Some discovery methods involve looking at employee activity. Depending on your jurisdiction and employment arrangements, that can raise privacy or works-council obligations. Confirm with counsel before using them, and tell employees what you collect.
Triage: keep, consolidate or retire
Once you have the list, decide what happens to each app. For every one, record:
The owner, a named person accountable for the tool
The users, roughly how many and which teams
The data, what it holds or can access
The integration, how it connects, and with what scopes
The decision, keep, consolidate into another tool, or retire
Apps you keep go through intake like any new vendor. Tier them by the data and systems they can reach, and apply the review that tier requires. Most will land in the lower tiers and need little more than an owner and a short check. A few will turn out to hold customer data and need full review.
Consolidation removes the most work. Three teams with three diagramming tools, or two survey tools holding customer feedback, can usually agree on one. Fewer tools means fewer vendors to review, fewer accounts to remove when someone leaves, and a shorter access review.
Apps with no owner and no clear use should be retired. If nobody will claim a tool, nobody is managing its risk.
Retiring apps properly
Retiring an app is vendor offboarding at small scale. The same steps apply: export what you need, revoke access and OAuth grants at the source, ask for deletion where the app held sensitive data, and update your records. The full process is in offboarding a vendor.
The step teams skip is revoking the OAuth grant. Telling users to stop using a tool does not remove its access to their mailbox or files. Revoke the grant in the admin console, and where your suite supports it, block the app from being authorized again.
Stopping new sprawl
Discovery and cleanup fix the past. To stop the list growing again, change how new tools arrive.
Make intake fast for low-risk tools
If every request takes weeks, teams will route around it. Use a short form, the tiering questions, and a fast path: a tool that touches no sensitive data and needs no integration can be approved the same day with an owner recorded. Reserve full review for tools that reach sensitive data or production.
Require SSO above a threshold
Make SSO a condition for any app that holds sensitive data or has more than a handful of users. It gives you central offboarding and MFA enforcement, which our article on SSO as a compliance control covers in depth. Check the edition: SSO is often limited to higher plans, and that cost belongs in the purchasing decision.
Control OAuth consent
Most collaboration suites let you restrict which third-party apps users can authorize, or require admin approval for apps requesting sensitive scopes. Turning this on is an effective control against sprawl, because it moves the decision to the moment of connection.
Publish an approved catalog
A list of approved tools by category, with what each is approved for, answers most requests before they are made. People looking for a diagramming tool will use the approved one if they can find it.
Keeping the inventory current
Sprawl returns if discovery is a one-off project. Schedule it.
Quarterly, rerun the discovery sources and compare the results with the inventory. New apps go to triage.
At each access review, include the apps that hold sensitive data, so accounts are checked against current staff. Our guide to access reviews that hold up covers the evidence each review should produce.
When an owner leaves, reassign their apps before their account is removed.
AI tools are a common source of new apps, often arriving as features added to tools you already approved. Our guide to keeping an AI system inventory covers how to track them alongside the rest.
Mistakes that bring sprawl back
Banning by default. A blanket ban drives adoption underground, where you cannot see it.
A one-time cleanup. The inventory is accurate for a month, then drifts.
Inventory without owners. A list of apps nobody is accountable for cannot be reviewed, reassessed or retired.
Ignoring free plans and extensions. Browser extensions and free tiers often hold the broadest access and the weakest terms.
How TrustLynce helps
TrustLynce's third-party risk module holds the app inventory with owners, tiers and review schedules, so discovered tools move into the same intake and reassessment process as every other vendor.