Software rationalization through identity governance: what teams need to know

At a glance

What this is: This is an Okta analysis of software rationalization through identity governance, arguing that access data, certifications, and deprovisioning can surface unused SaaS licenses and reduce waste.

Why it matters: It matters because IAM and IGA teams are being asked to use governance controls not only for compliance and least privilege, but also to prove value by reducing SaaS cost without harming productivity.

By the numbers:

• Gartner expects the SaaS market to reach nearly $205 billion in 2024, up from $105.6 billion in 2020.
• Gartner has estimated that 25% of SaaS spending is underutilized.

Context

Identity governance is often described as a compliance and access-control discipline, but in SaaS-heavy environments it is also a control point for software rationalization. The core question is whether governance can identify unused or excessive access quickly enough to reduce spend without creating avoidable disruption.

In this article, Okta frames IGA around least privilege, lifecycle management, access certification, and access requests. That combination is meant to help organisations reconcile cost control with day-to-day productivity, which is a familiar tension for IAM and IGA teams managing sprawling application estates.

The subject is typical of modern SaaS environments: access sprawl, license waste, and manual review processes often grow together. The governance challenge is not unusual, but the operational pressure to prove savings while preserving business flow is becoming more visible.

Key questions

Q: How should teams rationalize SaaS licenses without disrupting work?

A: Use identity governance to identify unused access, route removal through access certification, and keep a fast re-request path for legitimate business needs. That sequence lets teams reduce waste while preserving productivity and accountability.

Q: Why do SaaS sprawl and identity governance fail in the same place?

A: They both depend on discovery happening before control. If applications are only found at purchase or SSO integration, finance cannot manage spend early and security cannot govern access early. The shared failure is late visibility, which turns both disciplines into cleanup functions instead of preventive ones.

Q: What are the signs that software rationalization is failing?

A: Common signals include recurring renewal surprises, users retaining access they no longer use, manual spreadsheets replacing review workflows, and managers approving removals without app context. Those patterns show the governance process is disconnected from actual usage.

Q: What is the difference between deprovisioning and access certification in SaaS governance?

A: Deprovisioning removes access, while access certification asks an authorised reviewer whether access should remain. Deprovisioning is an execution control, and certification is a decision control. Strong programmes use both: certification to validate need, and deprovisioning to enforce the result quickly and consistently.

Technical breakdown

How identity governance supports SaaS license rationalization

SaaS rationalization depends on connecting identity data to application usage decisions. Identity governance does that by tying access entitlements, lifecycle events, and review workflows to the apps people actually use. When access activity is observable, teams can distinguish between a dormant entitlement and a genuinely needed license, then route the decision through certification or deprovisioning instead of leaving it buried in manual spreadsheets. The mechanism is less about shrinking licenses by default and more about making entitlement decisions evidence-based.

Practical implication: build governance workflows that use access data as the trigger for license review, not calendar-based assumptions.

Why access certifications matter for least privilege in SaaS

Access certification is the control that introduces context into removal decisions. In SaaS rationalization, a manager or app owner can validate whether inactive access is still operationally required, which avoids blunt deprovisioning that can interrupt work. This matters because least privilege is not just a security ideal here; it becomes a budget control. The same certification process that supports compliance reviews can also reveal over-permissioned, higher-cost licenses that are being carried without active use.

Practical implication: route license revocation through certification when business context is needed to avoid removing legitimate access.

How access requests reduce friction after rationalization

If teams remove unused access without a fast re-request path, users create workarounds and IT absorbs the friction. Access requests close that loop by letting users justify, request, and regain access through a governed workflow. In practice, that turns rationalization from a one-way cleanup exercise into a lifecycle process: discover, review, remove, and regrant when needed. The governance value is strongest when request approvals are tied to role, app owner, or policy, rather than ad hoc exception handling.

Practical implication: pair every removal campaign with a low-friction access request path so productivity does not become the hidden cost.

