SaaS spend management: the audit that finds your dead software
A SaaS spend audit reconciles every recurring software charge against the people and the data behind it. Run it in five steps covering money, seats, leavers, sign-in method and renewal dates. The finding is rarely only financial. Zylo measures average license utilization at 54 percent, and every dead seat is a live account.
- A SaaS spend audit runs in five steps in order, covering money, seat counts, leavers, sign-in method and renewal dates.
- Zylo measures the average organization using only 54 percent of its provisioned licenses, and that is enterprise platform data rather than an SMB benchmark.
- Every orphaned seat is a working login. In one 2026 survey, 79 percent of people who left a job kept at least one account working after their last day.
- Offboarding works for apps behind single sign-on and quietly fails for apps that keep their own password.
- Canceling a subscription stops the billing and leaves the data. Microsoft deletes abandoned customer data no later than 180 days after cancellation.
What is a SaaS spend audit, and what does it find?
A SaaS spend audit reconciles every recurring software charge against the people who use it and the data it can reach. It finds five things. Seats still billed for people who left. Duplicate tools bought by two departments for one job. Unsanctioned purchases made on a company card. Auto-renewals nobody put on a calendar. And live accounts sitting outside your identity system. The first four cost money. The fifth is a security finding, which is why this audit is worth a Tuesday morning.
The reason nobody has run it is structural. Software stopped being an IT purchase. Zylo, which manages SaaS portfolios for large enterprises, reports that IT now manages just 15 percent of SaaS spend and 13 percent of applications. Read that as a direction of travel rather than a figure for a 30-person firm. The pattern holds at your size, and the result has a name. SaaS sprawl is what you get when every department buys its own tools and nobody keeps a list.
Visibility is thin even where somebody is paid to look. Flexera's 2026 survey of 512 IT asset professionals found only 36 percent of organizations report complete visibility into their IT estate, down from 43 percent a year earlier, and 66 percent have visibility into their SaaS environment. Those are organizations with dedicated asset staff. You almost certainly do not have one.
This is the owner-run version, covering everything you pay for rather than what your provider bills. SaaS spend management at your scale is a reconciliation habit, not a software category. Read it beside our MSP license and billing audit and the employee offboarding IT checklist. For the buying discipline afterwards, see software procurement best practices and the IT procurement process.
Every dead license is also a live account
Every seat you forgot to cancel is an account somebody can still log into. That fact changes what the audit is for. The license left running for the person who resigned in March is not just a charge on your card. It is a working set of credentials, pointed at your customer list, with nobody watching it. Security teams call these orphaned accounts.
The measurement is uncomfortable. A September 2026 Pollfish survey of 1,000 US adults who had left a job, commissioned by a managed security provider, found 79 percent said at least one work account or access point kept working after their last day and 64 percent could still reach at least one category of sensitive company information. It is self-reported and the sponsor sells offboarding services, so treat the exact percentages with care. The direction is hard to argue with.
Smaller companies came out worse, which is the part that matters here. 82 percent of people leaving companies with fewer than 250 employees reported lingering access, against 70 percent at companies over 1,000. 17 percent still held admin accounts or shared company passwords, and 33 percent said it was not clear who was responsible for shutting their access off.
CISA sets the cadence you should hold your provider to. Its performance goals ask organizations to review user access and disable accounts when inactive for a specified period, giving 30 days as an example. Thirty days of inactivity, not the next renewal date.
A seat nobody uses costs you money once a month. An account nobody closed costs you nothing until the day it costs you everything.
Why your IT provider cannot see most of the problem
Your provider can only audit the software it bought. A departmental purchase on a company card never raised a ticket, never appeared on an invoice your provider issues, and never touched your identity system. So this audit starts with money rather than with technology.
Shadow IT is not a rumor, and it is accelerating in a new direction. Verizon's 2026 DBIR found 45 percent of employees used AI tools on corporate devices, with 67 percent of those doing so through non-corporate accounts. Flexera found 45 percent of organizations are actively identifying unsanctioned AI usage, which means most are not looking at all.
