Audit your SaaS stack to remove unused enterprise seats

Audit Your SaaS Stack: The Forensic Approach to Killing Ghost Licenses

According to multiple industry surveys, organizations running more than fifty SaaS subscriptions typically discover that roughly a third of their provisioned accounts have not generated a single login event in the trailing ninety days. The license sits warm. The invoice stays hot. Procurement continues to renew against a headcount that exists only in a spreadsheet.

This is not a technology problem. It is a process failure dressed in a tie. The fix is unglamorous: forensic inventory work, identity logs, and the willingness to negotiate contracts like a buyer rather than a supplicant. Below is the operational breakdown.

> The license doesn't know your employee quit six months ago. It keeps billing until someone kills it.

Mapping the Shadow IT Landscape and Hidden Subscription Silos

The first stage of any serious audit is admitting how little the central IT department actually knows. Shadow IT is no longer a fringe phenomenon confined to rogue marketing teams downloading freemium tools. It is the default state of large organizations. Marketing buys a CRM add-on with a corporate card. Engineering signs a contract for a monitoring service through a self-service portal. A regional sales office wires up a project tracker to chase quarterly targets, and the parent company only finds out during the next security review.

The discovery vectors are well established but rarely executed with discipline:

• Expense report mining. Run every line item above fifty dollars against a SaaS vendor database. Subscriptions hide inside line items labeled "software," "platform," or—frequently—"consulting."
• Network egress logs. Outbound API calls to unknown domains reveal active integrations that no procurement record captured. DNS logs from internal resolvers are usually the cleanest source.
• Cloud Access Security Broker (CASB) telemetry. For organizations that already run one, the shadow inventory is often a matter of reading the dashboard nobody has checked in eighteen months.
• Browser telemetry and endpoint agents. Modern EDR platforms surface browser-based SaaS usage through DNS filtering data or proxy logs.
• Mobile endpoint sprawl. The BYOD perimeter complicates this further. Employees now procure tools directly through mobile app stores, then authenticate corporate data into them. Coverage of mobile-side subscription leaks, including how personal device usage channels shadow spend, is documented at mobnews.org, where the parallel crisis of unmanaged mobile app subscriptions is tracked alongside enterprise tooling.

The output of this stage should be a flat file: every SaaS vendor, the contracting entity, the billing owner, the seat count on the contract, and the seat count actually provisioned in the source-of-truth directory. Anything missing from one column is a future audit finding.

Leveraging SSO and Identity Provider Logs for Real-Time Usage Verification

Once the inventory exists, the next move is forensic: pull the logs. Modern identity providers—Okta, Microsoft Entra ID, Google Workspace, JumpCloud—record authentication events with timestamps precise to the second. Those timestamps are the only honest signal in the entire audit.

For every application federated through the IdP, export the System Log for the trailing 180 days. The query is simple and brutal:

The trap here is service accounts. Automated workloads—CI pipelines, data syncs, API integrations—will log in daily even if no human touches the license for a year. Mark every service principal separately. A service account that logs in nightly is not evidence that a human seat is active. It is evidence that a machine seat is doing what it was configured to do. The two must not be conflated.

For applications that do not run through SSO—because some legacy subscriptions were never federated—the fallback is vendor admin console data. Adobe, Atlassian, GitHub, Salesforce, and Workday all expose last-login timestamps. Pull them. Cross-reference. Build the unified activity matrix.

The goal is a single spreadsheet column: days since last human authentication. Anything above ninety is a candidate for reclamation. Anything above 180 is a candidate for termination pending business owner review.

Categorizing Licenses by Activity Thresholds and Departmental Needs

Not all inactivity is equal. A power user who has not logged in for forty-five days may be on parental leave, sabbatical, or a long sales cycle. A finance team member who has not logged in for forty-five days may simply have nothing to reconcile this month. The naive cut—kill anything idle for ninety days—will provoke revolt in every department that uses the tool seasonally.

The workable threshold structure looks like this:

1. Tier 1: True Ghost (180+ days, no human login, no business owner response). Reclaim immediately. Notify the cost-center lead of the action after the fact, not before. Do not ask permission to stop paying for a service nobody uses.

2. Tier 2: Long-Tail Idle (90–180 days). Hold for two business weeks pending department confirmation. If the department cannot name a reactivation date, demote to Tier 1.

