What should organisations prioritise before SaaS contract renewals?

Why This Matters for Security Teams

SaaS renewal is one of the few moments when procurement, security, and application owners can correct access sprawl without waiting for an incident. The real risk is not just overspend. It is the quiet accumulation of unused seats, orphaned entitlements, and service access that survives long after the business case has changed. NHIs make this worse because machine access often outlives the humans who configured it.

That is why renewal review should be treated as a control point, not an accounting task. NHI Management Group’s Ultimate Guide to NHIs notes that 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, and that only 20% of organisations have formal offboarding and revocation processes. Those numbers matter at renewal time because dormant SaaS access often includes both human licences and hidden NHI dependencies tied to integrations, automations, and API tokens.

Security teams should therefore verify who still uses the product, who owns each entitlement, and whether any connected accounts, tokens, or automations still need access. The OWASP Non-Human Identity Top 10 reinforces that unmanaged machine identities are a recurring source of exposure. In practice, many security teams encounter entitlement sprawl only after renewal invoices arrive, rather than through intentional access reviews.

How It Works in Practice

Effective renewal preparation starts with a usage and ownership sweep. For each SaaS app, identify active users, last login dates, privileged roles, connected integrations, and any API-based or service-account access. Then compare that inventory with business need: if the app supports a workflow that no longer exists, the licence and the dependent access should be reclaimed together. If the app is still needed, downgrade inactive seats and remove stale administrative rights.

This is also the right time to validate offboarding. SaaS tools often retain tokens, delegated permissions, and SCIM or SSO mappings after a user leaves or a team changes. NHI Management Group’s NHI Lifecycle Management Guide and Guide to the Secret Sprawl Challenge both point to the same operational reality: access that is not explicitly retired tends to persist. For SaaS renewals, that means checking not just whether people still need the product, but whether any machine identities still rely on it.

• Confirm app owner, budget owner, and technical owner before any renewal commitment.
• Review last activity, feature adoption, and license tier fit for each tenant or workspace.
• Map integrations, API keys, and service accounts to the business process they support.
• Revoke or rotate dormant credentials before the renewal date, not after.
• Document exceptions where access must remain for a defined project window.

Used well, the renewal cycle becomes a forced cleanup of both SaaS spend and hidden identity risk. These controls tend to break down in highly integrated environments because no single team owns the full chain of licenses, tokens, and downstream automations.

Common Variations and Edge Cases

Tighter renewal control often increases coordination overhead, requiring organisations to balance cost savings against operational continuity. That tradeoff is most visible when an application supports shared workflows across departments, where a seat reduction can look efficient on paper but disrupt reporting, automation, or customer-facing processes.

Best practice is evolving for these edge cases. Some teams use renewal as a trigger for zero-standing entitlement reviews, while others only reset access for high-risk apps or those with external data exposure. There is no universal standard for this yet, but guidance from the OWASP Non-Human Identity Top 10 and NHIMG’s Top 10 NHI Issues supports a simple rule: if the renewal decision does not include entitlement cleanup, the organisation is likely renewing risk as well as software.

Edge cases also appear with sandbox accounts, executive tools, and cross-border SaaS instances where legal retention or regulatory logging requirements complicate deletion. In those cases, the goal is not immediate removal at all costs, but explicit justification, time-bounded exceptions, and documented reassessment at the next renewal. Renewals are most effective when they force a decision on whether the app still has a business purpose, rather than defaulting to automatic continuity.

Related resources from NHI Mgmt Group

• Should organisations prioritise external exposure or internal credential governance first?
• Should organisations prioritise token controls before expanding SaaS access?
• Should organisations prioritise SaaS cleanup before expanding access controls?
• How should organisations govern SaaS licenses alongside identity access reviews?