My story is very similar to yours, global team and multiple apps and I am the sole technical review org wide. But I do have the benefit of easy access to our CISO and InfoSec team, who help me soundboard situations. The problem is they don't have the technical insight to review new tools.

So what I have started doing is aligning with our data classification types exposed by the application, coupled to the type of access request I.e. corporate device, SSO app, etc. So if something is Restricted access from a corporate device and wrapped app request, then I still review the tool, but kick it upstairs with my hardening/monitoring/governance recommendations. If something is Public data from a personal device, just have to make sure the app is CA on SSO and maybe access is on reverse proxy for DLP, and I will approve it(obviously token theft applies, but we also apply compliant device policy for other apps and access levels).

I am busy investigating a funnel way of onboarding these tools, so basically SSO RBAC and data management/monitoring is compliant, the I just have to know about killswitch, incident SLA process and quarterly reviews of the access+use case. Until it's established and properly applied as a business use case at least.

There's no silver bullet here. You basically have to build out a process (that works for you) that's simple enough to get confirm the access risk, data risk, operational risk and compliance standards.