# Vendor Risk Management

**URL:** <https://community.appgovscore.com/t/vendor-risk-management/124>\
**Category:** SaaS Applications\
**Created:** [July 29, 2025, 5:42pm UTC](https://community.appgovscore.com/t/vendor-risk-management/124 "2025-07-29T17:42:31Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![RaviK12](https://avatars.discourse-cdn.com/v4/letter/r/977dab/32.png) [@RaviK12](https://community.appgovscore.com/u/RaviK12)\
**Post date:** [July 29, 2025, 5:42pm UTC](https://community.appgovscore.com/t/vendor-risk-management/124/1 "2025-07-29T17:42:31Z")

</div>

Due to regulations (DORA in our case) we have to setup vendor risk management. Has anyone ever done this for their Entra-integrated SaaS applications?

---

<div class="post-metadata">

**Author:** ![JONeillSr](https://yyz1.discourse-cdn.com/flex027/user_avatar/community.appgovscore.com/joneillsr/32/24_2.png) [@JONeillSr](https://community.appgovscore.com/u/JONeillSr)\
**Post date:** [September 10, 2025, 3:54pm UTC](https://community.appgovscore.com/t/vendor-risk-management/124/2 "2025-09-10T15:54:31Z")

</div>

Great question! Vendor risk management setup for Entra ID-integrated SaaS applications under regulations such as DORA is definitely doable, and Entra ID actually provides several built-in capabilities that support compliance efforts.

**Key steps I recommend:**

1. **Inventory & Classification** : Start by cataloging all your Entra-connected SaaS apps and classify them by criticality (critical, important, non-critical) based on business impact and data sensitivity.

2. **Leverage Entra’s Built-in Controls** : Use Conditional Access Policies, app governance features, and Microsoft’s Cloud App Security integration to establish baseline security controls and monitoring.

3. **Vendor Assessment Framework** : For each critical/important SaaS provider, conduct assessments covering:

4. **Continuous Monitoring** : Implement ongoing monitoring through Entra’s sign-in logs, risk detections, and app usage analytics to track vendor-related risks in real-time.

**DORA-specific considerations** : Focus on operational resilience requirements - ensure your critical SaaS vendors have robust BCM plans and that you have documented exit strategies or alternatives.

I’m actually working on a comprehensive blog post that will dive deeper into vendor risk frameworks for cloud-integrated environments. I’ll share the link once it’s published!

Has anyone else tackled DORA compliance for their SaaS stack? I would love to hear other approaches.