Infotech’s reported acquisition of Bengaluru-based Zluri, described as a move to expand SaaS management and identity governance capabilities, reflects the convergence of application visibility and access control. Organisations often buy governance tools to manage entitlements, yet struggle first to understand which cloud services employees use, who owns them and how access is granted.
The visibility gap
Software-as-a-service adoption can outpace procurement and security review. Teams sign up for tools independently, employees change roles, and contractors retain accounts after projects end. Identity records may be accurate in the core directory while application accounts and permissions drift elsewhere. This creates a blind spot for IGA: a campaign cannot review access that the organisation does not know exists.
SaaS management can help identify applications, usage and ownership. Combined with identity governance, that information could support a more complete view of who has access, why they have it and whether it remains appropriate. But convergence alone does not guarantee control. Discovery data must be reconciled with authoritative identity sources and translated into decisions with accountable owners.
From discovery to governance
A robust operating model begins by inventorying applications and classifying them by sensitivity, business criticality and data handled. It then identifies the business owner and the identity attributes used for account matching. Automated provisioning and deprovisioning should follow only after those foundations are reliable. Otherwise, automation can efficiently create incorrect accounts or remove access from the wrong person.
IGA teams can use SaaS visibility to prioritise high-risk applications for access reviews. They can flag dormant accounts, excessive permissions, orphaned identities and applications with no clear owner. Usage signals may help reviewers distinguish active business needs from inherited access, but usage should be treated as evidence, not as the sole basis for revocation.
Lifecycle processes are equally important. When an employee joins, changes role or leaves, access should be granted or withdrawn through defined workflows. For externally managed SaaS applications, the process must include a verified response from the application or a documented control when automated removal is unavailable. Exceptions need owners, expiry dates and periodic review.
Integration and accountability
Buyers considering a combined SaaS management and IGA approach should test how accurately the solution matches accounts to people, handles duplicate identities and captures entitlements. They should confirm that approval evidence, review decisions and remediation actions are auditable. Integration should also preserve role-based access controls and avoid granting broad administrative permissions to the governance platform itself.
Useful programme measures include the proportion of discovered applications with named owners, time to remove access after termination, number of stale accounts, review completion quality and the volume of unresolved exceptions. Such metrics reveal whether visibility is changing risk, rather than merely producing a longer inventory.
The acquisition may bring complementary capabilities under one umbrella. Its value to customers will depend on how well discovery, identity lifecycle management and access certification work together in real environments, with reliable data and clear operational responsibility.