What you will learn: a field-tested, 30-day program to reduce unnecessary SaaS spend using decision-grade usage data, enforceable seat policies, and identity automation — updated for July 2026 realities: AI consumption billing, MAU/per-active-user models, vector-db and model-hosting costs, ephemeral access patterns, and renewed vendor contract tactics.

Who this is for: SaaS enthusiasts, IT/Procurement/Finance operators, and small centralized teams (1–5 people) responsible for keeping SaaS costs sane. If you can access admin exports, an identity provider (IdP), and finance records, you can run this program this month.

Prerequisites and context: what to know before Day 1

Since the original June 2026 draft, two things hardened across the market: SaaS vendors now layer AI consumption (per-run, per-token, GPU-hours, model-hosting egress) on top of seat licensing, and billing models have fragmented between seat, MAU (monthly active user), and fine-grained feature-tier billing. That makes unmanaged fleets both expensive and risky.

Before you start, gather these items:

  • Top-spend list (start with 10): Pull 90–180 days of spend from accounts payable, corporate cards, and your ERP. Normalize vendor names (same vendor can appear under multiple billing entities and marketplaces like AWS Marketplace or GCP Marketplace).
  • Admin access and API keys: Export user lists, feature-level usage, and invoices. Vendors increasingly expose admin APIs, SCIM (System for Cross-domain Identity Management) provisioning, and consumption reports; use them.
  • Identity source of truth (IdP): Okta, Microsoft Entra ID, OneLogin or your directory — with SSO, group management, and token-revocation capabilities. Look for Just-In-Time (JIT) or ephemeral provisioning options for high-risk integrations.
  • HR, Finance, and renewal calendar: Contract end dates, auto-renew windows, notice periods, AI-consumption caps, and marketplace resellers. Put renewal alerts on a shared calendar.
  • Privacy and governance guardrails: Document what usage signals you'll collect and why—license eligibility and cost control—not employee productivity surveillance. Limit dataset access and set retention rules.

Why this still matters in July 2026: Multiple analyst and vendor reports through 2024–2026 continue to place avoidable SaaS waste in the 20–35% range for many organizations. Add unpredictable AI consumption (API keys misused or pipeline experiments) and MAU billing that counts brief activations, and unattended license fleets turn predictable budgets into surprise overages. The upside: reclaim seats and tighten consumption controls to reduce cost and attack surface simultaneously.

Step 1 (Days 1–3): Build a “top spend” map and pick your targets

Start where the money is. Your goal in Days 1–3 is a concise, actionable map.

  1. Pull 90–180 days of transactions from AP and corporate cards. Include marketplace charges (AWS/GCP/Azure marketplaces) — they often hide per-instance or per-seat surcharges.
  2. Normalize and rank by monthly spend or annualized cost. Add columns for billing model (seat, MAU, consumption/API, storage/ingest), renewal date, owner, and whether AI add-ons exist.
  3. Pick 3–5 targets that combine high spend and high waste potential:
    • Seat-heavy collaboration/PM/design tools where license creep is common (e.g., project tooling, visual design platforms).
    • Observability and data platforms with variable ingest/retention charges (log, metrics, tracing).
    • Tools with AI add-ons or per-API consumption (LLM access, embeddings, vision models, vector DB hosting).
    • Vendors with upcoming renewals or vendors billed via cloud marketplaces.

Real example: A product team shows 450 Pro seats on a PM tool billed annually. Activity logs reveal 120 users created projects in two months and only 90 ran substantive workflows. That’s a primary target for reclamation and negotiation.

Step 2 (Days 4–7): Get decision-grade usage data

“Last login” alone is noisy. In 2026, apps emit richer events — captures, runs, edits, API calls, model invocations — and those are what you should use.

  1. Export users + activity: From vendor admin consoles or APIs, export name, email, license type, group, last login, and feature-level events (project create/edit, pipeline run, model/embedding calls, file edits).
  2. Correlate with IdP and HR data: Cross-check employment status, contractor end dates, and whether an account is SSO-backed. SCIM and provisioning metadata often show orphaned local accounts or accounts never linked to SSO.
  3. Define inactivity by tool category: Calibrate thresholds for each category:
    • Chat/collab: no messages/posts or file edits in 30–45 days.
    • CRM: no opportunity edits/contact activity in 45–60 days.
    • Design: no file saves or exports in 60–90 days.
    • Dev tools: no commits, pipeline runs, or PR activity in 30–60 days.
    • AI features/APIs: no model runs, embedding calls, or API traffic in the last 7–30 days depending on usage patterns — consumption spikes are expensive.
    • Vector DBs & model hosting: check storage growth, query counts, and egress — these can be the hidden cost drivers.
  4. Calculate CPAU (cost per active user): Monthly spend ÷ active users. Flag tools with high CPAU or high variance month-to-month — they’re negotiation leverage.

