· Yair Knijn
The renewal that auto-charged for 200 licenses, half of them assigned to leavers
The renewal quote arrives at 200 seats, the same number you bought last year, and the finance director signs it. Not out of carelessness. The contract auto-renews at the contracted count, the vendor's CSM is friendly, and the alternative is reconstructing actual usage from a dozen admin consoles that each tell a slightly different story. Approving the invoice takes five minutes. Reconciling it would take two weeks nobody has.
So the wrong assumption gets baked in: that 200 seats last year means 200 seats are in use this year. They are not. Somewhere in that number are people who left in March, two tools that overlap, and an app that three of those seats stopped opening eight months ago.
Where the leak hides: leavers, duplicate tools, dormant seats
License leakage is rarely one big mistake. It is a pile of small ones that no single person sees end to end. The usual contributors:
- Leavers who were never deprovisioned in the billing-bearing app, because offboarding closed the SSO account but the product kept its own user record and kept charging.
- Duplicate tools bought by different teams that do the same job, so you pay twice for one capability and split usage so thinly that neither looks wasteful in isolation.
- Dormant seats assigned to people who are still employed but have not logged in for a quarter, the most expensive kind because they look perfectly legitimate on the roster.
Industry trackers put roughly a third of enterprise SaaS spend on licenses that are underused or never touched. The number that should worry a finance director more is the trajectory: Gartner has projected that organizations without centralized SaaS visibility will overspend by at least 25 percent through 2027. That is not a one-off; it compounds at every renewal.
Why per-tool admin consoles never give you the reconciled number
Each product gives you a clean answer to its own question. App A shows 80 active users. App B shows 140 seats provisioned. Neither knows that 22 of those identities are the same person, that 11 belong to people who left, or that a "license" in one tool means a named seat while in another it means a concurrent session. The definitions do not line up, the identifiers do not match, and the export formats fight you.
To get the real number you export from each console, paste it into a spreadsheet, and try to join on email addresses that are formatted three different ways. By the time you finish, the data is a month stale and the renewal date has passed. The average mid-sized estate processes something close to one SaaS renewal per business day, so this reconciliation is not an annual event you can muscle through once. It is a queue that never empties.
One identity-to-license map across every product
The fix is not a smarter spreadsheet or another spend dashboard that re-imports the same fragmented exports. It is one record of who each person is, mapped to every license they hold across every product, with a real last_active timestamp attached to each one. When identity and entitlement share a single source, "show me every seat assigned to someone who left, and every seat untouched for 90 days" becomes a query, not a project.
That map is also what makes a clawback safe. You can reclaim a dormant seat without breaking someone's workflow because you can see, in one place, whether they actually use it or just hold it.
Negotiating renewals from real usage instead of last year's invoice
Walking into a renewal with a reconciled active-seat figure changes the conversation. You are no longer arguing against the vendor's number with a hunch. You are presenting your own count, with the leavers and duplicates already stripped, and asking why you would renew capacity your own records show idle. Vendors discount when the buyer has done the homework. They auto-uplift when the buyer has not.
In Spot Suite, every person and every entitlement hang off one Customer Environment, so identity, license assignment, and last-active activity live in the same record instead of in a dozen consoles that disagree. The reconciled seat count is one export, not ten, and it is current the day the renewal lands rather than a month after. If you want to see how the identity-to-license map is built, the products overview is the place to start.