Beta list open
Your identity provider knows who exists. Each vendor knows who logged in. Cross the two and every seat paid for and never used shows up, priced from the contract and ready to reclaim.
Readings from the last run.
| Tool | Seats | Active in 90 days | Unused | Cost per seat/yr | Reclaimable |
|---|---|---|---|---|---|
| Datadog | 340 | 253 | 87 | 500 | 43 500 |
| Salesforce | 210 | 176 | 34 | 1 440 | 48 960 |
| Jira | 610 | 498 | 112 | 240 | 26 880 |
| Figma | 120 | 92 | 28 | 360 | 10 080 |
| … ten further tools on the same run | |||||
| Reclaimable this year · 14 tools · 2 140 seats | 187 400 | ||||
Example output. Where a vendor exposes no last-login, the seat is reported as unverified rather than counted as unused.
01 The problem
A new hire is provisioned into a dozen tools on the first morning. Access is removed from the identity provider on the last day, and the seats in each vendor stay assigned, because deprovisioning stops the login and rarely reclaims the licence. The invoice keeps counting them.
Between those two days, seats are assigned for a project and kept, a tier is bought for one feature and applied to everyone, and a second tool for the same job is bought on a card by a team that did not know the first existed. Each is invisible on the one document finance reads, because a vendor invoice lists seats and never logins.
The audit is done, when it is done, by hand: an export from the identity provider, an export from each vendor's admin console, a spreadsheet, a fortnight. It is done once and the seats grow back.
02 What it finds
Most organisations have all four. Every line in the audit is one of them, named, priced from the contract, and ranked by the money it releases.
People who left months ago and still hold an active licence. Offboarding closed the login on the last day and missed the seat inside the vendor, so the bill keeps running.
example34 Salesforce seats at 1 440 a year each: 48 960 wasted annually.
Seats assigned to current employees who never actually open the tool. Provisioned by default, forgotten immediately, renewed without anybody asking whether they are used.
example87 Datadog seats unused for ninety days or more: 43 500 wasted annually.
An enterprise tier bought for one feature and applied to every seat, while most of the people on it need the cheaper feature set below.
example60 people on Enterprise at 45 a seat a month who need Pro at 15: 21 600 reclaimable a year.
Tools bought on corporate cards outside the approved stack, duplicating a capability already paid for. Usage shows which one people actually open, and one renewal can be cancelled.
example3 project management tools with overlapping users: 18 000 in consolidation savings.
Example figures from a designed audit, amounts in EUR.
03 How it works
Read-only in, a ranked list out. Nothing is changed inside a vendor by Licensereap; the release step stays with the administrator who owns it.
Read-only access to the identity provider (Okta, Entra ID, Google Workspace) and to each vendor's admin API or usage export.
For every tool, every assigned seat against the last login and the last meaningful action, with the contract's per-seat price beside it.
Seats held by people who have left, seats never used, seats on a tier whose features are never touched, and tools that duplicate each other.
A ranked list with the money on each line and the vendor step that releases it. What is reclaimed against the next invoice is what the fee is calculated on.
04 Integrations
The method is one subtraction, so it needs two sources: the list of people who exist, and the record of who actually logged in. Both are read-only.
Identity provider · who exists
One of these is the source of record for people: who was hired, who has left, which groups they sit in. It is read, never written.
Audited vendors · who logged in
Each of these is asked for its assigned seats and its last-login record, through its admin API or usage export. Subtract the second list from the first, tool by tool, and what is left is a paid seat nobody sat in.
05 Who it is for
Every tool has an admin console that shows its own last-login column. Nobody has time to open forty of them and reconcile the result with the leavers list.
An invoice lists seats. The identity provider lists people. Nobody is paid to reconcile the two, so nobody does.
06 What it costs
The first year is priced as a share of the spend actually reclaimed, agreed before the first run and confirmed against the next invoice. Nothing reclaimed, nothing owed. From the second year the same audit runs as a flat monthly subscription, because the seats grow back.
A share of the spend actually reclaimed, agreed before the first run and confirmed against the next invoice.
Nothing is owed. The audit is only worth what it releases, and the fee follows the released seats.
A flat monthly subscription for the same audit on a schedule, because seats grow back as fast as they are cleared.
07 Request access
Requests decide which identity provider and which vendors are connected first.
08 Objections