How to Secure SaaS Accounts: Complete Checklist 2026

ServDigest Team

The average company uses 130 SaaS services (Productiv data, 2026). Every employee has dozens of accounts. One compromised password, one forgotten ex-employee account — and an attacker gains access to CRM, email, billing, source code. According to Verizon DBIR 2026, 49% of data breaches start with compromised credentials. This guide is a step-by-step methodology for securing SaaS accounts from employee onboarding to offboarding.

Level 1: Basic Hygiene (Mandatory for Everyone)

1. Password Manager — Not Optional

Without a password manager, SaaS security is impossible. The human brain cannot generate and remember unique 16-character passwords for 130 services. Without a manager, people use patterns — and those patterns are cracked by credential stuffing in seconds.

What to choose:

  • Bitwarden — free, open source, self-hosted option. Ideal for starting out.
  • 1Password — -8/month per user, best UX, SSH agent, CI/CD integration. For dev teams.

Team rule: zero passwords outside the manager. If a password can be typed from memory — it’s too simple.

2. Multi-Factor Authentication — Everywhere Possible

MFA reduces account takeover risk by 99.9% (Microsoft data). Method priority:

  1. Hardware key (FIDO2/WebAuthn) — YubiKey, Titan. Cannot be intercepted remotely. Best protection.
  2. TOTP app — Authy, Google Authenticator, built-in TOTP in 1Password/Bitwarden. One-time codes rotating every 30 seconds. Sufficient for most services.
  3. SMS — weak method (SIM-swap attacks), but better than nothing. Use only when other options are unavailable.

Critical services requiring MFA:

  • Email (email access = password reset access for all other services)
  • Domain registrar (domain hijack = full compromise)
  • Cloud/hosting provider (AWS, GCP, Azure)
  • Payment systems and billing
  • Code repository (GitHub, GitLab)

3. Zero Password Reuse

The password manager should flag duplicates. Watchtower in 1Password and reports in Bitwarden show reused passwords. Eliminate them immediately.

Level 2: Corporate Security (for Teams of 5+)

4. SSO Instead of Individual Passwords

Single Sign-On reduces the attack surface: instead of 130 passwords per person — one corporate account. When an employee leaves, you disable one account — access to all SaaS services is revoked.

What to choose:

  • Okta — enterprise standard, pricey (from /month per user)
  • Azure AD / Entra ID — if you’re in the Microsoft 365 ecosystem
  • JumpCloud — cheaper alternative, good for mid-market
  • Google Workspace — if all infrastructure is on Google

When selecting SaaS tools, verify SAML/SSO availability on the required plan. Some services (like Crisp) hide SSO behind Enterprise pricing.

5. Access Audit: Who Has Access to What

Monthly review:

  • Who has billing access?
  • Who has production environment access?
  • Who has admin rights in CRM?
  • Are there accounts for departed employees?

Automate with tools like AccessOwl, Zluri, or BetterCloud — they map access across all company SaaS services.

6. RBAC: Principle of Least Privilege

Role-based access, not person-based. Not “give Vasya billing access,” but “the Finance role has billing access, Vasya is in the Finance role.” When Vasya moves departments — remove the Finance role, don’t hunt through 50 services for his individual permissions.

7. Onboarding and Offboarding as Processes

Onboarding (Day 1):

  • Create SSO account
  • Add to appropriate groups/roles
  • Verify MFA is configured (hardware key)
  • Send welcome email with service list

Offboarding (Last Day):

  • Disable SSO account (automatically revokes all service access)
  • Check non-SSO SaaS (should be zero, but verify)
  • Deactivate API keys
  • Revoke repository access
  • Checklist must be completed within 2 hours of departure — not a week later

Level 3: Advanced Protection

8. Breach Monitoring

Data leaks constantly — it’s not “if” but “when.” Monitoring services:

  • Have I Been Pwned Domain — free email domain monitoring
  • 1Password Watchtower / Bitwarden Reports — compromised password monitoring
  • Breachsense / Dehashed — commercial services for finding corporate credentials in breaches

9. Password Policy

Set minimum requirements at the SSO level:

  • Minimum length: 16 characters
  • No special character requirements (reduce entropy)
  • Lockout after 5 failed attempts for 15 minutes
  • Forced password change only on compromise — not on a schedule (NIST SP 800-63B)

10. Session Control

Configure session timeouts for critical services:

  • 15 minutes idle for financial systems
  • 1 hour for CRM
  • 8 hours for development tools

11. API Keys and Secrets

API keys are passwords that are easy to forget. Rules:

  • Store in password manager vault, not .env files in repositories
  • Rotate every 90 days
  • Use least-privilege keys (read-only when possible)
  • CI/CD secrets — through HashiCorp Vault, 1Password Secrets Automation, or GitHub Secrets

12. VPN for Admin Panels

Critical service admin panels (hosting, domains, billing) should be accessible only from the corporate network or via VPN. Cloudflare Zero Trust offers free access for up to 50 users — set up in 30 minutes.

15-Point Security Audit Checklist

  • Password manager installed for every employee
  • Unique passwords for all services (zero reuse)
  • MFA enabled on email, domains, hosting, billing, GitHub
  • MFA — hardware key (YubiKey) for admins
  • SSO configured and mandatory for all SaaS
  • Offboarding process completed within 2 hours
  • Monthly access audit
  • Breach monitoring (HIBP Domain) configured
  • API keys stored in vault, not .env
  • API key rotation every 90 days
  • Session timeouts configured
  • Admin panels behind VPN
  • RBAC instead of individual permissions
  • Password policy compliant with NIST SP 800-63B
  • Access logs enabled for all critical services

Implementing these 15 points reduces security incident risk by an order of magnitude. Start with Level 1 — this alone puts you ahead of 80% of companies. Progress through Levels 2 and 3 as your team and service criticality grow.

Useful Tools