NHI Mgmt Group analysis

Software rationalization is becoming a governance use case, not just a finance exercise. Okta's framing shows that identity governance now sits at the point where access risk and software waste overlap. That matters because the same entitlement data used to enforce least privilege can also expose underused SaaS spend, so IGA teams are being measured on cost outcomes as well as access outcomes. The practitioner implication is that governance programmes need to treat entitlement quality as a business control, not a back-office reporting function.

Access certifications are the decisive control when cleanup has to be defensible. Removing access based only on activity signals is efficient, but it can be operationally blunt. Certification adds the human business owner back into the decision, which is what prevents rationalization from becoming indiscriminate deprovisioning. For IGA teams, the important shift is from automated cleanup to accountable cleanup, where every removal has a reviewer and a reason.

The named concept here is licence sprawl governance. That is the point where unmanaged application growth, over-entitlement, and dormant access become one governance problem rather than three separate ones. Once licence sprawl is treated as an identity issue, lifecycle controls, access reviews, and access request flows become part of cost containment. The implication is that SaaS optimization belongs in the IAM operating model, not only in procurement.

Real-time access data changes the economics of least privilege. Traditional governance often reacts after renewals, audits, or complaints, which means waste accumulates before action is taken. When access telemetry feeds governance decisions continuously, teams can remove waste earlier and reintroduce access only when justified. The practitioner implication is that IGA maturity now depends on how quickly identity data can be turned into operational decisions.

Productivity protection is now part of governance design. The article is right to surface the risk that cost-cutting can interrupt work, because over-correction is a common failure mode in access reduction programmes. Good governance in SaaS estates is not only about removing access, but about proving that the removed access was truly idle and that reinstatement remains simple. The practitioner implication is to design rationalization campaigns as controlled lifecycle changes, not one-off cleanup events.

From our research library:

• Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
• Read next: IGA Buyer's Guide

What this signals

Licence sprawl governance: The practical problem is not only unused software, but unmanaged entitlement growth across application owners, managers, and reviewers. Once SaaS rationalization is handled through identity workflows, access reviews and request paths become the control plane for cost containment as well as least privilege.

Identity teams should expect more pressure to prove that access cleanup is both defensible and reversible. The strongest programmes will be the ones that combine certification, usage data, and a fast access request path so productivity does not become the reason waste returns.

The operating question is shifting from whether SaaS licences are being used to whether identity governance can prove they still deserve to exist. That moves IGA closer to commercial accountability, not just compliance administration.

For practitioners

• Map SaaS license ownership to access governance Identify which application owners, managers, or group owners can approve revocation decisions for inactive users and costly licenses.
• Use usage signals to trigger review campaigns Feed real-time access and activity data into certification workflows so that dormant accounts are reviewed before renewal cycles.
• Separate cleanup from business continuity Document a fast re-request path for users who lose needed access, so rationalization does not push teams toward shadow approvals.
• Target over-permissioned high-cost licenses first Prioritise applications where the cost impact is highest and the entitlement footprint is broad, then validate removal with reviewers.

Key takeaways

• SaaS rationalization only works when identity governance can connect access rights to real usage and business ownership.
• The article shows why access certifications and request workflows matter as much for productivity protection as for least privilege.
• For IAM and IGA teams, licence sprawl is now a governance problem that affects cost, accountability, and operational flow.

Key terms

• Software Rationalisation: Software rationalisation is the practice of matching software licences and entitlements to actual business use. In identity programmes, it combines usage visibility, review, and deprovisioning so organisations can recover waste while reducing unnecessary access exposure.
• Access Certification: Access certification is the periodic review of whether an identity still needs its current entitlements. For NHIs, certification is only reliable when reviewers know the identity's owner, purpose, and expiry, otherwise stale machine access can persist long after the original use case has ended.
• Least Privilege: A security principle requiring that every identity, human or non-human, is granted only the minimum permissions necessary to perform its function. Least privilege is the single most effective control for reducing NHI blast radius.
• Access Request Workflow: A structured process for submitting, routing, approving, and tracking access changes. In identity governance, it is more than ticket handling because it can shape who receives access, under what policy, and with what audit evidence. Poorly designed workflows can record decisions without enforcing lifecycle control.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.