SaaS Spend Management: Find Every App and Cut Waste Before Renewal

SaaS spend management is the practice of finding every software-as-a-service subscription a company pays for, matching the licenses it owns to the people who use them, and cutting, downgrading, or renegotiating each contract before it renews. Discovery draws on four sources (accounts payable and corporate card data, single sign-on logs, endpoint or browser telemetry, and expense reports) because each one misses apps the others catch. The waste is measurable: Zylo's 2026 SaaS Management Index, built on more than 40 million licenses, found that the average organization leaves 36% of its SaaS licenses unused when measured against recommended utilization levels, and that business units now control 81% of SaaS spend. Start each review 90 to 120 days before the renewal date, and run the same inventory as a security control, because every unmanaged app holds company data and many hold an OAuth grant into email or files.

Where does SaaS spend go to waste?

SaaS waste falls into six patterns, and each one leaves a different trace in the data. The table maps each pattern to the evidence that exposes it and the action that usually follows.

Bundles change while you hold them. Microsoft's December 2025 packaging update brings Intune Plan 2, Remote Help, and Defender for Office 365 Plan 1 into Microsoft 365 E3, so a company that pays separately for an endpoint management add-on or a remote support tool may now pay twice. Price uplifts compound across the portfolio. Vertice's SaaS Inflation Index, published July 29, 2026, put the current SaaS inflation rate at 16.4% and reported that June 2026 recorded the highest rate on record. In Zylo's 2026 survey of 218 IT leaders, 78% reported unexpected charges tied to consumption-based or AI pricing in the prior 12 months, and 61% had cut projects because of unplanned SaaS cost increases. The total keeps climbing: Gartner's October 21, 2026 forecast puts worldwide software spending at $1,464 billion in 2026, up 15.2%.

How do you find every SaaS app the company pays for?

No single system lists every SaaS app, so discovery joins four sources and reconciles them by vendor, product, and owner. Each source has a blind spot, and the gaps between them are where shadow SaaS lives.

Accounts payable and corporate card data

Finance records catch every subscription paid by invoice or company card, including apps nobody signs in to through single sign-on (SSO). They miss free and freemium tools, products bundled into another vendor's invoice, and software bought through a cloud marketplace. AWS, for example, bills AWS Marketplace purchases on its own invoice, so those subscriptions appear as cloud spend instead of as a separate vendor in accounts payable. Pull at least 12 months of transactions so every annual contract appears once.

Single sign-on and identity provider logs

The identity provider (Microsoft Entra ID, Okta, or Google Workspace) shows which apps people sign in to and how often, which makes it the best source for usage. It sees only apps connected to SSO, so tools with local passwords never appear, and its history is short. Microsoft Entra ID keeps sign-in logs for 30 days on P1 and P2 licenses and seven days on the free tier, and retention changes are not retroactive, so a 90-day usage view needs logs exported to storage before the review starts.

Endpoint and browser telemetry

Endpoint management agents and managed browsers record installed desktop apps and the web apps people open, including free tools and trials that never reach finance. They miss personal devices and unmanaged browsers, and they report visits instead of paid seats, so they confirm use but not cost. Browser monitoring also collects personal browsing data, so agree on its scope with HR and counsel before turning it on.

Expense reports

Expense reports catch subscriptions that employees buy on personal cards and claim back, a common entry point for shadow SaaS. In Zylo's 2026 index, expense-based SaaS spend rose 267% year over year, and ChatGPT became the most expensed application. An expense line shows the purchase but not who uses the app, what data it holds, or the terms someone accepted at sign-up.

Add one more source for security: the OAuth grant list in Microsoft Entra ID or the Google Workspace Admin console. It shows third-party apps that users have connected to company accounts, including free ones that never appear in finance data.

How do you measure whether SaaS licenses are used?

License utilization is the share of paid seats with real activity in a defined window, and the definition of "active" decides the answer. A sign-in is the weakest signal. A meaningful action, such as a document edited, a ticket closed, or a report run, is the strongest, and most admin consoles report both. The Active Users report in the Microsoft 365 admin center, for example, shows license use by product over 7, 30, 90, or 180 days.

Use a 90-day window for most apps so that people who work in a tool once a quarter keep their seat, and a 12-month window for seasonal tools such as tax, audit, or budgeting software. Sort every seat into one of four decisions: keep, downgrade, reassign, or remove. Send the list to the app's business owner with a deadline, and give reclaimed seats to the next new hire or requester before anyone buys more.

