How to Create a Third-Party SaaS Approval Policy for SMB Clients Without a defined approval process, SaaS adoption can quickly become uncontrolled. This leads to shadow IT, duplicated tools, rising costs, and increased security risks. In this video, we'll outline how to create a third-party SaaS approval policy for SMB clients. Before we begin, be sure to subscribe to NinjaOne's IT video hub and our YouTube channel for more tech content like this. Streamline SaaS Evaluation for Clients Step 1: Define Scope and Evaluation Criteria Start by defining what types of applications require approval and how they will be evaluated. For most SMBs, this typically includes all third-party SaaS applications, or at minimum, any app handling sensitive or business-critical data. Evaluation criteria ensure every request is reviewed consistently. These criteria should focus on: security posture, compliance alignment, data handling practices, cost and licensing, and business relevance. Step 2: Create a Standardized Request and Review Workflow Next, build a consistent process for submitting and reviewing SaaS requests. Start with a simple request form that captures only essential details. All requests should be routed into a centralized system to maintain visibility and tracking. From there, apply a risk-based approach: Low-risk requests can be reviewed quickly with minimal overhead. Medium-risk requests require validation from both technical and business stakeholders. High-risk requests require deeper evaluation, including security and compliance review. Assign clear response timelines to prevent bottlenecks. For example, low-risk apps might be reviewed within one business day, while high-risk evaluations may take up to a week. Step 3: Assign Roles and Approvers Each stage of the approval process should have designated roles responsible for decision-making. At a minimum, this includes: requester, business owner, technical reviewer, finance or procurement, final approver. Clear role assignment prevents delays, supports accountability, and creates a documented audit trail for compliance purposes. MSPs typically serve as technical advisors throughout this process, providing guidance on security, risk, and implementation considerations. Step 4: Implement a Risk-Based Decision Matrix To standardize decisions further, introduce a risk-based decision matrix. A typical model includes three tiers: Low risk: approved with standard controls such as MFA and least-privilege access. Medium risk: requires pilot testing and partial restrictions before approval. High risk: may require vendor review, extended testing, or outright rejection. Each tier should also define required controls, approvers, and expected response times. Step 5: Communicate Decisions and Enforce Controls Once a decision is made, communicate it clearly to all stakeholders. Approval or denial should always include the rationale along with any required next steps, such as security configurations or usage restrictions. For approved applications, enforce baseline controls immediately. This includes enabling MFA, applying least-privilege access, and activating audit logging where available. Step 6: Schedule Regular Reviews and Renewals Finally, establish an ongoing review process. SaaS environments are constantly changing, so approvals should not be treated as permanent. At regular intervals, reassess each application based on usage, cost, and risk. This includes reviewing actual app usage, revalidating vendor security, reviewing compliance documentation where applicable, and evaluating whether the tool still delivers business value. Based on these findings, you can decide whether to renew, right-size, or retire the application. Creating a third-party SaaS approval policy gives SMB clients a structured way to adopt new tools without introducing unnecessary risk or cost. The goal is for MSPs to maintain control while still supporting business agility. For more information, check out our official blog post on how to create a third- party SaaS approval policy for SMB clients, linked in the description below.