How to Find Unused SaaS Licenses: The 2026 Audit Framework

A 600-person SaaS company we modeled in March was paying for 1,847 SaaS seats. Active users in the trailing 30 days: 1,142. That is 705 dormant seats — 38% of the contract — across Salesforce, Outreach, Slack, Zendesk, Adobe Creative Cloud, Notion, and Zoom. Annual dollar value at list pricing: roughly $380K. The CFO had no idea. The data lived in three different systems, none of them reconciled. This post is the audit framework that surfaces the number in a Tuesday afternoon.

Try the free calculator — 15 seconds, no signup. Paste your headcount, see the typical dormant-seat range across your stack.

The problem: dormant seats hide in three different systems

The reason most CFOs don't know their dormant-seat number isn't that they don't care. The three numbers required to compute it live in three different places, owned by three different people.

Contracted seats. What the contract PDF says you bought. Lives in DocuSign or a procurement folder, owned by Legal or Finance.

Provisioned seats. What is currently assigned in the IdP — Okta, Azure AD, Google Workspace. Owned by IT.

Active seats. Who logged in or performed a value-creating action in the last 30 days. Lives in each vendor's admin console, owned by whoever first championed the tool.

You need all three. Most companies have at most two. (Productiv's 2024 SaaS statistics report the average SaaS portfolio is over 300 apps with under 50% of users actively engaged across them; almost no company reconciles all three sources.) The result is structural shelfware that compounds every renewal: contracts auto-renew at the original seat count, the IdP keeps deprovisioned employees billable for 60–90 days because the SCIM hook isn't wired, and auto-renewal clauses quietly roll into year two before anyone re-baselines. (Vendr's missed-cancellation-window playbook covers what to do when the notice deadline already passed.) By year three, you are typically paying for 30%+ more seats than active usage justifies.

The audit methodology: dormant_seats × monthly_cost

The framework is four lines of math, tool by tool.

provisioned_seats = count(IdP assignments)
active_seats = count(users who logged in or performed key action in 30 days)
dormant_seats = provisioned_seats − active_seats
weighted_dormant_usd = dormant_seats × monthly_cost_per_seat × 12

Three notes on doing this honestly.

The IdP login is a misleading signal. This is the contrarian point most audit guides skip. A read-only Salesforce user who opens the dashboard once a week to check pipeline status logs in. They do not advance pipeline, create records, or extract seat-level value. The IdP says "active." The seat is, for negotiation purposes, dormant. For tools where this matters — Salesforce, Outreach, Zendesk, HubSpot — pull the vendor's in-app activity report (record creates, sequence sends, ticket touches), not the IdP authentication log. Why "unused seats" is the wrong metric in 2026 covers the deeper reasoning — the audit framework here is the floor; the engaged-seat number is the ceiling.

Use contracted seats, not provisioned, for the renegotiation ask. If your contract says 80 seats and your IdP shows 65 provisioned and 41 active, the renegotiation target is 41 + buffer, not 65 − 41. You are paying for 80. The vendor quotes you a discount on 80.

Pick a 30-day window. Seven days under-counts monthly closers and quarterly reviewers. Sixty over-counts seats that are technically active but useless. Thirty is what every vendor's admin console reports natively.

Try the free calculator — 15 seconds, no signup. It runs the dormant-seat math against the typical mid-market stack so you can sanity-check before pulling the real numbers.

Tool-by-tool: where the dormant seats actually hide

Five vendors, five places to find the report, five typical waste signatures. We use list prices throughout this section because that's what shows up on the contract PDFs you're auditing — the calculator models against negotiated mid-market rates ($100 Salesforce, $100 Outreach, etc.) which is where you should land after the renewal call.

Salesforce — Setup → Users → Login History

Salesforce Enterprise is $165/seat/month at list. Pull Setup → Users → Login History, filter to 30 days, export, cross-reference with your IdP. The deltas are dormant candidates. Then pull the AppExchange "User Adoption" dashboard or run a custom report on LastModifiedDate against OpportunityFieldHistory, LeadFieldHistory, TaskFieldHistory. Users who log in but never touch a record are read-only seats — same $165 as a working AE. (The Salesforce renegotiation playbook has the renewal-call script.)

Typical signature: 22-35% dormant by login, plus 10-20% read-only on top. A 100-seat deployment usually has 30-50 negotiable seats.

Outreach — User Activity Report → emails-sent filter

Outreach lists at $130/seat/month and gets bundled into onboarding for every new sales hire. Inbound-focused AEs, customer success teams with "just in case" licenses, sales engineers who log in twice a quarter — all paying full price.

Pull Outreach Settings → User Activity Report, filter for users sending fewer than 20 emails in 30 days. That is your drop list. Typical signature: 30-40% send fewer than 20 emails/month. On the active reps that remain, the AiSDR + Outreach compression math becomes the second lever (catalog: AiSDR compresses Outreach by 55%).

Slack — Analytics → Members tab

Slack Business+ runs $15/seat/month. Cheap until you multiply by 600 employees. Pull Slack admin → Analytics → Members, sort by "Messages posted (30d)." Zero messages posted and fewer than five channels read in 30 days is a drop candidate. Typical signature: 30-45% dormant at companies above 300 employees. Most mid-market companies are also on Business+ ($15) when Pro ($8.75) covers actual feature usage — audit the tier separately.

