How to Build a SaaS Inventory Using the Tools You Already Have

To build a SaaS inventory without a dedicated platform, combine three data sources: identity provider logins, firewall or proxy logs, and finance or expense records. Merge them into one spreadsheet or database, refresh it on a schedule, and review it with each client at business reviews. Each source catches apps the others miss, so the combined record shows what is used, what is paid for, and what no one approved.

Saas offers convenience and flexibility, but many Managed Service Providers (MSPs) and their clients lack the budget for dedicated SaaS management platforms, which leaves gaps in their SaaS inventory.

This article explores how MSPs can repurpose existing data sources to gain SaaS visibility cost-effectively, without the need for expensive tools.

Building a SaaS inventory with existing tools

Building a SaaS inventory with existing tools and data requires a structured approach. Key steps include collecting usage data, capturing network signals, incorporating financial records, consolidating the inventory, automating updates, visualizing and reporting findings, and embedding the inventory into client governance processes.

Prerequisites:

• Access to client identity provider (IdP) logs
• Firewall, proxy, or secure web gateway logs
• Finance/expense management data or credit card statements
• Reporting tools
• Microsoft Entra ID P1 or P2 licensing on the client tenant, if the client uses Entra and you want the Usage and insights report

Steps at a glance

Step 1: Collect SaaS usage data from identity providers

IdPs like Okta and Microsoft Entra are the gateways to most SaaS applications. Since users’ login flows through them, these IdPs become the centralized source of SaaS usage data.

Use Case: An MSP managing a 200-seat client wants to understand which SaaS applications are actively used. By pulling login reports from Microsoft Entra, they can quickly identify applications accessed, frequency of use, and licensed users.

Export login activity from IdPs

Pull reports from Okta, Entra ID, or other identity providers configured for single sign-on. These reports usually have the app name, user ID, login frequency, and authentication type.

In Okta, the Application Access report queries the system log for single sign-on events and exports to CSV. In Microsoft Entra, the Usage and insights report under Enterprise applications gives an application-centric view of sign-in data.

Capture key SaaS usage details

Track and document the following usage details:

• Application name: The accessed SaaS tool
• User identity: Which employee is logging in, tied to email or account
• Login frequency: How often users engage with the application
• License agreement: Whether the user has an active license

Form a baseline SaaS inventory

Form a baseline SaaS inventory using the login activity and usage details collected. Use the login data as the authoritative dataset for centrally authenticated SaaS usage, then map out adoption trends across departments and roles. Afterward, highlight unused or duplicate tools for cost optimization.

Use built-in reporting tools

The Microsoft Entra Usage and insights report requires an Entra ID P1 or P2 license. The Okta Application Access report reads the system log, and Okta retains events for 90 days, so export reports on a schedule before older data ages out. Confirm how long each client tenant retains sign-in logs, and export them regularly if retention is short.

Important: Apps not tied to IdP may result in incomplete coverage and missed shadow IT. (For more info, refer to: Things to look out for)

Step 2: Capture network and browser-based clues

While many SaaS applications run through an IdP, some employees adopt tools by signing up directly, thus creating shadow IT. Capturing network and browser data helps find these hidden applications.

Use Case: An MSP reviews firewall logs for a client and discovers frequent traffic to Trello, even though it’s not on the approved SaaS list.

Analyze firewall or proxy logs

Scan for outbound traffic to well-known SaaS domains, such as Slack and Zoom, then look for usage patterns that suggest regular employee adoption.

If the client already licenses Microsoft Defender for Cloud Apps, Cloud Discovery can analyze traffic logs from firewalls, proxies, or Defender for Endpoint against a catalog of more than 31,000 cloud apps. By default, it cannot discover apps that are not in that catalog, so keep a manual review for unfamiliar domains.

Leverage browser telemetry

Pull browser telemetry to see what SaaS tools employees access. Secure web gateways can enrich this data by categorizing traffic and showing app-specific trends.

