Skip to content

SaaS Management Asset class 03 of 05

Find the SaaS nobody told you about. Including the AI.

Three discovery signals converge: the identity provider, vendor APIs and a browser extension. Together they surface every application in use, then reclaim the licences, revoke the grants and close the offboarding gap automatically.

Book a demo See the offboarding console
  • 47 connectors
  • 3 discovery signals
  • OAuth risk scoring
Discovery
Illustrative UI
  • SYNC Identity provider

    Entra ID · Okta · MFA enrolment

  • PULL Vendor API

    47 connectors · users, licences

  • SIGNAL Browser extension

    Domains · time-on-app · users

Application record

Owners
4 types
Licences
240 / 186
Active 90d
61%
SSO
Covered
Application Classification
  • Slack IdP API Ext
    Sanctioned
  • Notion API Ext
    Shadow IT
  • Miro Ext
    Unsanctioned
  • ChatGPT Ext
    Shadow AI
Sample data
The problem

The problem: the offboarding gap

Someone left four months ago. Their Microsoft 365 licence was removed on day one. Their Figma, Notion, Linear and ChatGPT seats are still being billed, and their OAuth grant to a third-party app still has read access to the company drive.

The offboarding process was not ignored. It ran, it passed, and it only ever covered the applications the identity provider knew about. Everything bought on a card sat outside it.

  1. Day 0

    The leaver ticket closes

    Licence removed, sign-in blocked, record archived.

  2. Day 1

    Six seats nobody is looking at

    Every app bought outside the identity provider still bills.

  3. Day 31

    The first renewal bills anyway

    The subscription record never learned they had gone.

  4. Day 124

    The OAuth grant is still live

    A consented third-party app still reads company files.

305

SaaS applications in the average enterprise portfolio

46%

of SaaS licences go unused — the average organisation uses 54%

+393%

growth in AI-native application spend at large enterprises

47

SaaS connectors

3

converging discovery signals

13

workflow actions

0–100

OAuth grant risk score

Inside the product

Offboarding, from checklist to receipt

One user, every licence they held, and the revocation state of each. The monthly cost of whatever is still open sits at the top of the panel.

Still billing, 124 days on Illustrative

£214.25$289€251/mo

6 of 7 licences from one leaver, still assigned and still charged. The panel below takes that figure to zero and writes the evidence.

Working interface · press play or watch it run

Users / Offboarding / u-4821

Illustrative UI · sample data

Departed user · access removed 124 days ago

Directory record archived · 7 licences held at departure

Still billed

£214.25$288€250/mo

Revocation progress 1 of 7

  • Microsoft 365 · E3

    Revoked on leaver date · sign-in blocked

    —

    Pending

  • Slack · Business+

    Connector · deactivate member

    £11.75$16€14

    Pending

  • Notion · Plus

    Connector · remove from workspace

    £8$11€9

    Pending

  • Box · Business

    Connector · transfer, then deactivate

    £13.5$18€16

    Pending

  • HubSpot · Sales Hub Pro

    Connector · soft mode (no suspend API)

    £75$101€88

    Pending

  • ServiceNow · ITIL

    Connector · lock and strip roles

    £84$113€98

    Pending

  • ChatGPT · Team

    Connector · remove from workspace

    £22$30€26

    Pending

6 licences outstanding · every step written to the audit log

OAuth grants still live

Scored 0–100 on data sensitivity, scope breadth, consent type and dormancy.

  • Document sync utility

    Unverified publisher · Unused 124 days

    drive.readonly offline_access
    High risk

  • Marketing enrichment add-on

    Verified publisher · Unused 38 days

    Mail.Read User.Read.All
    Elevated risk

  • Meeting recorder

    Verified publisher · Used 6 days ago

    Calendars.Read
    Low risk

Audit log · this user

1 entry

  1. › entra.licence.remove ok

Written as each step returns. Revocation is also a workflow action, so this never has to be done by hand twice. The Auditor role can read the evidence without holding the permissions to change anything.

Per-licence state

Pending, in progress or complete: never a single green tick standing in for seven separate systems.

Vendor-accurate steps

Each connector runs the deprovisioning the vendor actually supports, and names the step it took.

Evidence, kept

Every provisioning and deprovisioning action is written to an audit log the Auditor role can read.

Visibility · Optimization · Management · Governance

The four pillars, applied to SaaS

Every asset class on the platform is governed the same four ways. Here is what each one means when the asset is a subscription somebody bought in a browser.

