They should not separate the two. Licence data and access data need to be reviewed together, because a dormant licence may be a cost issue, while a dormant account may also be a governance issue. If the account still has access paths or elevated roles, removal or reclassification matters more than simple cost recovery.
How to Think About Licence Optimisation and Access Cleanup Together
In ITSM, licence optimisation and access cleanup should be treated as one review cycle, not competing tasks. The practical question is whether the record represents only unused cost, or a broader access problem that changes risk, ownership, or entitlement. If an account still has active roles, group membership, or privileged paths, access cleanup takes precedence because the issue is no longer just expense.
When Cost Recovery Is Enough, and When It Is Not
Licence optimisation is mainly a commercial and allocation exercise: reclaim what is unused, right-size entitlements, and reduce shelfware. Access cleanup is an identity and governance exercise: remove accounts, disable stale paths, and correct excessive privilege. The two overlap when the same user, device, or integration still has access material attached to a licence, because a “freeing” action that leaves permissions in place can create false assurance.
That is why dormant licences are not automatically low priority. If the licence is tied to a live account, an API token, or an administrative entitlement, the security question changes from cost recovery to authority management. If no access path remains and the licence is only a billing artefact, optimisation can proceed on its own timetable.
Practical Ordering for ITSM Teams
The safest ordering is to confirm access state first, then decide whether the licence can be reclaimed, reclassified, or retired. A simple cost-led cleanup can miss shadow access, especially where directories, SaaS roles, and manual exceptions have drifted apart. The review should also check whether the account is dormant because the person left, because the service changed, or because the entitlement model is outdated.
- Start with the account, role, and entitlement record, not the licence label alone.
- Confirm whether the identity is still authenticated, authorised, or delegated anywhere else.
- Remove or downgrade access before reclaiming the licence if the account still has meaningful reach.
- Only treat it as licence optimisation when the record is clearly disconnected from active access.
Risk and Threat Considerations
Weak separation between licence records and access records can hide excessive privilege, stale accounts, and orphaned access paths. The main risk is that teams close a cost issue while leaving an identity issue untouched, which preserves the conditions for unauthorised use, account takeover, or undetected privilege retention.
Failure mechanism: Access remains active through a dormant account, shared entitlement, or connected service path after the licence is reclaimed or reclassified, so the organisation believes it has reduced exposure when it has only reduced spend.
Impact: The organisation can lose both money and control, because stale access may continue to support misuse, lateral movement, audit findings, or a failed recertification outcome.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | Licence cleanup overlaps with account and entitlement lifecycle control. |
| Recommendation — Review dormant accounts and remove unneeded access before reclaiming licences. | ||
| ISO/IEC 27001:2022 | A.5.18 — Access rights | The question turns on whether access rights still exist when a licence looks dormant. |
| Recommendation — Reconcile active access rights before treating a licence as only a cost item. | ||
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Dormant licences often mask live accounts that still need lifecycle control. |
| Recommendation — Inventory and disable stale accounts before optimising licence counts. | ||
Practitioner Guidance
What to prioritise: Prioritise the records that combine dormant spend with active authority. If a user, service, or integration still has access to production systems, treat removal of access paths as the first decision and licence recovery as the follow-on action.
What to verify: Verify the full entitlement footprint, including groups, delegated access, privileged roles, and connected tokens or service relationships. The right test is whether the identity can still do anything material, not whether the licence is technically assigned.
Practitioner takeaway: The useful ITSM decision is not “licence first” or “access first”, but whether the object still carries operational authority. If it does, clean up access before you call it a pure optimisation task.
Related resources from NHI Mgmt Group
- When should organisations prioritise access governance over software spend optimisation?
- When should organisations prioritise cleanup of unused access over adding more approval steps?
- When should organisations prioritise provisioning automation over more access cleanup?
- Should organisations prioritise JIT access over broad entitlement cleanup?