Identity and access management is changing fast. AI tools spread through companies faster than IT can review them. SaaS access management sits at the center of this. It covers who gets access to which apps, the removal of access when people leave, and monitoring to ensure that employees aren't using apps outside of IT's approval.
This report draws on AccessOwl product data from a sample of 100 companies along with conversations with 450+ IT buyers who evaluated an access management solution.
Key findings
During onboarding new hire gets access to a median of 9 apps, held by 5 different app admins.
During offboarding leaver has to be removed from a median of 17 apps, held by 8 different app admins.
Without a dedicated access management tool, onboarding a new hire by hand takes about 1.5 hours. Offboarding takes about 1 hour.
Only about 3 in 10 apps employees sign into are managed. The median company has about 70 shadow apps out of a median of 110 apps connected to the Google or Microsoft workspace.
About 1 in 7 shadow apps is an AI tool. Among the fastest growing shadow AI apps were Typesafe (Jev), Grokbot, Wispr Flow, and Granola. Claude was the most frequently added AI app into the managed stack.
Creating SaaS accounts for onboarding
A new hire's first day depends on having the right access. Here's how many apps that usually means, and how many people can grant it.
Full-time employees got access to a median of 9 apps beyond their main workspace when they joined.
The main workspace refers to Microsoft 365 or Google. The 9 only counts managed apps set up at onboarding, not shadow apps (n=927 onboardings).
Access to those 9 apps sat with a median of 5 different app admins. Without a central access management tool, that would be 5 people to track down for every new hire. App admins are the people who can grant access in each app (usually managers across different departments).
Removing SaaS accounts for offboarding
When someone leaves, every account they had needs to close. Leavers have almost twice as many apps to remove as new hires get on day one.
Full-time employees had to be removed from a median of 17 apps beyond their main workspace when they left.
The main workspace refers to Microsoft 365 or Google. The 17 only counts managed apps, not shadow apps (n=649 offboardings).
Removing someone from those 17 apps meant going through a median of 8 different app admins. When someone joins, it's 5. Each one would be a person to reach out to when access management isn't automated.
Process | App admins to reach (median) |
|---|---|
Onboarding a new hire | 5 |
Offboarding a leaver | 8 |
Onboarding and offboarding SaaS apps by hand
Before a dedicated tool, most teams run access from a checklist or a ticket queue. Here's what that costs per person.
Without a dedicated tool, onboarding a new hire takes about 1.5 hours. Offboarding takes about 1 hour.
From our talks with 450+ IT buyers evaluating access management, that's the typical time to set up or remove one person's app access by hand. Most of it goes to creating or removing accounts one app at a time. Laptop setup comes on top.
And it's often not an IT person provisioning the accounts. Early on, tracking SaaS access lands on HR personnel, Ops personnel, or engineering personnel that are given IT tasks before the team has a formal IT department.
Apps connected to Google and Microsoft accounts
Not every app goes through IT. Employees can sign up for a tool with their work account in two clicks. Here's how many of those IT actually manages.
AccessOwl's discovery found a median of about 70 shadow apps per company.
Shadow apps (or unmanaged apps) are apps employees signed into or connected with their Google or Microsoft work account in the last 90 days, but that the company doesn't manage. People connect them with "Sign in with Google" or "Sign in with Microsoft", or by giving an app access to their email or files. Managed apps are the ones the company added to its access management, so it tracks who has access.
*Apps people log into with a username/password aren't counted. That's a separate Shadow SaaS vector and would bring the unmanaged app count higher.
Only about 3 in 10 apps employees signed into in the last 90 days were managed. At the median company, employees signed into or connected about 110 apps (across the entire company), and only about 35 of them were managed.
Most of those will be harmless and not every single shadow app requires the attention of the IT or security team. It's impossible to track 100% of the apps that your team is using.
But from our data, of those shadow apps, about 18 had 5 or more people connected to them. Apps like this should raise a flag for your team to review. They may indicate paid licenses outside of IT's visibility or regular usage of an unnaproved app.
Why it matters
Offboarding: blocking someone's work account stops new sign-ins. It doesn't close their account inside each app, or remove the company data in it. The 17 apps in the offboarding stat only count managed apps.
Spend and risk: shadow apps can be duplicates of tools you already pay for, or tools handling company data nobody checked.
Shadow AI
AI tools are the fastest-moving part of the shadow app list. New ones show up every few months, and some spread across companies in weeks.
About 1 in 7 shadow apps are AI tools. About half are everyday business tools. About a third are add-ons and one-offs, which are often noise.
In H1 2026, bolt.new showed up as a new unmanaged app at 27% of companies, just ahead of Wispr Flow at 25%.
In H2 2026 so far, one tool spread faster than any other: TypeSafe (Jev). It showed up as a new unmanaged app at 56% of companies. Almost all of that happened in a single four-week window, from mid-September to mid-October 2026, right around when the developer tool went viral. Kimi was a distant second at 18%, ahead of Higgsfield, Microsoft Copilot and Grok.
Managed AI Tools
Companies do bring the big AI tools under management. In H1 2026, Claude became a new managed app at 40% of companies.
Claude was the AI tool most companies brought under management in H1 2026.
In H2 so far, Wispr Flow leads at 10%. Six months earlier, it was one of the fastest-rising shadow AI tools.
"New" counts companies where the tool showed up, or became managed, for the first time that half. Companies count only if AccessOwl was already running there before the half started: 63 and 80 companies for the shadow AI charts, 65 and 83 for the managed charts. Google's Gemini and generic AI chat apps aren't included.
About the data
This report draws on two sources.
AccessOwl product data: For this report, we took a sample of 100 AccessOwl customers and analyzed how they manage SaaS access. All data is anonymized and aggregated.
Conversations with 450+ IT buyers who evaluated an access management solution. This was used to get a sense of access management before a solution was put in place.
Company size. The 100 companies range from 10 to 1,000 employees.
Industries. They vary, but most are tech companies.
Software (SaaS): about 45%
Fintech and insurtech: about 25%
Healthtech: about 15%
Other, like consumer brands, mobility, energy and real estate: about 15%
Definitions
Term | What it means |
|---|---|
Main workspace | Microsoft 365 or Google Workspace, where employees' work accounts live. |
Managed apps | Apps the company added to its access management, so it tracks who has access. |
Shadow apps | Apps employees signed into or connected with their Google or Microsoft work account, but that the company doesn't manage. Also called unmanaged apps. |
Shadow AI | Shadow apps that are AI-first tools, like Granola or ElevenLabs. |
App admins | The people who can grant or remove access in each app. |
Full-time employees | People marked as full-time in the company's HR data. Contractors aren't included. |
About AccessOwl
AccessOwl helps IT teams manage onboarding, offboarding, access requests and access reviews across all their SaaS apps.
How to cite: "State of SaaS Access Management 2026, AccessOwl", with a link to this page.