Why use core events: They reduce false positives. A CFO who logs in monthly to close the books is not a candidate for removal even if they don't create content every day.

Privacy reminder: Keep the dataset scoped to license eligibility signals. Enforce role-based access and retention limits so the effort doesn't drift into employee surveillance.

Step 3 (Days 8–12): Create an enforceable seat policy

Think of the seat policy as your operating procedure: short, role-driven, and automatable by your IdP.

  1. Draft one page: Define tiers by function — Pro (creator/admin), Contributor (edit/comment), Viewer (read-only), and AI-enabled variants if vendors distinguish them. Keep examples of job functions that map to each tier.
  2. Specify request and approval flows: Who can request upgrades, what business case is required, and where approvals are recorded (ticketing system or procurement intake).
  3. Define reclamation rules: For example: “Downgrade after 45 days inactivity; remove after 90 days unless exception approved.” Make AI-enabled tiers a separate opt-in with manager approval.
  4. List explicit exceptions with owners: Financial close accounts, security/IR, executive assistants. Assign a named owner and a quarterly review cadence for each exception.

Why roles, not seniority: License eligibility follows workflow. A junior DevOps engineer running CI pipelines needs a higher tier than a VP who only views dashboards.

Step 4 (Days 13–18): Right-size seats with a two-pass approach (soft then hard)

Soft then hard. Sudden removals cause support tickets and shadow IT. Use a humane, documented process.

  1. Pass 1 — Soft reclaim (notification + self-serve):
    • Notify flagged users and managers: explain the change, timeframe, and how to request retention.
    • Provide a one-click justification form that routes to the manager for approval.
    • Typical window: 7–10 days.
  2. Pass 2 — Hard reclaim (downgrade or remove):
    • Downgrade tiers first (Pro → Contributor) to preserve access to history; remove accounts primarily for leavers or true non-use.
    • Enforce via IdP group changes + SCIM; log every change in your ledger for auditability.
    • Track reclaimed licenses by vendor and reason — this is your negotiation data.

Example: An AI add-on billed at $30/user/month becomes $13,500/month for 450 seats. Downgrading 200 inactive seats to a non-AI Pro tier saves $6,000/month. If the vendor supports pooled credits, move infrequent users to a pool instead of per-seat AI billing.

Step 5 (Days 19–24): Put enforcement on rails — IdP groups, JML, and automation

Manual cleanup wins are temporary. Automation is how savings stick.

  1. Use IdP groups mapped to license tiers: Create groups like App-Pro, App-Contributor, App-Viewer and map via SCIM or vendor APIs to license assignments.
  2. Implement Joiner/Mover/Leaver (JML) automation:
    • Joiner: default to the lowest onboarding tier; manager requests upgrades with a business case.
    • Mover: role change triggers automatic review of group membership and license tier.
    • Leaver: immediate deprovisioning, token revocation, and license reclamation.
  3. Time-bound contractor accounts: Set expirations in your IdP and review upcoming expiries weekly.
  4. Lock down local accounts and rotate service keys: Enforce SSO and rotate API/service-account keys; add alerts for unexpected token usage.
  5. Monitor API keys and model endpoints: Set consumption alerts on AI API keys and throttle or rotate keys that spike unexpectedly—this prevents runaway costs from experiments or credential theft.

Security note: These controls reduce spend and risk. Each reclaimed seat eliminates a credential an attacker could leverage and shrinks your blast radius for compromised API keys and tokens.

Step 6 (Days 25–30): Fix the renewal math and negotiate from a stronger position

Once cleaned, you negotiate with hard data: active users by tier, peak MAU, AI consumption patterns, and storage/egress trends.