Pull 13 months of card and bank statements before you ask anybody for a report. Thirteen months catches one full annual cycle plus the month you are in, so no yearly charge hides. Sort by merchant and flag every recurring line. Each charge missing from your provider's itemized invoice is software nobody manages.
The five-step SaaS audit you can run with your provider
To audit your SaaS spend, work through five steps in this order. Money first, people second, access third, dates fourth, decisions last. Keeping that order means you never cancel a tool before you know who uses it.
- Pull 13 months of card, bank and provider invoices, then list every recurring charge by merchant.
- Count the seats. Put the seat count you pay for beside the number of people who signed in during the last 30 days.
- Reconcile against the leaver list. HR knows who left. The license list knows who is still billed. The gap is your largest finding.
- Check the sign-in method for every app, which is either single sign-on or a separate password nobody controls.
- Build a renewal calendar holding the renewal date, notice period and cancellation window for each contract.
Step four decides whether steps two and three matter
Checking the sign-in method tells you whether offboarding ever worked. Microsoft Entra can deprovision accounts automatically, but only where a connector exists for that app. Its documentation is explicit that manual provisioning means there is no automatic connector, so accounts must be created by hand, and the product has a feature to discover existing users in your application, including local or orphan accounts. Offboarding works for apps behind single sign-on and quietly fails for every app that keeps its own password.
Step five needs a date, not an intention
Build the renewal calendar from contracts, because an auto-renewal is a decision made by default. Microsoft warns that for some subscriptions you can only cancel during a limited window of time after you buy or renew, after which the only route left is turning off recurring billing. An auto-renewal you notice in week three is a twelve-month commitment you already made.
What does a SaaS spend audit actually recover?
Expect to recover specific seats rather than a headline percentage, because no credible figure exists for a business your size. Knowing the honest state of the evidence stops you setting a target from somebody else's sales deck.
The most defensible measurement comes from platform data rather than opinion. Zylo reports that the average organization uses only 54 percent of its provisioned licenses, so close to half of every seat paid for goes unused. Its benchmark portfolios average 305 applications, so the measurement describes large enterprises, published by a company selling the remedy.
Survey data agrees on direction and stays silent on size. Flexera found 43 percent of organizations reported increased wasted SaaS spend year over year and 78 percent of IT asset teams name accurate inventory as their top priority. Be warier of proposal figures. We traced the repeated claim that 30 percent of software spend is wasted back to a 2016 Gartner release about achievable savings, self-reported by firms that had already bought asset-management tooling, in our MSP license audit.
So set the target in seats. License reclamation is the plain name for the work. Count the dormant seats, multiply by the monthly price, and reclaim them at the next renewal window. Then look at duplicate tools doing one job. Vendor consolidation is worth real money where two products overlap and nothing where it costs you a working process, so consolidate the easy ones and renegotiate the rest. Two overlapping tools at $12 a seat is a procurement problem you fix at renewal, with any true-up clause read before you sign.
Canceling a subscription does not close the account
Canceling stops the billing and leaves the data behind. That is the trap on the way out of this audit, and it converts a cost win into a new exposure. The subscription you killed in step five can still be a live workspace holding customer records.
Microsoft documents the timeline precisely. A business subscription moves from Active to Expired for 30 days, then Disabled for 90 days, then Deleted, and any customer data you leave behind might be deleted after 90 days and will be deleted no later than 180 days after cancellation. For up to six months your data sits in a tenant nobody watches. Many vendors behave the same way or downgrade you to a free tier, which keeps the workspace and its logins alive indefinitely.
So cancel in three moves rather than one. Export what you are required to keep. Revoke every OAuth grant that app holds into your email, files and CRM. Then delete the workspace in writing and file the confirmation.
The OAuth grant is the piece owners underrate most. CISA's Entra baseline requires that only administrators shall be allowed to register applications and that user consent to applications shall be restricted, because application access presents a heightened security risk compared to interactive user access, since applications are typically not subject to critical security protections such as MFA policies. Your multi-factor authentication does not cover the app a staff member connected to your mailbox.