Surface apps outside of SSO

Identify SaaS tools not authenticated via IdPs and flag them as potential shadow IT or unmanaged subscriptions for review.

While IdP exports capture centrally authenticated SaaS usage, network analysis exposes missed tools. This step ensures the SaaS inventory reflects sanctioned and unsanctioned applications. Merging the two datasets enables MSPs to present clients with an inventory that covers known and hidden SaaS activity.

Step 3: Add financial and expense data

Finance data allows MSPs to see what people paid for, which helps spot SaaS that slips past the IT team.

Use Case: An MSP reviews a client’s card statements and finds recurring charges to multiple whiteboarding apps. After reconciling with IdP and network data, they consolidate to one tool and cut duplicate spend.

Collect finance sources

Export from expense and AP systems and pull credit card statements. Include the vendor’s name, transaction date, amount, currency, cardholder, memo, and other helpful information.

Identify recurring SaaS spend

Flag monthly or annual patterns and similar amounts per vendor. Separate subscriptions from one-off charges for better visibility and tracking. Lastly, mark potential auto-renewals based on cadence.

Cross-check with IdP and network datasets

Cross-check the finance data against the other two datasets:

• Match by app: If finance shows Figma, but IdP or network shows no use, investigate shadow IT or unused license.
• Match by user or department: Join cardholder or expense submitted to the directory info to find an owner.

This step expands visibility from ‘what’s used’ (steps one and two) to ‘what’s used and paid for.’ Merging finance with IdP and network enables you to confirm actual adoption (used + paid), waste (paid + unused), and risk (used + unpaid or unactioned).

Warning: Vendor name inconsistencies or exposure of sensitive finance data may result in client mistrust. (For more info, refer to: Things to look out for)

Step 4: Combine into a central inventory

This step is where you centralize everything into an authoritative SaaS inventory.

Use Case: An MSP gathers multiple exports, but the information is scattered. By consolidating into one structured spreadsheet, they deliver a client-ready inventory that’s easy to manage and present.

• Combine entries into a spreadsheet, documentation tool, or low-code database.
• Standardize app names to unify variations. For example, Microsoft Teams is sometimes called MS Teams or Teams.
• Deduplicate records across data sources to avoid double-counting.
• Include key fields in the inventory for consistent tracking:
  • Application name
  • Owner or department
  • License status (Active, Trial, Expired)
  • Renewal date
  • Risk or compliance tag
  • AI features (yes or no)
  • Data access granted (such as OAuth scopes)

A sample inventory record looks like this:

This step gives MSPs and clients a shared view of the SaaS environment and a single record to build reports, automation, and governance on.

Step 5: Automate refreshes where possible

Manual updates are error-prone and time-consuming. Automating this stage ensures the SaaS inventory remains accurate and sustainable.

Use Case: An MSP sets up scheduled exports from Microsoft Entra and QuickBooks. A simple script parses the CSVs and updates the master inventory weekly, ensuring clients see the latest SaaS usage and spend.

• Set scheduled exports from IdPs, finance systems, or secure web gateways.
• Export identity provider reports before log retention windows close. Okta, for example, retains events for 90 days.
• Write scripts to clean and import CSV into the central inventory.
• Automate merges so new data aligns with existing app records, owners, and renewal fields.
• Establish weekly or monthly update frequency, depending on client size and SaaS activity.

Automation keeps the inventory a living system rather than a static report. Limiting manual updates frees technicians for higher-priority work.

Important: Ensure you monitor automation logs and set alerts for failed runs to avoid outdated or missing data caused by broken scripts. (For more info, refer to: Things to look out for)

Step 6: Visualize and report findings

This step ensures clients gain valuable insight, as you turn the SaaS inventory into clear visuals and reports.

Use Case: An MSP builds a Power BI dashboard showing the SaaS spending by department. During a governance meeting, the client sees that Marketing pays for multiple design apps, prompting a consolidation decision.

