When someone leaves a mid-market SaaS company, finance still pays for seats that nobody uses and security still finds leftover access in tools the IdP never owned. Rutagon builds SaaS license reclamation that treats both as one offboarding event: the seat is reclaimed, the account is revoked, and a reclaim report lands where finance and GRC can both close the ticket. The work is engineering, not a reminder email to a manager.
Most teams already have a terminate checkbox in the HRIS and a deactivate action in the IdP. That pair is necessary and not sufficient. The expensive leftovers live in product admin consoles, billed workspace seats, shared mailboxes, and API tokens that never belonged to an IdP group. We wire those systems to the same leaver event that access deprovisioning automation already consumes, then we emit a report that names the seat, the last actor, and the dollar driver without inventing a price.
This article is about that delivered system: unused seats and leftover access removed together, with a reclaim report your controller can reconcile. It is not a catalog of every SaaS vendor API. It is the pattern we ship for companies in the 50–500 range that already run a GRC platform and still export license CSVs by hand.
What SaaS License Reclamation Looks Like When We Ship It
SaaS license reclamation starts from a single source of truth for employment status, then fans out to billed identities. We ingest hire, transfer, and terminate events from the HRIS. We resolve the worker to IdP users and to SaaS user IDs that do not match email. We classify each assignment as a billed seat, a free guest, or leftover access that is not a seat but still an auditor problem.
The reclaim action is scoped. A billed editor seat is downgraded or removed. A personal sandbox that still holds production data is locked, not left as a “maybe later” comment. A shared admin that was never tied to the leaver stays in a separate queue so we do not steal a working break-glass path. Every action writes an evidence row: actor, system, before state, after state, timestamp.
Finance does not get a screenshot of a vendor admin page. They get a reclaim report: seats closed this window, seats still blocked (API missing, SSO-only tenant, pending owner), and leftover access that was revoked even when the vendor does not bill per user. That last column is how we stop the “we saved the license but they still have the repo” failure.
Unused Seats and Leftover Access on the Same Event
The same-event rule is the whole design. If license reclaim runs on Friday and access revoke runs next quarter, you have paid for a ghost and left a live session. We bind both to the HR terminate timestamp and to a retry window for APIs that 429 or require a second owner approval.
Leftover access is the longer list. SCIM deprovisioning can clear the IdP-linked user and still leave personal access tokens, OAuth grants, and local accounts created before SSO. We inventory those on the way out, using last-activity signals where the vendor exposes them and an explicit “unknown last use” flag where they do not. Reviewers see the unknown flag; they do not get a silent skip.
For custom and internal tools that never grew a license SKU, we still revoke. Those systems show up in access reviews for custom applications and they belong on the reclaim report as “access closed, no seat.” Finance learns the license number; security learns the access number. One event, two columns.
The Reclaim Report Finance Can Close
The report is a dated artifact, not a live dashboard that an auditor cannot sample. Each row is a closed or blocked reclaim with a stable ID. Blocked rows carry an owner and a next action, not a blank cell. We keep the file in the same evidence store used for other access jobs so GRC can attach it without a new collector.
A typical close package includes the HR terminate event ID, the IdP disable time, each SaaS mutation, and a short exception list. If a vendor requires a human to click “transfer ownership” before the seat can drop, that click is a tracked task with a due time inside the same week, not a Slack hope. When the click lands, the row flips from blocked to closed and the report version increments.
We do not print a fake savings total. Seat cost varies by contract, prepaid true-ups, and unused minimums. The report states counts and SKU names. Your finance team applies the contract. If a vendor publishes a public list price and you want that cited internally, that is your number, not ours.
What We Wire Behind the IdP
The IdP is the identity spine, not the license system of record. We read group membership and SSO assignments, then we talk to each SaaS admin API for the billed object. Where the vendor only offers a UI, we document the gap and put a human step in the same workflow instead of pretending SCIM covered it.
Retry and idempotency matter. Offboarding jobs rerun. A second pass must not create a new local user or re-invite the leaver. We key mutations on the employment event plus the SaaS user ID and we store the vendor request ID when the API returns one.
event: hr.terminate
worker: emp-1842
idp_user: aida@example.com
actions:
- system: design-saas
seat: editor
result: downgraded
- system: issue-tracker
leftover: personal-access-token
result: revoked
report_id: reclaim-q-sample
That shape is the deliverable. Your GRC tool attaches report_id. Security automation is the capability that owns the connectors, the retry, and the evidence write. We do not ask you to run a new IGA product to get a license close.
Last-activity hints from cloud IAM, such as IAM access advisor, inform AWS-side leftovers. They do not replace the SaaS admin call. We treat AWS last-used data as one more input to the same event, not as a separate quarterly project.
Frequently Asked Questions
Does SaaS license reclamation require every vendor to support SCIM?
No. SCIM helps for the IdP-linked user, and many billed seats still need a vendor admin API or a tracked human step. We inventory which tenants can mutate automatically and which ones only accept an owner transfer. The reclaim report shows both so finance is not told a seat is closed when it is only disabled in the IdP.
What if a leaver owns a shared workspace that other people still use?
We do not delete the workspace to reclaim one seat. Ownership transfers to a living manager or a named service owner, then the leaver seat drops. The report records the transfer target. If no living owner exists, the row stays blocked and that is an access finding, not a silent license win.
How is unused different from unassigned?
Unused means a living or leftover identity still holds a paid seat with no recent activity. Unassigned means the contract has idle capacity that was never given to a person. We reclaim unused seats on terminate and we can separately list unassigned capacity for procurement. Mixing those two numbers is how teams invent savings they cannot book.
Can the reclaim report stand in for a quarterly access review?
It can support the leaver sample. It does not replace a periodic recertification of people who still work there. Pair it with automated access reviews so movers and remaining staff are not ignored because offboarding looked clean.
See what an Access & Credential Governance Diagnostic finds in your environment. Call 907-841-8407, email contact@rutagon.com, or use rutagon.com/contact.