Zendesk — Reports → Activity overview

Zendesk Suite Professional is $115/seat/month. The dormant-seat picture differs from sales tools — support agents who have a seat are usually active. The waste signature is replaceable: tier-1 tickets an AI deflection layer (Sierra at 60% catalog compression, Decagon at 65%, Intercom Fin at 50%) handles cheaper. Pull Zendesk → Reports → Activity overview, segment by ticket category. Tier-1 categories (password resets, billing questions, basic how-to) are the deflection target.

Limitation: Sierra's flat-fee math only pencils above ~87 Zendesk seats steady-state (~130 year-1 with the $35K setup); Decagon around 67 / 95. Below that, renegotiate down to active count and skip the agent. Intercom Fin is volume-driven and only pencils on growth curves where you'd otherwise hire — see the Fin / Zendesk math.

Adobe Creative Cloud — Admin Console → Insights → Product Usage

Adobe Creative Cloud All Apps Teams runs ~$90/seat/month. The contrarian take: most "Creative Cloud users" at non-design companies (marketing, product, sales ops) only open Photoshop and maybe Acrobat. Single App is $35/seat/month. Pull Admin Console → Insights → Product Usage, look at which apps each user has opened in 60 days. One or two apps means Single App candidate. Migrating two-thirds of users saves $660/seat/year with no productivity hit. This is tier-mismatch waste, not dormant-seat — different lever, same audit shape.

A real example: a 400-person fintech, three months ago

Anonymized but real. 400-person fintech, total annual SaaS spend $2.8M, the CFO ran the dormant-seat audit over 14 days in February. List prices on the contract PDFs:

Total identified dormant value: $209,460/year, or 7.5% of total SaaS spend concentrated in seven contracts.

What landed after Q2 renewal calls: ~$140K/year realized (about 67% of the gap, the typical realization rate). Salesforce gave back 40% of the dormant ask — vendors fight on volume tiers. Slack and Zoom gave back closer to 80% because the renewal account managers had no defense against the activity report. Adobe converted 30 of 38 candidates to Single App — eight users actually needed the full suite once asked. Notion converted only half of the 123 dormant seats — anyone who'd accessed a workspace in the prior 90 days couldn't be cleanly removed without internal pushback. Plan on realizing 60–70% of the identified number, not 100%.

The Sierra evaluation on Zendesk did NOT pencil at 22 seats — Sierra's year-1 cost ($107K including the $35K setup) is roughly 6× the gross savings at that scale. The honest call was to skip the agent, hold Zendesk at the active count, and revisit when support headcount triples or Sierra introduces a smaller tier.

How to apply this — your 14-day audit calendar

What we tell every new mid-market customer to run before their next quarterly renewal cluster.

Day 1-2: pull contracts. Sort by renewal date. Identify contracts with notice windows expiring in the next 90 days — those are the audit priority. The auto-renewal traps post covers which clauses kill your timeline.

Day 3-5: pull IdP assignment lists. From Okta, Azure AD, or Google Workspace, export per-app assignments. That is provisioned_seats. Most IdPs export to CSV in two clicks.

Day 6-9: pull vendor activity reports. Tool by tool, 30-day window: Salesforce login history + record-touch report, Outreach user activity, Slack members tab, Zendesk activity overview, Adobe product usage, Notion members sort, Zoom usage report. That is active_seats.

Day 10-11: build the gap table. Subtract active from provisioned, multiply by monthly cost × 12. Sort descending — the top three rows are 60-70% of the dollar value.

Day 12-13: run the AI agent overlay on the top three — and check the year-1 unlock honestly. For Salesforce, Outreach — model whether AiSDR (~12 SDRs steady-state on the SDR stack) clears your seat count. For Zendesk — only if you're above ~87 seats for Sierra (steady-state) or ~67 for Decagon. Below those, no agent layer; renegotiate down to active. (How to model the math.) For Slack, Zoom, Notion, Adobe — no clean agent replacement; audit ends at dormant-seat plus tier-mismatch.

Day 14: write the renewal binder. Per vendor, two numbers: the dormant-seat ask (renegotiation) and the agent replacement plan where applicable. Walk into the renewal call with both. Most vendors give 30-50% of the dormant gap rather than risk you shopping. If you want a faster path, the seven-tool Q3 audit checklist sequences the same work against the standard mid-market stack.

What you do with the number

Three actions, in order of leverage. Renegotiate at renewal: take the dormant-seat number to the account manager 60 days out, ask to drop to "active count + 15% buffer." Frame as a seat-count drop, not a discount — it changes the negotiation math. (Vendr's contract-renewal guide lays out the timing, leverage, and trade-offs that produce meaningful savings — typically the buyers who open the conversation 90+ days out land in a different pricing band than the buyers who don't.) Tier down: Pro users on Enterprise plans, All Apps users who only need Single App — tier downgrades often save more than dormant-seat removal because they apply across the active user base. Replace seats with AI agents where the math works AND your seat count clears the year-1 unlock: SDR stacks above ~12 SDRs (AiSDR steady-state), tier-1 support above ~87–130 seats (Sierra), internal IT helpdesk where Moveworks pencils. The seat compression primer and the AI-agent replacement deep dive cover the full model.

The bottom line

Dormant SaaS seats are a structural problem, not a discipline problem. The data is hard to gather and harder to keep current. Run the 14-day audit on your top contracts, build the gap table, walk into the next renewal call with the number. The dollars are real — typically $150K–$400K/year at mid-market scale — and most companies leave them on the table because nobody owns the audit cycle.

Try the free calculator — 15 seconds, no signup. Plug in headcount and the tools you actually pay for, and see your typical dormant-seat number across the standard mid-market stack before you pull the real reports.