This step requires using reporting tools like Microsoft Excel, Google Sheets, or visualization platforms. Create key views that highlight totals by:

• Application
• Department
• License type (Active, Trial, Expired)
• Renewal status and upcoming dates
• AI-enabled applications

You also want to highlight trends in usage vs. spending to show underutilization or duplication. Share snapshots with clients during Quarterly Business Reviews (QBRs) or monthly governance calls. Visualization makes the inventory actionable, transforming a static list into a tool clients can interpret. This step helps MSPs demonstrate value.

Step 7: Embed inventory into client governance

A SaaS inventory delivers the most value when it becomes part of ongoing client governance rather than a one-time project.

Use Case: An MSP includes SaaS inventory findings in a client’s QBR. The MSP guides the client toward cost savings and improved compliance by highlighting redundant collaboration tools and upcoming renewals.

Present SaaS inventory during QBRs, monthly governance calls, or compliance reviews. Spotlight the following themes if possible:

• Cost optimization opportunities
• Redundant applications
• Risky or unapproved apps

Afterward, you want to tie the findings to action items so the client leaves with clear next steps. Update governance materials so the inventory becomes a recurring agenda item with endpoint health, backup status, and security posture.

This step turns the inventory into a tool that supports cost control, risk management, and strategic planning.

Shadow AI and OAuth access in your SaaS inventory

AI tools are a fast-growing part of SaaS sprawl. The BetterCloud State of SaaS 2026 report found that organizations deploy an average of 27 AI-powered SaaS applications, and the Torii 2026 SaaS Benchmark Report found that AI tools often bypass procurement, security reviews, and identity controls.

The sources in this guide still apply, with a few additions:

• Identity provider logs: Review sign-in and consent activity for AI tools. In Microsoft Entra, audit logs for enterprise applications can show who gave consent to an application.
• Network and browser data: Look for traffic to AI tool domains that are not on the approved list.
• Finance data: Look for new recurring charges from AI vendors, including usage-based charges that change from month to month.
• Inventory fields: Record whether each app includes AI features and what data access was granted, so reviewers can spot risky grants.

Best practices when building a SaaS inventory

When building a SaaS inventory, follow these practices to ensure it remains client-friendly, transparent, and accurate.

What to watch out for when building a SaaS inventory

NinjaOne services that help build a SaaS inventory

You can use the NinjaOne inventory, custom field, and reporting functions to add SaaS tracking to existing workflows.

Device inventory exports

NinjaOne’s device inventory exports let you view endpoint-installed applications across client environments. Software inventory reports cover installed software, usage, product keys, and updates across the network. Combining this endpoint data with SaaS usage records allows MSPs to capture locally installed tools and cloud-hosted services.

Integrating NinjaOne this way helps identify redundancies, unmanaged licenses, or shadow IT.

Customizable fields

NinjaOne has custom fields that track SaaS-specific information, such as license owner, subscription renewal dates, cost centers, or security compliance notes.

Incorporating SaaS inventory data into existing documentation or ticketing workflows ensures that technicians and account managers have this information readily available.

License tracking

NinjaOne IT Asset Management tracks software license purchases, consumption, and renewals, with alerts for insufficient licensing and upcoming expirations. IT Asset Management must be enabled before use.

Reporting tools

QBRs let MSPs demonstrate value to their clients.Adding SaaS inventory insights to NinjaOne reports gives MSPs a consistent way to share findings with clients.

Highlighting SaaS cost savings, security gaps, or consolidation opportunities adds strategic value.

Strengthen governance by building a DIY SaaS inventory

You can build a SaaS inventory using the tools you have at your disposal. Combining SSO logs, network records, and financial data allows MSPs to construct an inventory that reduces shadow IT risks and optimizes SaaS spend.

With NinjaOne, you can keep your inventory alongside strong endpoint data and improved software visibility.

Related topics:

• Software Inventory Reports
• What Is Inventory Management?
• IT Asset Inventory: Definition, Management, & Best Practices