You can build a useful SaaS inventory in a week from five sources you already have: your single sign-on app list, OAuth consent grants in your identity provider, expense and card statements, sign-up and invoice emails, and browser extension reports. Merge them into one sheet with an owner for each app.
Why start with an inventory
You cannot review settings, access or contracts for tools you do not know about. Most SaaS exposure begins with a tool someone signed up for in five minutes and then forgot, still holding company data or a connection into a core system.
Source 1: single sign-on
List every app configured in your identity provider. These are the known ones. Note which use SSO login and which have local passwords on the side.
Source 2: OAuth grants
When a person clicks "sign in with" or "connect to" another tool, they often grant it access through OAuth. Microsoft documents that apps added to an Entra tenant through user or admin consent can be reviewed, and that permissions can be revoked. Google Workspace and other platforms have comparable admin views. Export the list of third-party apps with grants and the scopes they hold. See the Entra walkthrough.
Source 3: finance records
Card statements and expense reports show spend on tools that never touched IT. Search for recurring small charges and vendor names you do not recognise. Free tiers will not appear, so this source misses them.
Source 4: email
Search shared mailboxes and finance inboxes for terms like "welcome to", "your invoice", "verify your email" and "your trial". Treat results as leads.
Source 5: browser extensions and devices
If you manage browsers, export the installed extension list. Many extensions connect to online services and hold data. Device management reports may also list installed desktop apps with cloud sync.
The merged sheet
Columns to keep:
- App name and vendor
- Owner (a person)
- Business purpose
- Data it holds
- Login method (SSO, local password, OAuth only)
- Connected systems
- Date last reviewed
- Decision: keep, replace, remove
Triage
- Remove apps nobody can justify.
- Move the rest behind SSO where the vendor supports it.
- Reduce excess permissions on connections.
- For apps with sensitive data, read the vendor's security documentation and decide whether more review is needed.
Keep it current
Add "register the tool" to your procurement and onboarding steps, and rerun the five sources each quarter. Any app found by a source but missing from the sheet is a process gap to close.
Aim for completeness over precision in the first pass. An entry with an unknown owner is still useful, because it tells you where to ask.
Where Safeguard fits
Safeguard offers asset discovery, vendor-related compliance evidence automation, and policies for software you build. It is not a SaaS security posture product and does not claim to be.
Quick check
Do I need a tool for this?
Not to start. A spreadsheet and the five sources get you most of the way. Tools help once the number of apps and staff makes manual review slow.
Sources
Last reviewed: 19 October 2026.