Visibility

01 / 04

Every application, sanctioned or not, with the evidence of who uses it.

Identity provider Vendor API Browser extension One application record
  • Browser extension detecting SaaS domains, time-on-app and per-user attribution
  • Identity provider sync from Entra ID and Okta including MFA enrolment
  • Connector sync pulling authoritative user and licence lists from the vendor
  • Shadow AI Dashboard with three-tier adoption risk model
4 more of 8
  • OAuth grant discovery for consented third-party applications
  • Executive Dashboard rolling up apps, users, spend and trend
  • Usage Summary with Active Usage Rate and power-user identification
  • SSO Coverage widget with a ranked list of high-value gap applications

Optimization

02 / 04

Stop paying for seats nobody has opened since March.

Days of zero recorded usage

0306090

Flagged idle at 30 days · six actions from there

  • Unused licence detection at 30+ days of zero usage
  • App Rationalization overlap detection ranked by recoverable saving
  • Actions reclaim, reassign, downgrade tier, archive, remind, dismiss
  • Optimization Score from 0 to 100 across utilisation, response and adherence
4 more of 8
  • Upcoming renewals with days-to-renewal and utilisation rate
  • Cost per licensed user versus cost per active user
  • Realized savings, realized avoidance and ROI by fiscal quarter
  • Bulk deprovision wizard for multi-select offboarding

Management

03 / 04

Automate the busywork between discovery and resolution.

8 triggers 11 conditions 13 actions One workflow canvas
  • Workflow engine 8 triggers, 11 conditions, 13 actions on one canvas
  • Provisioning and deprovisioning across Entra, Okta, Google, M365 and more
  • Four owner types application, business, technical and data owner
  • Report delivery to Slack and Microsoft Teams
3 more of 7
  • Subscription lifecycle with purchased, assigned, available and oversubscribed
  • Custom fields on applications, subscriptions and users
  • Data Agents and Reporting Agents on schedules

Governance

04 / 04

Close the loop and keep the receipt.

OAuth grant risk score

Sensitivity, scope, consent, dormancy

Low 0–39 Elevated 40–69 High 70–100
  • Offboarding checklist per user with per-licence revocation status
  • OAuth grant risk scoring on sensitivity, scope, consent and dormancy
  • One-click grant revocation also available as a workflow action
  • Six-tier role model including a dedicated Auditor role
4 more of 8
  • Wasted spend metric for licences still held by departed users
  • Risk assessment on data sensitivity, compliance and business criticality
  • Audit log covering every provisioning and deprovisioning step
  • Per-application budgets with warning and critical thresholds

31 named capabilities in total, across the four pillars.

The automation layer

Nobody should do the same
seven clicks twice.

Eight triggers, eleven conditions and thirteen actions sit on one canvas, the engine between discovery and resolution. Three worked examples below; switch between them.

Workflows / Leaver detected

Illustrative configuration

When · 1 of 8 triggers

User marked leaver

Identity provider · Entra ID or Okta

If · 11 conditions available

  • User holds one or more paid licences
  • Application has a deprovisioning connector

All must hold

Then · 13 actions available

  1. 01 Deprovision Each connector, in the mode that vendor supports
  2. 02 Revoke OAuth grants Every consented third-party application
  3. 03 Reclaim seats Returned to the subscription pool
  4. 04 Notify Application owner, in Slack or Teams

Result Offboarding checklist closes with per-licence evidence

Beyond discovery

Three things the category does not do

Discovery is table stakes. What happens after discovery is where SaaS management platforms quietly stop.

01

Shadow AI is a first-class capability, not a footnote

AI tools are classified from application feature tags in the catalogue rather than a hardcoded list, so the detection set grows on its own. The dashboard ranks adoption risk by the share of your organisation using each tool, because ten people on ChatGPT is a different problem to a thousand.

Tools nobody registered reach that list through the browser extension, the one signal of the three that can see an account somebody opened with a work email and paid for on a personal card.

Shadow AI · share of organisation Illustrative
  1. 01 ChatGPT Tier 1 34%
  2. 02 Claude Tier 2 11%
  3. 03 Gemini Tier 3 4%

Each tool can be set to managed, blocked or ignored. The classification comes from catalogue feature tags, so a new tool is detected before anyone writes a rule for it.