Then reconcile the counts with the contract, because seat reductions usually take effect only at renewal. Salesforce's Main Services Agreement (the September 15, 2025 version) states that quantities purchased cannot be decreased during the subscription term, and Microsoft's new commerce program allows a prorated cancellation only within seven calendar days of purchase. Utilization data turns into savings at the renewal table, which is why the calendar matters as much as the measurement.

When should you start a SaaS renewal review?

Start 90 to 120 days before the renewal date. Three deadlines sit inside that window, and missing any one of them leaves you accepting the vendor's quote. The first is evidence: measuring 90 days of use requires 90 days of logs, and the identity provider may keep only 30. The second is the notice date. Salesforce's agreement renews subscriptions automatically for one-year terms unless either party gives written notice at least 30 days before the term ends, and Adobe opens its renewal window 30 days before a team's anniversary date. The third is time to build an alternative, because a credible replacement takes weeks to evaluate and the vendor knows how many days are left.

Renewal timing also decides when price increases reach you. When Microsoft moved its commercial suites to new list prices on July 1, 2026, it kept existing customers on current pricing until renewal, so each company's renewal date set the day its cost went up. Build the calendar from the contract repository and the accounts payable data, with the vendor, owner, term end, notice deadline, auto-renewal status, and annual cost of each contract. Set a threshold for full reviews, such as any app above a set annual cost or any app that holds customer data, and give the long tail a lighter check: whether the app is still used, whether it has an owner, and whether it sits behind SSO.

Which contract terms lower SaaS costs at renewal?

A renewal quote is an opening position. The terms below change what a contract costs over its life. Treat them as negotiating practice, and have counsel review the final language, because interpreting a contract is a legal question.

• True-down rights: the right to reduce quantities at each anniversary at the existing unit price. Salesforce's standard agreement shows why this matters, because a renewal at lower volume or for a shorter term is re-priced without reference to the prior term's per-unit price.
• Multi-year price caps: a fixed unit price for the term, or an annual increase capped at a stated percentage, carried into the first renewal.
• Co-terming: aligning add-on purchases with the main contract's end date so every seat renews together and can be negotiated as one block. Adobe's Value Incentive Plan works this way, prorating purchases to a single anniversary date.
• Usage-based tiers: price bands that step down as well as up, or consumption pooled across teams, so a smaller year costs less.
• Auto-renewal terms: remove the clause, or shorten the notice period and require the vendor to send a renewal reminder before the deadline.

Bring evidence to the conversation: the utilization report, the alternatives you evaluated, and your budget. A vendor facing a lower seat count and a credible exit plan negotiates differently from one handed a signature deadline. For contracts with the large software publishers, where audit rights and use rights matter as much as price, our guide to software license optimization covers the publisher-specific terms.

How do you keep SaaS spend from growing back?

A cleanup does not last unless purchasing changes, and three controls keep the inventory accurate. The first is one intake path for new software: a short request that captures the business need, the data the app will touch, the expected users, and the cost, routed to IT, security, and finance. The second is a named business owner for every app above the review threshold, accountable for its seat count, its renewal decision, and removing access when people leave. The third is a quarterly review of utilization, new apps found by discovery, and contracts entering the 120-day window.

Intake has to be faster than a credit card, or people will route around it. Business units control 81% of SaaS spend in Zylo's data, while IT directly manages 15%, so the workable goal is visibility and guardrails that business units will follow. In a company without a full-time CIO, a virtual CIO can own the process.

SaaS management platforms automate much of the work. Products in the category, including Zylo, Torii, BetterCloud, and Flexera One SaaS Management, connect to finance systems, identity providers, and app admin interfaces to build the inventory, track usage, and warn about renewals. A platform makes sense when the app count runs into the hundreds and someone will act on what it shows. Smaller portfolios can run the same process from accounts payable data, SSO exports, and a renewal calendar kept in a spreadsheet or ticketing system. BD Emerson does not resell any of these products.

What security risks does unmanaged SaaS create?

Every app in the inventory is also a place where company data lives, and the cost review is the cheapest moment to check four risks.

Shadow SaaS skips security review. Apps bought on expense reports or used on free tiers never had their data handling, retention, or breach terms checked. AI tools are adding to that population quickly: Zylo reported on September 23, 2026 that spending on AI-native software rose 334% year over year. Our guide to shadow AI covers detection and an acceptable use policy for that subset, and the vendors behind approved apps belong in your third-party risk management program.

OAuth grants outlive the decision that created them. When a user connects a third-party app to Microsoft 365 or Google Workspace, the app receives a token to read mail, files, or calendars on that user's behalf. Microsoft recommends allowing user consent only for apps from verified publishers and notes that changing the consent setting leaves existing grants in place, so a cleanup has to review the grants themselves. In Google Workspace, the API controls page lists every accessed app with its user count and requested services, and admins can mark each app trusted, limited, or blocked. The risk is concrete. Google's Threat Intelligence Group reported that, beginning as early as August 8, 2025 and continuing through at least August 18, an attacker used compromised OAuth tokens from the Salesloft Drift integration to export data from numerous corporate Salesforce instances and search it for credentials.

