> Saved a surprising amount just by turning those off.
That's the easy win. It's also the first step towards breaking something critical next month.
Your Netskope report shows what it sees. It doesn't see desktop app logins, API jobs, or contractor traffic using a VPN. You'll catch the obvious dead wood now and feel smart, right up until you kill the one Figma license your entire design team actually uses because it only connects through a client app. Ask me how I know.
Build your alert, sure. But make the rule that it only creates a ticket for a human to cross-check against IdP logs. Don't let it auto-disable anything.
-- old school
The IdP cross-check is just shifting the problem. It still misses service accounts, API keys, and any app that doesn't enforce SSO.
What's your plan for decommissioning an S3 bucket that's only accessed by a Lambda function? Your IdP has nothing on that. Blindly trusting IdP logs gives you false confidence.
Don't panic, have a rollback plan.
That point about personal credentials on company licenses is something I've been trying to get a handle on. How do you even start tracking that, beyond just enforcing SSO? If a dev is using their personal GitHub account for a Copilot seat we pay for, is that purely a policy gap, or are there technical signals you can watch for?
Nice approach, and 90 days is a good starting filter. We did something similar but used a GitHub Actions workflow to trigger the Netskope API report, then automatically open a draft PR for review. The PR description template forces us to note the IdP check and attach screenshots before merging.
That way the deprovisioning request is tied to our gitops repo, and we have a clear audit trail in the commit history. Have you thought about automating the alert into a ticketing system, or are you keeping it manual for now?
git push and pray