SaaS Apps and Identities: The Asset Classes Most Inventories Miss

Our coverage grid records, for seven asset classes, whether each of the seven tools documents coverage on its own public pages. Laptops are the easiest class. Identities are the hardest, and SaaS apps are close behind. This note explains why, and what the tools that do document them read.

Why can't network discovery see these assets?

A SaaS app runs on the vendor's infrastructure, not on your network. An identity, whether a person's account or a service account, is a record in a directory or an application, not a device that answers a probe. Scanning and passive traffic analysis are the best ways to find unknown devices, but they do not reach either class. That is why tools built around network discovery score well on deployment effort and freshness and still leave these two cells empty or partial in the grid.

What does the coverage grid show?

• SaaS apps: documented fully by 3 tools (Axonius, JupiterOne, and Oomnitza) and partially by 2 (Lansweeper, whose SaaS coverage on the pages we reviewed is AI usage tracking and Device42, which tracks software licenses). runZero and Armis do not document SaaS apps as an asset class.
• Identities: documented fully by 2 tools (Axonius and JupiterOne) and partially by 3 (runZero and Oomnitza, whose integrations feed directory data into device records and Lansweeper, which merges user data into asset records). Armis and Device42 do not document identities as an asset class on the pages we reviewed.

"Not documented" means we did not find it on the vendor's pages, not that the product cannot do it. Ask the vendor directly if either class matters to you.

Where does SaaS data come from?

Axonius describes continuous discovery of sanctioned, unsanctioned and unmanaged SaaS, including shadow apps, OAuth tokens and risky extensions, using data from the identity provider, single sign-on, endpoint telemetry and direct integrations with the apps. It also documents finding orphaned accounts, stale access and unused licenses. ServiceNow's Software Asset Management addresses SaaS sprawl through SSO integrations with identity providers such as Okta and Microsoft Entra ID. Oomnitza covers SaaS as part of a license position for every app, installed or SaaS.

The common thread is that SaaS inventory is built from sign-in and license data, not from the network. An app that nobody signs into through single sign-on, and that no endpoint reports, is the hardest case, which is why endpoint telemetry appears in the list of sources. Our explainer on shadow IT covers the unsanctioned side.

Where does identity data come from?

Directories and identity providers hold user accounts and groups. Cloud platforms, SaaS apps and infrastructure hold their own accounts, many of them non-human: service accounts, API keys and automation identities. Axonius documents discovery of human and non-human identities across directories, cloud, SaaS and infrastructure. JupiterOne lists users and owners among its asset classes and maps relationships between identities and the assets they can reach in its security graph.

Identities matter to an inventory for two reasons. They are assets in their own right, with owners and life cycles, and they are how every other asset gets an owner. Our lesson on asset ownership covers the second point.

What should you check in an evaluation?

• Which identity providers, SSO services and SaaS apps the tool reads, and whether it reads them through direct integrations.
• Whether non-human identities such as service accounts and API keys are inventoried, with an owner field.
• Whether the tool can show unused licenses and accounts with stale access, not only a list of apps.
• How SaaS and identity records are matched to people and devices, so one person with three accounts is not counted three times.
• How often each source syncs.

What does this mean for the ranking?

SaaS apps and identities are two of the seven classes behind our source coverage criterion, which carries 22% of the score. Tools that document both fully score higher on that criterion; tools that focus on network, OT or data center discovery score higher elsewhere. Neither approach is wrong. The multi-compare page puts any two to five tools side by side, class by class.