How to conduct a SaaS account permission audit, beyond just looking at the admin list

When conducting a SaaS permission audit, just looking at who the admins are is not enough. Many risks don't come from super admins, but from project owners who haven't been managed for years, shared accounts, contractor email addresses, and accounts of employees who have left but are still in groups. I once did a cleanup where the first round involved pulling user lists, roles, and last login…