Accounts survive offboarding when apps sit outside SSO. Disabling a user in the identity provider blocks new sign-ins to every app that relies on SSO, and SCIM provisioning, the standard protocol defined in RFC 7644, can deactivate or remove the account in the app itself. An app with local passwords keeps working for a former employee until someone deletes the account by hand, so the inventory should mark which apps lack SSO and SCIM and give each one a named offboarding step.

The SSO tax is a cost line and a security line. Many vendors sell single sign-on only in an enterprise tier, and CISA's 2024 work on SSO adoption called that premium an "SSO tax" and recommended that vendors include SSO in the base offering. Price the premium at renewal against the cost it avoids: manual account management, slower offboarding, and the extra audit evidence an app outside SSO needs.

How does BD Emerson run a SaaS spend review?

BD Emerson runs SaaS spend reviews within our IT cost optimization service, and each review follows the renewal calendar. We start from read-only exports: accounts payable and card data, the identity provider's sign-in logs and OAuth grant list, and admin console usage reports for the largest apps. From those we build one inventory with an owner, a renewal date, a utilization figure, and a security note for each app, then rank renewals by the money at stake and the days left before each notice deadline. For each contract in the window, we prepare the seat count, the tier mapping, and the terms to ask for, and your team or our fractional CIOs take them to the vendor. Security findings, such as apps outside SSO, broad OAuth grants, and accounts that outlived their owners, go in the same report, so a cost cut does not open a gap. We are vendor-neutral: we do not resell software or licenses and take no resale margin, so our recommendation does not change with the vendor you keep. Cloud bills follow the same discipline, as our guide to cloud cost optimization explains.

Frequently asked questions

What is the difference between SaaS management and SaaS spend management? SaaS management covers the whole life of each app: discovery, access, security settings, provisioning, and offboarding. SaaS spend management is the cost side of that work: the inventory of what the company pays for, license utilization, renewal dates, and negotiation. The two share one inventory, because the data that shows an unused license also shows an app outside single sign-on or an account that outlived its owner.

How do I find all the SaaS applications my company uses? Combine four sources: accounts payable and corporate card transactions, single sign-on logs from your identity provider, endpoint or browser telemetry, and expense reports. Each misses something. Finance data misses free tools, SSO logs miss apps with local passwords, and telemetry misses personal devices. Add the OAuth grant list from Microsoft Entra ID or Google Workspace to catch connected apps nobody pays for, then reconcile everything into one inventory with an owner for each app.

How much SaaS spend is wasted? Zylo's 2026 SaaS Management Index found that, measured against recommended utilization levels, the average organization leaves 36% of its SaaS licenses unused. The figure varies widely by company and by app, so treat it as a reason to measure your own portfolio. Your number comes from comparing paid seats with 90 days of activity for each app, then adding duplicate tools and wrong tiers.

When should you start preparing for a SaaS renewal? Start 90 to 120 days before the renewal date. You need time to collect 90 days of usage data, to agree seat counts with the app owner, and to evaluate an alternative before the notice deadline passes. Many agreements renew automatically unless you give notice in advance. Salesforce's standard agreement, for example, requires written notice at least 30 days before the term ends.

What is shadow SaaS? Shadow SaaS is software a team or employee uses for work without IT or security approval, often bought on a corporate card or expense report or used on a free tier. It wastes money through duplicate tools and creates risk through company data stored outside your controls and OAuth grants into company email or files. Expense data, browser telemetry, and OAuth grant inventories are the best ways to find it.

Do you need a SaaS management platform? A platform helps when you have hundreds of apps and a team that will act on its findings, because it automates discovery, usage tracking, and renewal alerts. Smaller portfolios can run the same process from accounts payable data, SSO exports, and a renewal calendar kept in a spreadsheet or ticketing system. Either way, the savings come from the decisions app owners make before each renewal.

What is the SSO tax? The SSO tax is the premium a vendor charges for single sign-on, usually by offering it only in an enterprise tier. CISA's 2024 report on SSO adoption by small and medium-sized businesses used the term and recommended that vendors include SSO in the base offering. At renewal, price the premium against the cost of managing that app's accounts and offboarding by hand.

If your largest SaaS renewals fall in the next two quarters and nobody can say how many seats are in use, our IT cost optimization team can build the inventory, measure utilization, and prepare each renewal with your app owners.