TL;DR: Install counts alone are masking software spend waste, because leadership cannot tell whether users actually open Microsoft 365 or Adobe apps before renewal decisions, according to JumpCloud. App-level discovery and foreground usage tracking shift license management from guesswork to measurable governance, and that matters wherever SaaS cost control depends on real adoption.
At a glance
What this is: This is a how-to analysis of SaaS spend governance that argues app-level discovery and foreground usage tracking are needed to tell whether expensive desktop suites are actually being used.
Why it matters: It matters because IAM and IT teams need evidence-based entitlement decisions, especially where suite-level licensing, device management, and user adoption determine renewal, downgrades, and budget recovery.
Context
Software spend governance is the discipline of matching licence cost to actual use, not just installation presence. In this article, the gap is that installed Microsoft 365 and Adobe software can look fully deployed even when users rarely open the desktop apps, which leaves renewal decisions based on assumption rather than measured activity.
For identity and access teams, that gap sits at the intersection of SaaS governance, endpoint visibility, and lifecycle control. The relevant question is whether access rights and paid entitlements still reflect real usage patterns across managed devices, or whether the organisation is funding dormant capacity inside large software suites.
Key questions
Q: How should teams govern SaaS licences when installation data does not show real use?
A: Treat install counts as discovery only and require usage evidence before renewals, tier changes, or budget approvals. Governance works better when licence decisions are based on what people actually open in the foreground, because installed software can remain idle while still consuming cost. That shifts SaaS management from inventory tracking to measurable entitlement control.
Q: Why do installed desktop apps create bad renewal decisions for software spend?
A: Because an installed app can look productive even when it is never opened or is only present in the background. That leads teams to renew premium plans for users who do not need them, especially in large bundles like Microsoft 365 and Adobe Creative Cloud. The result is slow, repeated overspend rather than a single visible waste event.
Q: What are the signs that SaaS spend controls are failing?
A: The most common signs are duplicate tools for the same use case, licences that remain unassigned after demand drops, and subscriptions that renew after the team stops using them. Another warning sign is when app discovery lives in one system but ownership lives in another, because the organisation cannot reconcile usage with accountability or termination decisions.
Q: When should organisations move users from full suite licences to lower tiers?
A: Do it when app-level usage shows that the user only needs a web version or a single application such as Outlook or Acrobat Pro. The right trigger is sustained low engagement with the rest of the suite, not the presence of the software on the device. That is how spend governance becomes operational instead of speculative.
Technical breakdown
Why installation counts fail as a governance signal
Installation data only confirms that software exists on a device, not that a user derives value from it. In suite environments such as Microsoft 365 and Adobe Creative Cloud, the same install can mask very different behaviour, from active daily use to a background presence that never contributes to work. Governance breaks when teams treat inventory as adoption, because licensing, budgeting, and renewal decisions then rest on a false proxy for consumption.
Practical implication: Treat install counts as discovery data only, not as evidence for licence renewal or tier selection.
Foreground usage reveals actual application engagement
Foreground tracking distinguishes a running application from one the user is actively working in. That matters because many desktop tools start automatically and remain open without meaningful interaction. By sampling whether an app is the primary window during a window of time, teams can separate real engagement from background noise and identify which individual suite components are actually being used across endpoints.
Practical implication: Use foreground activity to decide whether a premium desktop licence is justified or whether a lower tier is sufficient.
Suite-level bundles need app-level auditability
Large SaaS and desktop bundles behave like portfolios of separate tools, but many management systems still report them as opaque packages. App-level discovery breaks that bundle apart so that Word, Outlook, Photoshop, Illustrator, and other components can be governed individually. That enables more precise chargeback, more accurate renewal analysis, and better troubleshooting because control is applied at the app actually consumed, not at the bundle label.
Practical implication: Model high-cost suites as collections of individually governed applications when you assess spend and entitlement fit.
NHI Mgmt Group analysis
App-level usage data is the missing control in software spend governance: installation inventory tells you what exists, while usage telemetry tells you what is actually consuming budget. Suite licensing becomes inefficient when those two signals are collapsed into one, because procurement assumes value where none may exist. The practical consequence is that governance must move from presence-based reporting to consumption-based entitlement review.