  1. Recalculate your baseline: Active users by tier, peak MAU, monthly API/AI consumption (tokens, GPU-hours), vector DB storage and query volumes, and a conservative growth forecast.
  2. Choose commitment strategy:
    • Stable, predictable usage: consider annual commits for discounts.
    • Volatile usage or heavy AI consumption: push for quarterly true-ups, monthly seat pricing, pooled credit models, or burst buckets only for authorised pipelines.
  3. Ask vendors for specific concessions:
    • Adjust committed seat counts to measured active users rather than provisioning counts.
    • Allow quarterly seat rebalancing or per-feature true-ups instead of rigid annual blends.
    • Cap AI overages, move to pooled/organizational credits for expensive model hosting, or negotiate fixed per-inference pricing for standard models.
    • Include explicit charges for model-hosting egress or vector DB storage and request transparency on how queries are billed.
    • Require data portability/deletion clauses and a clear process for export at termination (this is increasingly important for compliance under regional AI rules).
  4. Institutionalize controls: Assign vendor owners (business + IT/security), add a lightweight intake form for new tools, and require procurement sign-off for purchases above a threshold or that include AI consumption.

Realistic savings: After clean-up and contractual controls, repeatable wins typically come from removing departed users, downgrading unused premium tiers, and preventing future sprawl with group-based provisioning and procurement gates. Expect single-tool savings ranging from 10–40% depending on how aggressive the reclaim and renegotiation are.

Common mistakes (and how to avoid them)

  • Relying only on last login: Use app-level events such as edits, runs, and API calls.
  • Cutting seats without notice: Use a soft reclaim window and provide a simple appeal path to managers.
  • Ignoring service and shared accounts: Replace shared logins with service principals where possible; if shared accounts remain, document ownership, rotate credentials, and restrict privileges.
  • Letting marketplace billing hide costs: Normalize marketplace invoices and insist on line-item clarity for seats vs consumption vs hosting.
  • Allowing exceptions to proliferate: Every exception needs a named owner and a quarterly review; otherwise exceptions become the rule.

Pro tips for better results

  • License “parking lot”: If your vendor supports unlicensed-but-in-directory states, use them for inactive-but-preserved accounts—reactivation is cheaper than new seat provisioning in many vendors.
  • Standardize inactivity windows by category: Makes policies defensible and easier to explain.
  • Trend CPAU and consumption metrics: CPAU (cost per active user) and monthly AI consumption trends are leading indicators for renewal negotiations.
  • Treat AI as a controllable feature: Gate AI feature enablement behind manager approval and central credit pools to avoid surprise overages.
  • Audit vector DBs and embeddings: Embeddings/storage can generate recurring costs—archive or delete cold vectors and set TTLs (time-to-live) where possible.
  • Automate logs and audits: Keep an auditable ledger of who changed what and why—vital for finance, security, and renewal conversations.

FAQ

How do I define “inactive” without breaking workflows?

Use the tool’s core activity signals (edits, runs, posts, builds, API calls) rather than login alone, and set thresholds by category. Run a notification window (7–10 days) and allow exceptions with a named owner to avoid disrupting essential but infrequent users (e.g., monthly closers).

Should I move to pooled credits for AI or keep per-user billing?

Pooled credits often work better for teams with bursty, project-based AI usage (marketing experiments, prototypes) because they avoid per-user sticky costs. Per-user AI billing is easier to manage for consistent developer teams. Decide based on your consumption pattern: if less than 30% of users generate 80% of AI calls, pooled credits plus manager gates usually save money.

Do I need a SaaS management platform to do this?

No. You can achieve meaningful savings with exports, IdP group controls, and a renewal calendar. SaaS management platforms (Zylo-style or others) speed scale and automate reconciliation, but they won't replace precise activity definitions, governance, and enforceable seat policies.

What do I do about unexpected AI consumption spikes?

First, identify the source—user, integration, or pipeline. Rotate or revoke compromised API keys, throttle endpoints where possible, and enable consumption alerts. Negotiate consumption caps or pooled credits with vendors and add contract language limiting surprise overages.

What is the fastest win I can execute this week?

Remove or time-box licenses for departed employees and expired contractors. That often yields immediate savings and reduces security risk with minimal pushback.

Bottom line: Treat SaaS licenses and AI credits like perishable inventory. Use app-specific usage data, IdP-driven enforcement (SCIM/SSO/groups), and a short, role-based seat policy to cut waste quickly—then automate JML and consumption controls so the savings stick in 2026’s more complex billing landscape.