How to Run a SaaS License Audit

A SaaS licence audit answers three deceptively simple questions: what are we paying for, who is actually using it, and where is the money leaking? Run well, an audit routinely pays for itself many times over in the first cycle. This is a practical, repeatable framework you can complete in two to four weeks.

Step 1: Define the Scope

Decide up front whether you are auditing the entire stack or a subset — for example, your top 20 applications by spend, which typically account for 80% of the total. A focused audit delivers results faster and builds momentum for a broader one. Set a clear cut-off date for the usage window you will analyse; 90 days of activity is the standard, long enough to catch quarterly workflows without being distorted by a single quiet month.

Step 2: Collect the Data

Pull three data sets and line them up side by side. Entitlements: how many seats you have purchased for each tool, from the vendor's admin console or your contract. Assignments: how many seats are currently allocated to named users. Activity: when each assigned user last actually used the tool. The gap between purchased and assigned reveals seats you are paying for but haven't handed out; the gap between assigned and active reveals seats handed out but sitting idle.

For identity-connected tools, directory platforms make this straightforward — Microsoft Entra ID exposes both assignments and, with the reporting permission, per-user application usage. For tools outside SSO, you will need each vendor's own usage report.

Step 3: Reconcile

Now match the three data sets against your people records. Two patterns fall out immediately. Ghost accounts: active licences assigned to people who have left the organisation — a cost problem and, more importantly, a security and compliance finding, since former employees should not retain access to business systems. Zombie seats: licences assigned to current employees who have not touched the tool in the audit window.

Step 4: Quantify the Waste

Translate every finding into an annual pound figure, because that is the language that drives action. Multiply unused and idle seats by their cost-per-seat, and total it by vendor. Rank the results by recoverable spend so you know exactly where to start. In most audits, two or three tools account for the majority of the waste, which keeps the remediation focused.

Step 5: Act, Then Systematise

Acting on the findings falls into three moves: reclaim idle and ghost seats immediately, right-size the purchased seat count at the next renewal, and downgrade users on premium tiers they don't fully use. Each is low-risk because you are removing capacity nobody is using, not tools people depend on.

The final step is what separates a one-off saving from a durable one: turn the audit into a standing process. A licence audit run once a year decays immediately as the stack changes. Continuous utilisation tracking — where idle-seat and ghost-account alerts surface automatically — means the audit essentially runs itself and the savings compound.

Further reading

• IAITAM — IT Asset Management education
• ISO/IEC 19770 — IT asset management