02

Offboarding you can prove finished

Most platforms tell you a user was offboarded. This one shows every licence they held, the connector status behind it, and whether revocation is pending, in progress or complete, alongside the estimated monthly cost of whatever is still open.

That last figure has a name in the product: wasted spend, counted against every licence a departed user still holds.

  1. State 01

    Pending

    Licence held, connector queued, cost still accruing

  2. State 02

    In progress

    Vendor call in flight, with the specific step named

  3. State 03

    Complete

    Seat released, evidence written, cost falls to zero

03

Deprovisioning that respects each vendor’s reality

HubSpot has no suspend API, so there is a soft mode that strips roles and a hard mode that deletes. Box transfers file ownership before deactivating. ServiceNow locks the account and strips every role and group membership. Generic connectors cannot do this.

These three run on three separate code paths.

HubSpot
No suspend API exists. Soft mode strips every role and releases the paid seat; hard mode deletes the user outright.
Box
File ownership is transferred to a nominated owner first, and only then is the account deactivated.
ServiceNow
The account is locked out, then every role and group membership is removed individually.
Integrations

Connectors that pull the truth from the vendor

A connector reads the authoritative user and licence list from the application itself, then runs deprovisioning the way that vendor supports it.

Connectors shipping today

47

Written against each vendor's own API.

Named here
26
Also shipping
21

Identity 02

  • Entra ID
  • Okta

Productivity & collaboration 13

  • Microsoft 365
  • Google Workspace
  • Slack
  • Zoom
  • Notion
  • Miro
  • Box
  • Dropbox
  • Atlassian
  • Asana
  • Monday.com
  • Airtable
  • DocuSign

Business systems 05

  • Salesforce
  • HubSpot
  • ServiceNow
  • Tableau
  • Databricks

Engineering & observability 04

  • GitLab
  • Datadog
  • New Relic
  • PagerDuty

AI 02

  • OpenAI
  • Anthropic

Twenty-six named here, of forty-seven connectors shipping today. See the full list.

  1. 01

    Authenticate

    Scoped credentials held per application, never a shared admin token.

  2. 02

    Sync

    Users, licence tiers, seat counts and assignment dates, straight from the vendor.

  3. 03

    Reconcile

    Vendor list matched against the identity provider and the browser signal.

  4. 04

    Act

    Provisioning and deprovisioning run the way that vendor actually supports.

Questions

What buyers ask us first

6 questions, answered by the engineers who built the connectors.

If your question is more specific than these, the answer is usually a connector detail, and we will give it to you straight.

Ask an engineer
What does the browser extension actually record?

The application domain, time spent on it and the user it belongs to. That is the signal that finds applications bought on a card and never mentioned to IT, the ones no identity provider and no connector will ever tell you about.

Can we run this without deploying an extension?

Yes. Two of the three signals need nothing on the endpoint: identity provider sync from Entra ID or Okta, and connector sync pulling authoritative user and licence lists from each vendor. The extension is what closes the gap on unsanctioned tools, so most organisations pilot it on one department first.

How do you decide a licence is unused?

Thirty or more days with zero recorded usage, measured against the vendor’s own user list. From there the actions are explicit: reclaim, reassign, downgrade tier, archive, remind or dismiss. Dismissing counts as an action and is written to the audit log like the other five.

How is Shadow AI detected if new tools appear every week?

Classification comes from the feature tags already held in the application catalogue, so the detection set grows without waiting for a product release. The Shadow AI Dashboard then ranks adoption risk by the share of your organisation using each tool, and each one can be marked managed, blocked or ignored.

What happens when a vendor has no suspend API?

The connector does the closest defensible thing and tells you which one it did. HubSpot has no suspend endpoint, so there is a soft mode that strips roles and releases the paid seat, and a hard mode that deletes. The choice is yours per application, and the outcome lands in the audit log either way.

Who can see the spend, and who can act on it?

A six-tier role model, including a dedicated Auditor role that can read the offboarding evidence and the audit trail without holding the permissions to change anything. Application, business, technical and data owners are held separately, so the person accountable for renewal is not automatically the person with revocation rights.

Start with the offboarding gap

Watch a leaver offboard,
application by application.

The demo runs the console end to end: the licence still held, the OAuth grant still live, and the vendor with no suspend endpoint, with every step named and every connector call shown.

Book a demo Close the offboarding gap

No gated PDF, and if you say you are only exploring, nobody chases you weekly.