3. Tier 3: Soft Idle (30–90 days). Flag only. Do not reclaim. Surface in quarterly reviews.

4. Tier 4: Active Power Users (under 30 days). Validate that the assigned license tier matches actual usage. Heavy users on entry-tier licenses may be feature-blocked; light users on premium tiers are wasting money in the opposite direction.

Departmental context matters. Sales organizations cycle through users faster than engineering. Seasonal businesses—tax, audit, retail planning—have predictable dormancy windows. The audit must accommodate these patterns or it will lose internal credibility. The objective is not to maximize reclaimed seats in a single quarter. The objective is to install a perpetual discipline that prevents the waste from reaccumulating.

Automating the Offboarding Process to Prevent License Leakage

The real savings come from closing the leak, not from bailing the boat once a quarter. The single largest source of license waste is the employee who left the company six months ago and still has an active Salesforce seat, an active GitHub seat, an active Figma seat, and an active Adobe seat. HR closes the human resources record. IT never receives the trigger.

The remediation is a provisioning and deprovisioning pipeline tied to the authoritative HR system. Workday, BambooHR, HiBob—whatever the source of truth is, it must feed the identity provider through SCIM (System for Cross-domain Identity Management). The flow is mechanical:

1. HR marks the employee as terminated with an effective date.

2. SCIM pushes the lifecycle event to the IdP.

3. The IdP deactivates the account and triggers downstream deprovisioning rules.

4. Each federated SaaS application receives the disable signal and revokes the session, the API token, and the license assignment.

5. A nightly job reconciles assigned licenses against the directory and reclaims orphan assignments.

Two failure modes recur here. First, the org has SCIM configured for ten applications but is running sixty. The remaining fifty require manual offboarding, which means the manual offboarding does not happen. Second, contractors and fractional users sit outside the HR system entirely and are added directly to the IdP without a corresponding HRIS record. These accounts accumulate indefinitely. The audit must surface them.

The discipline that prevents recurrence is straightforward: no license assignment without an HRIS-linked identity, and no HRIS-linked identity without a manager, an end date for contractors, and a status field that triggers lifecycle automation. Anything else is administrative debt that compounds quarterly.

Negotiating True-Down Clauses During Enterprise Agreement Renewals

Procurement typically negotiates enterprise agreements as if the headcount number on page one will hold steady for three years. It will not. It never does. Restructuring, attrition, divestitures, and product sunsetting will all reduce seat consumption between signing and renewal. Without a true-down clause, the organization pays the original commitment and accepts the waste.

True-down provisions fall into three categories, ranked by leverage:

The negotiation posture matters. Procurement teams that show up with audit data—the exact utilization percentages from the past four quarters—extract better terms than teams that arrive with vendor-targeted rhetoric. Vendors respond to documented patterns of waste because those patterns prove the customer has alternatives. Procurement teams that cannot quantify their own waste signal to the vendor that the contract will be renewed on the vendor's terms.

The secondary lever is the renewal deadline. Most enterprise agreements auto-renew on a twelve-month cycle with a thirty-to-sixty-day notice window. The organizations that reclaim the most budget are the ones that begin the renewal review ninety days before that notice window opens, with a documented list of every underutilized license and a clear ask: "We will renew at X seats, not Y, and we will accept a price increase of Z percent in exchange for that flexibility." Vendors that refuse the seat adjustment usually lose the renewal entirely. The threat is credible because the audit has already produced a list of redundant subscriptions the organization can drop.

> Renewal is the only point in the contract where procurement has leverage. Use the leverage or pay for it.

The Bottom Line on Ghost Licenses

SaaS sprawl is not a mystery. It is the predictable output of procurement processes that reward purchase velocity and punish reclamation effort. Every quarter that an organization delays the audit, it subsidizes vendors on seats that no human uses. The forensic work—SSO logs, vendor telemetry, HRIS-linked deprovisioning—is tedious but mechanical. There is no technology gap. There is an execution gap.

Run the inventory. Pull the IdP logs. Tie deprovisioning to HRIS. Demand true-down clauses at renewal. Repeat the cycle every quarter. The budget recovers faster than any vendor-led optimization initiative ever will, because the seats being reclaimed were never producing value in the first place. They were only producing invoices.