This is not theoretical. In August 2025 Google's Threat Intelligence Group found an actor using compromised OAuth tokens associated with the Salesloft Drift third-party application to export large volumes of data from corporate Salesforce instances, then advised customers to treat any and all authentication tokens stored in or connected to the Drift platform as potentially compromised. Nobody was breached through Salesforce. They were breached through third-party app consent granted once and never reviewed.
Does a small business need a SaaS management platform?
No. A 30-person company does not need a SaaS management platform, and buying one to govern 40 subscriptions adds a 41st. These platforms are priced for the portfolios Zylo measures, averaging hundreds of applications across business units with their own budgets.
Four free things replace it. A spreadsheet with one row per tool, holding owner, seat count, price and renewal date. Your bank feed, which sees every departmental purchase your provider cannot. Your identity provider's connected-application list. And a 90-minute review each quarter with whoever signs the checks.
Set the cadence against the risk rather than the calendar. IBM and the Ponemon Institute put the global average cost of a data breach at $4.99 million, a 12 percent rise and a record high. Your exposure is not $4.99 million, but a dormant admin account is how a small incident becomes a reportable one.
Do not wait for a regulator to fix the renewal problem either. The FTC was still seeking comment in March 2026 on amending its negative option rule so people can cancel without unwarranted obstacles. Your renewal calendar stays your own job.
What to ask your IT provider on Tuesday
Ask for five specific documents, and verify each against your own bank statements rather than accepting a summary. A capable provider produces all five inside a week.
- Request an itemized invoice naming every subscription, its seat count and its unit price.
- Request an assigned-versus-active export per tool, showing last sign-in dates.
- Request the list of applications connected to your email and file storage, with the consent date for each.
- Request the renewal date, notice period and cancellation window for every contract held on your behalf.
- Request the written offboarding runbook, naming which apps deprovision automatically and which are done by hand.
Three answers are red flags. A provider that cannot produce last sign-in dates does not monitor usage, whatever the dashboard shows. A provider that cannot name your renewal date is administering a contract nobody read. A provider that treats the connected-application list as an unusual request has never checked it.
CISA asks buyers to develop and maintain an understanding of the services, including the security products, provided by MSPs. This audit is how you do that for software. We rank providers on verified rating and firmographic data, we label paid placement, and we do not sell IT services, so take the five requests to three independent firms and compare what comes back.
FAQ
What is SaaS spend management?
SaaS spend management is the practice of tracking every software subscription a business pays for against who actually uses it and what data it can reach. For a small business it is a quarterly reconciliation of bank charges, seat counts and sign-in dates. Zylo reports IT now manages just 15 percent of SaaS spend.
How do I find SaaS subscriptions nobody told IT about?
Start with 13 months of card and bank statements rather than an IT report, because an unsanctioned purchase never reaches a ticket. Sort by merchant, flag every recurring charge, then compare the list against your provider's itemized invoice. Flexera found only 66 percent of organizations have visibility into their SaaS environment.
Does deleting a user stop their access to other SaaS apps?
Only where the app is connected to your identity system. Microsoft deprovisions accounts automatically where a connector exists, and manual provisioning means accounts must be created by hand. Apps keeping their own password survive offboarding entirely, which is why 79 percent of surveyed leavers kept at least one account working after their last day.
How often should a small business audit its SaaS spend?
Quarterly, with a leaver check every month. CISA advises organizations to review user access and disable accounts when inactive for a specified period, giving 30 days as an example. The quarterly review catches duplicate tools and upcoming renewals. The monthly check catches orphaned accounts long before the renewal date arrives.
Do small businesses need a SaaS management platform?
No. A SaaS management platform is built for portfolios in the hundreds of applications, so a 30-person company governing 40 subscriptions simply adds a 41st. A spreadsheet, the bank feed and your identity provider's connected-application list do the same job for nothing. Zylo's benchmark portfolios average 305 applications.
Best IT MSP is the independent directory of managed IT providers across the US and Canada. We rank on verified rating and firmographic data, we label paid placement, and we do not sell IT services. Take the five requests above to three merit-ranked firms in your city and compare the answers side by side.