How SaaS access management works
SaaS access management is the practice of finding every account and application authorization that exists across an organization’s SaaS environment, deciding which of them should still exist, and removing the ones that should not.
It matters because an identity provider governs the front door — who can sign in — while a large amount of access sits behind that door: accounts created directly in individual SaaS tools, and OAuth grants that third-party applications hold against your Google Workspace or Microsoft 365 tenant. Disabling a person’s primary identity does not automatically retire all of it.
Solvantra works on that downstream layer. It connects to supported providers, builds an inventory of the SaaS accounts and OAuth application grants it can see, flags the ones that look unnecessary or risky, and lets an administrator revoke the grants it supports revoking.
What is SaaS access management?
SaaS access management is the discovery, review and removal of access to SaaS applications across an organization — both the accounts people hold in those applications and the authorizations that applications hold against each other.
It is a narrower discipline than identity governance as a whole. It assumes an identity provider is already in place and already doing its job. The question SaaS access management answers is the one that comes next: given that this person’s identity exists (or has been disabled), what access still exists out in the SaaS estate, and should it?
In practice that means keeping track of three things: which SaaS accounts exist, which third-party applications have been granted access to your tenant, and which of those relationships no longer have a reason to be there.
Why the problem exists
SaaS access accumulates faster than it is removed, for reasons that are mostly structural rather than careless.
Applications are adopted by individual teams without a central procurement step. People authorize third-party tools against their work account with a few clicks, and that authorization persists until somebody explicitly removes it. Accounts get created directly inside an application rather than through single sign-on. Employees change roles, and their old access is rarely the thing anyone remembers to clean up.
None of this is visible from a single console. The identity provider knows about identities. Each SaaS application knows about its own users. Nothing in the middle holds the full picture, which is the gap this category exists to fill. Our solutions overview describes which teams typically own that gap.
The four stages of the workflow
1. Connect
An administrator connects a supported provider. Solvantra currently supports Google Workspace and Microsoft 365 (Entra ID) for OAuth grant discovery and revocation, plus a generic HRIS webhook for termination events. Connection is credential-based and scoped to what the integration needs.
2. Discover
Solvantra builds an inventory of what it can see through those connections: SaaS application accounts, the OAuth application grants held against the tenant, and — where receipt scanning is enabled — SaaS spend visible in mailbox receipts.
3. Review
Discovered access is analysed and surfaced for an administrator to review. The output is a list of accounts and grants that may no longer be needed, with the context behind why each one was flagged — not an automatic verdict.
4. Revoke
Where the provider supports it and an administrator authorises it, Solvantra revokes the OAuth grant through the provider API. Actions run through defined workflows so there is a record of what was changed.
The same four stages appear on every page in this section, applied to a specific problem: employee offboarding, OAuth grant revocation and orphaned SaaS accounts.
Does SaaS access management replace an identity provider?
No. It sits downstream of one.
An identity provider such as Microsoft Entra ID authenticates people, holds the authoritative record of who works at the organization, and controls sign-in. Solvantra does none of that — it is not an SSO provider, it does not issue or hold primary identities, and it does not replace Entra ID or any other directory.
What it adds is visibility and control over the access that exists beyond that record: the application grants and SaaS accounts that an identity provider does not automatically retire when an identity is disabled. The two are complementary, and Solvantra is designed on that assumption.
What Solvantra can and cannot do today
Currently supported
- SaaS application and access discovery
- OAuth app grant discovery and revocation in Google Workspace
- OAuth app grant discovery and revocation in Microsoft 365 (Entra ID) via Microsoft Graph
- Flagging SaaS connections that may be unnecessary or risky
- Administrator review of discovered access
- Receipt scanning for SaaS cost and licence-waste visibility
- A signed HRIS termination webhook that triggers access review
Not available today
- Solvantra is not a full identity governance platform and does not perform access certification campaigns or segregation-of-duties analysis
- It does not act as an SSO or identity provider
- It does not delete the underlying user account when it revokes an OAuth grant
- Discovery covers OAuth-connected applications — password-only accounts with no OAuth relationship are not discovered the same way
- AI-assisted browser remediation is in development and dry-run only; it locates deactivation controls but does not perform the deactivation
- No connectors exist for Okta, Workday, BambooHR, Salesforce, GitHub, Slack or AWS IAM
The integrations page carries the current status of every connector, and the security page covers how these connections are protected.
Common questions
Is SaaS access management the same as identity governance?
No. Identity governance is a broader discipline that includes access certification, policy and segregation-of-duties analysis. SaaS access management focuses specifically on the accounts and application authorizations that exist across SaaS tools, downstream of the identity provider. Solvantra works in the second category and does not claim to be a full identity governance platform.
What does Solvantra actually revoke?
OAuth application grants, through the provider API, in Google Workspace and Microsoft 365 (Entra ID). Revoking a grant removes the third-party application’s authorization against the account. It does not delete or disable the underlying user account, and it does not apply to applications where no OAuth relationship exists.
Do we need to replace anything to use SaaS access management?
No. It is designed to run alongside an existing identity provider and existing SaaS applications. Solvantra connects to supported providers with scoped credentials and reads what those providers expose; it does not sit in the authentication path.
Related reading
See what SaaS access already exists in your environment.
The free assessment walks through the discovery stage against your own SaaS estate.