SaaS inventory · Microsoft 365 and Google Workspace

Everyone needs the list. Nobody wants to build it.

FailSafe reads your Microsoft 365 or Google Workspace tenant and builds the list: every app, who uses it, how it got in, and what it can reach. For the team with an auditor on the calendar, the IT manager who inherited the spreadsheet, and the MSP who is tired of asking the client.

Run the free scan Read a sample audit→
free preview up to 80 users, no card · paid plans from $49 / mo · read only, no agents
By the numberssources
152

SaaS apps in use at the average company under 500 employees.

70%

Of SaaS spend now sits with lines of business, not IT.

75%

Of employees will acquire, modify, or create technology outside IT's visibility by 2027, up from 41% in 2022.

89%

Of organizations breached through SaaS believed they had appropriate visibility at the time.

Three partial lists. No complete one.

The directory shows what is connected. Finance shows what is paid. Inboxes hold the sign ups nobody mentioned. Each one is right, and none of them is the list.

SOC 2 prep

The startup with an auditor on the calendar.

The auditor wants a system inventory with owners. The spreadsheet from the last fundraise is stale, and the person who built it has moved on. FailSafe builds the list from the tenant itself, maps it to the frameworks, and gives you a PDF to hand over.

Internal IT

The IT manager who inherited the spreadsheet.

You know the apps you set up. You do not know the ones a department head signed up for last quarter, or the free tier with customer data in it. FailSafe cross references the directory, mailboxes, and the books, and keeps the result in one place.

MSP

The MSP who relies on the client to gather it.

Onboarding starts with a questionnaire the client never finishes. Connect the tenant read only and FailSafe produces the inventory without the back and forth, with a report ready for the first business review.

What one row of the inventory holds.

Not a list of names. Each app comes with the context you need to decide what to do about it.

Field What it tells you
App and vendor The product by name, with its vendor and category, matched against a catalog of thousands of SaaS vendors.
Users Who has it, by account, so you can find the owner and the stragglers.
How it got in The layer that found it: directory, email, finance, or endpoint. One source is a gap worth a look. All of them means approved and tracked.
What it can reach OAuth scopes and admin consent on every connected app, so you can see which ones can read mail, files, or the directory.
Status Sanctioned or unsanctioned, with an approve workflow so the list becomes a decision record instead of a snapshot.
Vendor security SOC 2 and ISO status, breach history, and SSO and MFA support, from public records.
Cost What you pay for it, when the finance layer is connected (Discover plus Spend).
The inventory view, sanitized
FailSafe dashboard, SaaS inventory view

Four sources, cross referenced.

Read only connections to platforms you already run. Transparent and revocable.

Layer 01
Identity.
01

Read only access to the admin directory. Every connected app, user, admin role, and license.

Layer 02
Email.
02

Adoption signals from mailbox indicators: the sign ups and receipts that never touched the directory. Never personal correspondence.

Layer 03
Financial.
03

An accounting or transaction export, matched against the discovered tools. Catches what is paid for but not connected.

Layer 04 · Optional
Endpoint.
04

Installed app inventories from your endpoint tools. Catches what cloud APIs can not see.

Why cross referencing matters

No single source gives the full list. The value is in connecting the signals. An app in the directory with no payment and no email is usually a free tier with company data inside. A payment with no directory entry is a subscription IT does not know about.

The inventory controls, by framework.

Every major framework starts with the same question: what do you run? FailSafe maps its findings to these in the report.

Framework Control What it asks for
SOC 2 CC6.1 Identify and manage the inventory of information assets, as a point of focus under logical access.
ISO 27001:2022 Annex A 5.9 An inventory of information and other associated assets, with owners.
CIS Controls v8 Control 2, Safeguard 2.1 Establish and maintain a detailed software inventory: title, publisher, install date, and business purpose.
NIST CSF 2.0 ID.AM-02 Inventories of software, services, and systems managed by the organization are maintained.
A note on evidence

What your auditor accepts is their call. A current list, with who uses each app, is what they usually ask for first, and that is what the scan produces. The report ships with the crosswalk to NIST CSF 2.0, CIS v8, SOC 2, and ISO 27001:2022.

Free preview, then the full inventory.

The free scan runs the real pipeline on your tenant and shows you the shape of the result. Paid plans show you every row.

Free · up to 80 users, no card

The shape of your inventory.

  • Identity and email discovery across Microsoft 365 or Google Workspace
  • App counts by category and the five busiest apps by name
  • Your top three findings and your posture score
  • A three page watermarked PDF of the preview
  • Unlock the full report any time, no rescan needed
Discover · from $49 a month

Every row, with the detail to act.

  • Every app by name, with its users and the layer that found it
  • Full findings with remediation steps and the affected accounts
  • OAuth audit with scopes, holders, and consent
  • Vendor security intelligence and the compliance crosswalk
  • The audit ready executive PDF
Discover plus Spend adds the finance layer. Complete adds endpoints and is unlimited. See pricing

Questions we get before the first scan.

Does the free scan need a card?

No. Connect, scan, and read the preview with no card, for tenants up to 80 users. Upgrade later and the full report regenerates from the same scan, no rescan needed.

What access does FailSafe need?

Read only. Microsoft 365 connects through an admin consented app registration and Google Workspace through domain wide delegation to a service account. Both are revocable from your admin console at any time, and FailSafe never writes to your tenant.

Will this satisfy my SOC 2 auditor's inventory request?

FailSafe gives you the inventory and a report mapped to SOC 2, ISO 27001:2022, CIS v8, and NIST CSF 2.0. Whether a given artifact is sufficient evidence is your auditor's call. Most ask for a current list with who uses each app, and that is what the scan produces.

Does it catch apps bought on a personal card?

Often, yes. The email layer reads sign up and receipt signals from mailboxes, never personal correspondence, so a tool adopted on a personal card shows up as an unsanctioned entry even though it never touched the directory or the company's books.

See what your business actually runs on.

Connect Microsoft 365 or Google Workspace, read only and revocable. The free scan shows you the shape of the inventory today.

Run the free scan Read a sample audit→
free preview up to 80 users · paid plans from $49 / mo · monthly or annual billing

Sources for the figures above. 152 apps and 70% of spend: Zylo, 2025 SaaS Management Index, January 2025. 75% of employees by 2027: Gartner press release, March 28, 2023. 89% of breached organizations: AppOmni, The 2025 State of SaaS Security Report, July 2025. All figures are the publishers' own. If anything here is out of date, email info@optiflowlabs.ai and we will correct it.