Foreground activity is a better proxy for business value than process presence: a desktop app can run all day without supporting real work. That distinction matters for Microsoft 365, Adobe, and similar suite licensing because the organisation may be paying for premium functionality that users never reach. Practitioners should treat foreground engagement as the point where spend governance becomes measurable.
License governance and identity governance now overlap at the entitlement layer: access rights, paid plans, and device-managed software are converging into the same operational decision set. This article shows why software asset decisions increasingly belong inside broader IAM and lifecycle review processes, not in a separate spreadsheet silo. The implication is that entitlement review should consider actual application use, not just assigned licences.
Foreground telemetry creates a measurable waste signal: when apps are installed but never brought into focus, the organisation is carrying avoidable cost and sometimes avoidable startup load. That does not automatically justify surveillance concerns, because the article limits the data to app usage, not in-app content. The key governance move is to interpret the signal as spend inefficiency and right-size licences accordingly.
App-level governance is the named concept here: software spend cannot be managed effectively at suite level when the real consumption pattern is app by app. That concept matters because it turns a vague optimisation exercise into a repeatable control pattern for renewals, tiering, and budget recovery. Practitioners should build renewal decisions around the applications people actually open, not the packages they are assigned.
From our research library:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Read next: Top 10 NHI Issues
What this signals
App-level usage governance changes how organisations interpret software entitlement. Once teams stop treating installation as adoption, they can see which suites are carrying dormant cost and which are actually supporting work.
The control problem is simple: renewals based on inventory create budget waste, while renewals based on foreground engagement create defensible decisions. That is why usage telemetry belongs alongside lifecycle management in modern SaaS governance.
For practitioners
- Define app-level usage as the renewal signal Base Microsoft 365 and Adobe licence reviews on app open behaviour, not on whether the suite is installed on a device.
- Separate foreground use from background presence Use foreground activity to distinguish real work from apps that launch at startup or sit open without user interaction.
- Re-tier users by actual app dependence Move people who only use Outlook, Acrobat Pro, or a single desktop app to web-only or single-app plans where the licence model allows it.
- Audit suite components individually Review Microsoft 365 and Adobe applications as separate entries so that spend, adoption, and troubleshooting reflect the app that is actually consumed.
- Treat dormant apps as reclaimable budget Look for installed applications that have not been opened in 30 or 60 days and reassign that spend to higher-value priorities.
Key takeaways
- Installed software is not the same as active software, and treating those signals as equivalent leads to waste in expensive suite licensing.
- The article's core governance point is that app-level discovery and foreground tracking turn renewal decisions into measurable evidence rather than assumption.
- For IAM and IT teams, the practical implication is to right-size entitlements using real application engagement and reclaim unused budget for higher-priority work.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Licence governance is an entitlement decision problem, not just asset inventory. |
| GV.OC-03 — Roles, responsibilities, and authorities are established, communicated, and coordinated | Software spend governance needs clear ownership across IT, finance, and identity teams. | |
| Recommendation — Apply PR.AA-05 to align entitlements with actual application use and remove unused access. Assign clear ownership for licence review and renewal decisions across IT and finance. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account and licence sprawl both require authoritative lifecycle control. |
| Recommendation — Use CIS-5 to review and remove licences that no longer map to active user need. | ||
| ISO/IEC 27001:2022 | A.5.9 — Inventory of information and other associated assets | App-level discovery improves the accuracy of software and asset inventories. |
| Recommendation — Maintain asset inventories that distinguish installed applications from actively used software. | ||
Key terms
- App-Level Usage Tracking: App-level usage tracking records which specific applications a user actively opens and works in, rather than only whether software is installed or running. In SaaS governance, it helps teams measure real consumption and distinguish meaningful use from background presence or dormant entitlement.
- Foreground Activity: Foreground activity is the state where an application is the primary window a user is interacting with. For identity and software governance, it is a stronger signal of actual use than process presence, because many desktop apps launch automatically and continue running without supporting productive work.
- License Tiering: License tiering is the practice of assigning users to the software plan that matches their actual needs and usage. When tiering is misaligned, it often signals both waste and entitlement drift, because access is broader or costlier than required.
- Consumption-Based Governance: Consumption-based governance is an operating model that makes renewal, budget, and entitlement decisions from measured usage rather than assumed need. It is especially useful for large software suites, where installed presence can hide low adoption and create persistent overspend.
Deepen your knowledge
Identity lifecycle management, secrets management, and workload identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 12, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org