SaaS Management brings every employee account and every SaaS access into one place. Use it to see which SaaS your company runs, create and remove accounts as people join and leave, and keep track of licences and costs.

Feature/Functionality

Overview

Setting up SaaS Management takes three steps, in this order:

• Connect your email provider. Google Workspace or Microsoft Entra ID. This switches on SaaS discovery, automatic account creation and identity sync.
• Activate SaaS discovery. Find the SaaS your employees actually use, through Google Workspace, Microsoft Entra ID or the Factorial IT Chrome extension.
• Connect your SaaS. Link a SaaS from the catalogue with SSO, SCIM or API credentials, so its accounts are created and removed for you.

How to use

1. Connect Google Workspace or Microsoft Entra ID. See "Connect your email provider".
2. Turn on SaaS discovery, then open SaaS > Directory to see what was found.
3. In SaaS > Directory, click Add a SaaS and connect the SaaS you want to manage automatically.
4. For each connected SaaS, write a provisioning rule so new joiners get the right access.

What you can do

• Set one provisioning rule per SaaS. At onboarding, Factorial IT suggests the accounts, licences, groups and roles each new joiner should get. It also flags accounts that break the rule.
• Cut access at offboarding. Revoke the leaver's accounts and hand their Drive files and emails over to someone else.
• Connect any SaaS with SAML SSO. If a SaaS supports SAML single sign-on but is not in the catalogue, add it as a custom SAML SaaS.
• Spot waste and risk. See shadow IT (tools nobody approved), licences no one uses, and the SaaS each employee works with.

Glossary

Single sign-on (SSO). One set of credentials opens several SaaS. Example: an employee signs in to Notion with their Google account.

System for Cross-domain Identity Management (SCIM). A standard that lets the identity provider create, update and delete accounts in a SaaS without anyone doing it by hand.

Just-in-time (JIT) provisioning. The SaaS builds the account itself the first time the employee signs in through SSO. Notion, Asana and Zoom work this way.

SSO tax. The extra charge some vendors add before they let you use SSO or SCIM. The SSO Wall of Shame (sso.tax) keeps a list of them.

Troubleshooting and FAQ

Troubleshooting

• The Directory is empty. Your email provider is probably not connected yet, or discovery is not on. See "Activate SaaS discovery".
• A SaaS you need is not in the catalogue. Connect it as a custom SAML SaaS if it supports SAML SSO. Otherwise, track it manually.

FAQ

1. What is the difference between SSO and SCIM?
   SSO handles how employees sign in. SCIM handles the accounts themselves: creating, updating and deleting them.
    
2. Do I need SCIM if the SaaS supports JIT provisioning?
   JIT creates the account at first sign-in. It does not cover updates or removals, which is what SCIM is for.
    
3. Why does a vendor ask me to upgrade before I can use SSO?
   That is the "SSO tax": some vendors keep SSO and SCIM for their more expensive plans.