What is SSPM (SaaS Security Posture Management)?
SaaS Security Posture Management (SSPM) continuously assesses the configuration and identity posture of SaaS applications — such as Microsoft 365, Google Workspace, GitHub and Snowflake — detecting misconfigured sharing settings, unprotected admin accounts, excessive permissions and disabled audit logging.
The blind spot
A cloud security platform will tell you an S3 bucket is public. It will say nothing about:
- A Microsoft 365 global administrator without MFA
- A SharePoint site shared with "anyone with the link"
- A Google Workspace guest account belonging to a contractor who left in 2023
- A Snowflake service account holding ACCOUNTADMIN
- A GitHub organisation with branch protection disabled on the default branch
- Microsoft 365 Unified Audit Log switched off at the tenant level
These are not edge cases. They are among the most commonly exploited footholds in real intrusions, and traditional CSPM scans none of them, because none of them are cloud infrastructure.
Why SaaS is the softer target
Identity concentration. Compromising a Microsoft 365 or Okta administrator usually yields more lateral movement than compromising a virtual machine. SaaS admin accounts sit above the infrastructure, often federate into it, and are frequently protected by nothing more than a password and goodwill.
Data exfiltration surface. External sharing settings in SharePoint, OneDrive and Google Drive are one-click paths out of the organisation. No bucket policy check will ever see them.
Audit gaps. When audit logging is disabled or retention is set too low, incident response becomes guesswork. These settings are invisible to infrastructure tooling and are rarely reviewed after initial setup.
Sprawl without procurement. SaaS is adopted by teams, not by IT. The platform holding your most sensitive customer data may have been signed up for with a corporate card.
What SSPM checks
| Area | Examples |
|---|---|
| Privileged identity | Admins without MFA, standing privilege, missing conditional access |
| External sharing | Anyone-with-link files, external guests, links without expiry |
| Audit configuration | Logging disabled, retention below policy, missing alerting |
| Dormant access | Stale guests, orphaned accounts, unused service principals |
| DevOps posture | Branch protection, token scopes, org membership, third-party OAuth apps |
| Data platform posture | Warehouse roles, network policies, grant sprawl |
How SSPM connects
Through each platform's official API using read-only, scoped application permissions — Microsoft Graph, Google Admin SDK, GitHub and GitLab app tokens, Snowflake key-pair authentication. There is no agent and no browser extension. A well-built connector requests directory, audit and configuration scopes only, and never message or document contents.
SSPM vs CSPM vs CIEM
- [CSPM](/learn/cspm) — cloud infrastructure configuration
- SSPM — SaaS application configuration and identity
- [CIEM](/learn/ciem) — effective permissions inside cloud providers
They meet at the identity provider. A SaaS compromise becomes a cloud compromise at the federation hop, which is exactly why keeping SSPM findings in a separate console from cloud findings defeats the purpose.
Next steps
- How Onam implements SSPM — 8 platforms, 433 CIS SaaS rules
- What is CIEM?
- What is CNAPP?
Frequently asked questions
What does SSPM stand for?
SSPM stands for SaaS Security Posture Management — continuous assessment of the configuration and identity posture of SaaS applications such as Microsoft 365, Google Workspace, GitHub, Okta and Snowflake.
What is the difference between SSPM and CSPM?
CSPM scans cloud infrastructure — compute, storage, networking, IAM inside AWS, Azure or GCP. SSPM scans the SaaS applications running on top of that infrastructure. A CSPM tool will never see a SharePoint sharing setting or a Microsoft 365 admin without MFA.
What permissions does an SSPM tool need?
Read-only application permissions scoped to directory, audit and configuration data — for example Microsoft Graph Directory.Read.All and AuditLog.Read.All. A properly built connector never requests write scopes and never reads message or document contents.
Is SSPM the same as CASB?
No. A CASB sits in the traffic path to broker and control access to cloud services, often via proxy. SSPM connects to the SaaS platform's API to assess how it is configured. CASB is an inline control; SSPM is a posture assessment.