Everybody’s experienced it. Someone exits the company, and you realise that removing the team member from their access to company tech isn’t as simple as handing in their laptops and phones.
No, today each employee depends on tens, hundreds of different online apps, each of them with their own accesses. Some you’ve managed to close up with a password manager, some are managed with “Sign in with Google” buttons, some might be on SSO, and some just common accounts with passwords shared on a post-it.
Identifying those apps is one thing. Ensuring that everyone is correctly removed from all of them, and that you’ve subsequently cancelled the subscription for each of their SaaS is a whoooole different kettle of fish.
Naturally, savvy IT and Finance leaders turn to employee #2: Google, and fall into the rabbit hole of SaaS Management, Identity Access Management (IdP), and the smoke-and-mirrors presented by overzealous marketing teams. If you’re reading this, you’re probably at that point now.
If you don’t read further, remember this: No SaaS Management tool can automatically create or delete users for you automatically unless all of your apps are on enterprise plans, and all of your apps offer SCIM provisioning. So if you’re an SME, prepare to x4-x10 your SaaS spend.
If you’re curious and want to know why, keep reading.
So it’s technically possible?
For sure. It’s the best friend of any IT team in large corporations or organisations with strict regulatory requirements. They simply plug in their SaaS Management Platform (SMP) with each of their SaaS apps then set up automated workflows to decide when users should be automatically created or deleted on those SaaS.
But…
The way that they do so is by harnessing a technical standard known as SCIM provisioning, or System for Cross-domain Identity Management [provisioning]. This is the only known secure method to connect with your SaaS (via API) and create or delete those users for you.
Great for large companies. Hell, we bet they’d be willing to pay tons to solve a problem that big.
That’s exactly what SaaS executives think, too. That’s why most, if not all, SaaS apps only allow you to access their SCIM API if you’re on their “Enterprise” pricing plan. If you don’t want to head to the Pricing page and Ctrl + F for “Provisioning” and “SCIM”, we’ve collected a few examples 👇
Not on enterprise plans, like the majority of SMEs? Tough luck. You’ll have to onboard and offboard your users manually.
But my SaaS Management Platform has direct app integrations...
They do, but SaaS Management Platforms (SMP) aren't the problem. The issue is that as soon as you try to connect your SMP to any one of your SaaS with priced-off SCIM, you’ll hit an error and have to resort to manual offboarding.
That might not be an issue, so long as your SaaS Management Platform is reasonably priced and allows you to set up SaaS on/off-boarding processes that don’t depend on SCIM. Unfortunately though (noticing a trend?), just like SCIM access, SaaS Management Platforms with direct app integrations and automatic SaaS user provisioning features tend to be high-cost solutions, as the folk that want those features are big corporations.
Single-Sign-On (SSO) will do the job, right?
Just like SCIM provisioning, when SaaS vendors hear the word “SSO” in a demo call, they start salivating. Because yet again, this is the type of requirement that large organizations have, so they’ll also price that off on their enterprise plans.
For a long list of SaaS vendors that price off SSO (sometimes referred to as SAML), check out SSO.tax, but for convenience, we’ve also selected a few apps to demonstrate 👇
Oh, and let’s not forget, adding an SSO solution (Okta, OneLogin etc.) is another subscription to add to your budget.
Single-sign on (SSO) doesn't on/off-board users
Nope, that’s SCIM (Getting sick of the jargon yet?). SSO just means that once you delete the user from your SSO solution, the user will not be able to log in and access the applications you have SSO enabled for (unless, of course, you also have SCIM - see above).
That means that you’ll still be paying for their seats on your subscription. And in some cases, even if you’ve removed their “seat” from your subscription, you’ll still need to log into the billing section of your apps to reduce the number of licences you’re paying for.
Ah, yes - because some SaaS vendors don’t automatically update that according to the number of users on your account. They just consider that your licence hasn’t been attributed to a user, despite that user being removed of their access.
How can SMEs manage SaaS on/off-boarding?
Unfortunately, there’s no magic wand, but there are ways to optimise your SaaS user onboarding and offboarding without breaking the bank.
First, let’s lock down security. Implement some sort of company-wide password manager and ensure that users know the most up-to-date information on good password practices (the NIST password guidelines are a great starting point). That way, should someone leave the company, you can be reasonably sure that they can’t log into any of their (now ex-) apps.
If your SaaS offers it, encourage team members to only login via “Sign in with Google” / “Sign in with Office 365” buttons. That way, you can block all those accesses via your Google or Microsoft admin portal. You’ll still need a password manager as backup for the apps that don’t have that option, though.
Now let's talk about SaaS on/off-boarding for SMEs
The best-in-class process for SMEs is deploying a semi-automated workflow.
As soon as an employee joins or leaves the company, you create a task list for the on/off-boarding tasks and delegate each task to each of your application managers. If Claire is responsible for Asana, she’s responsible for adding and removing everyone there; if Ian is responsible for Notion, he’s responsible for adding and removing everyone from there, etc.
To optimize that process, you’ll first need to have an updated inventory of all your apps and the employees who have access to them. For that, you have two choices:
- Use a SaaS Tracker spreadsheet/Notion template, trigger task workflows by integrating your spreadsheet with some sort of task management tool (Asana, Trello, Notion etc.), then relaunch the app managers who haven’t completed tasks after x days
- Use an SME-compatible SaaS Management Platform to automatically keep an updated SaaS inventory, then trigger optimized on/off-boarding processes via that platform. As an added plus, those SaaS Management Platforms will consistently monitor and remind your app managers who forget to complete their tasks
In LicenceOne, for example (we have to toot our own horn at some point 😛), you’d head to the employee profile you want to offboard, begin an offboarding process, then your application managers will constantly be reminded until your (now-ex) employee is fully offboarded.
Summary
If you want to onboard and offboard users for your SaaS apps as an SME, either:
- x4-x10 your SaaS budget to switch all your SaaS apps to enterprise plans and get SCIM & SSO access, then take an enterprise SaaS Management Platform
- Use a SaaS tracker spreadsheet, pray it’s up-to-date, and launch manual on/off-boarding workflows from there
- Use LicenceOne, optimize your SaaS onboarding and offboarding, and pay a reasonable price for SME-compatible SaaS Management features
If you have questions after reading this article, feel free to shoot us a message in our chat tool on this page. We’re in the business of selling the right tool to the right buyer, not over-selling unusable features and engaging companies in 12-month contracts.
