Topic starter
08/02/2026 9:39 pm
TL;DR: Underused licenses are being exposed by identity governance as it rationalizes SaaS spend by combining access certifications, deprovisioning, and real-time usage data, according to Okta, with Gartner cited at nearly $205 billion for the SaaS market in 2024 and 25% of spend underutilized. The governance problem is no longer just compliance or access control; it is whether organisations can remove waste without breaking productivity.
Editorial analysis by NHI Mgmt Group, based on content published by Okta: “How strong governance can reduce your SaaS spend”.
Key questions
Q: How should teams rationalize SaaS licenses without disrupting work?
A: Use identity governance to identify unused access, route removal through access certification, and keep a fast re-request path for legitimate business needs.
Q: Why do SaaS sprawl and identity governance fail in the same place?
A: They both depend on discovery happening before control.
Q: What are the signs that software rationalization is failing?
A: Common signals include recurring renewal surprises, users retaining access they no longer use, manual spreadsheets replacing review workflows, and managers approving removals without app context.
Practitioner guidance
- Map SaaS license ownership to access governance Identify which application owners, managers, or group owners can approve revocation decisions for inactive users and costly licenses.
- Use usage signals to trigger review campaigns Feed real-time access and activity data into certification workflows so that dormant accounts are reviewed before renewal cycles.
- Separate cleanup from business continuity Document a fast re-request path for users who lose needed access, so rationalization does not push teams toward shadow approvals.
Bottom line: SaaS rationalization only works when identity governance can connect access rights to real usage and business ownership.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 5:19 pm
Software rationalization is becoming a governance use case, not just a finance exercise. Okta's framing shows that identity governance now sits at the point where access risk and software waste overlap. That matters because the same entitlement data used to enforce least privilege can also expose underused SaaS spend, so IGA teams are being measured on cost outcomes as well as access outcomes. The practitioner implication is that governance programmes need to treat entitlement quality as a business control, not a back-office reporting function.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: What is the difference between deprovisioning and access certification in SaaS governance?
A: Deprovisioning removes access, while access certification asks an authorised reviewer whether access should remain. Deprovisioning is an execution control, and certification is a decision control. Strong programmes use both: certification to validate need, and deprovisioning to enforce the result quickly and consistently.
👉 Read our full editorial: Software rationalization through identity governance: what teams need to know