How Datadog's IT team automated monitoring third-party accounts (opens in new tab)

Datadog built “Clarity,” an automated system for auditing SaaS accounts against Workday’s employee records. It regularly identifies accounts that do not belong to active employees, then logs, tickets, stores, and communicates findings through Datadog, Freshservice, Slack, and DynamoDB. The system replaces infrequent, manual reviews with continuous visibility and faster remediation of security and cost risks.

The Need for Automated SaaS Audits

• Modern companies rely on dozens or hundreds of external applications.
• Manual account reviews are difficult to scale and may fail to detect unauthorized or abandoned accounts promptly.
• An unexpected account in an identity provider or SaaS application could give a bad actor access to sensitive systems.
• Datadog needed recurring audits as its SaaS portfolio continued to expand.

Clarity’s Requirements

• Use a single source of truth for employee status:
  • Datadog uses Workday.
  • Other organizations could use Okta, OneLogin, ADP, or Active Directory.
• Run frequently enough to provide timely visibility.
• Support manual execution when needed.
• Integrate with existing communication, ticketing, and observability tools, such as Slack, Freshservice, and Datadog.
• Minimize disruption to IT workflows and encourage adoption across a globally distributed organization.

Audit Pipeline

• A CloudWatch Event Rule triggers the audit Monday through Friday at 10 a.m. EST.
• Clarity concurrently retrieves:
  • Active employees from Workday.
  • Active users from primary SaaS applications such as Slack, GitHub, and Zoom.
• It compares SaaS user email addresses with active employee records.
• Accounts without a matching active employee are flagged.
• Results are:
  • Sent to Datadog as logs and metrics.
  • Added to DynamoDB for historical tracking.
  • Converted into Freshservice tickets.
  • Reported through Slack notifications with an audit summary.

Datadog Metrics and Investigation

• Clarity sends a metric for every flagged account using the Datadog Metrics API and Python SDK.
• It uses a gauge metric to track flagged accounts over time.
• Metrics include tags such as:
  • Environment, such as production.
  • Responsible team.
  • SaaS service.
  • Flagged user’s email address.
• These tags provide the context needed to investigate the account and support alerting and visualization within Datadog.

Practical Outcome

Clarity provides a repeatable, automated control for SaaS account governance. Organizations implementing a similar system should connect an authoritative employee directory to their SaaS inventory, run audits regularly, and integrate findings with their existing monitoring, ticketing, and notification workflows.