SaaS vendor review processian company, you're almost certainly paying for SaaS seats that nobody touches. Not a few. Tens of them, sometimes hundreds, quietly auto-renewing every month while the people assigned to them moved teams, left the company, or simply stopped using the tool three months after onboarding.
The problem isn't that teams buy software they don't use. The problem is that nobody finds out until the annual renewal invoice lands and someone does the uncomfortable math. By then, you've already paid for 11 months of waste.
This piece walks through how AI-driven license monitoring actually works at a technical level: what signals it parses, how it cross-references them, and what a real reclamation workflow looks like once you know which seats are dormant. If you manage a SaaS stack of 15 or more tools, the specifics here are directly applicable.
Why Spreadsheets Fail at License Monitoring
Spreadsheets are static snapshots. Someone updates the tab when they remember to, which in practice means once a quarter at best, and usually only after a renewal already hit the card. They tell you what you bought. They have no idea what's being used.
There's no connection between a spreadsheet and actual login data. When a row says "Slack — 80 seats — renews March 1," that number came from last year's invoice. It doesn't know that 15 of those users were deactivated in Google Workspace six months ago, or that another 8 haven't opened Slack since the last product launch. The spreadsheet reports what you paid for, not what you're actually using.
SaaS renewal calendareet rarely gets updated before the charge hits. Single-owner risk compounds this: the tracker lives in one person's Drive, invisible to both finance and IT simultaneously. When that person leaves or goes on leave, the institutional memory leaves with them.
SaaS spend management India Slack organisation where 40 seats are dormant at ₹900 per seat per month is burning ₹36,000 every month on access nobody uses. That's ₹4.32 lakh a year. Not a rounding error for most Indian SMBs.
The average Indian SMB renews 60% of its SaaS stack on autopilot — with no utilisation review before the charge lands.
Key takeaway: Spreadsheets capture purchase intent, not usage reality. Any cost-reduction effort built on a spreadsheet is working with the wrong data from the start.
reclaim unused SaaS licensesSaaS license rightsizing auditams: invoice metadata, identity-provider login events, and vendor API activity. Each stream answers a different question, and the combination is what makes the system actually reliable.
Invoice parsing handles the "what do we pay for" question. The AI reads unstructured email receipts and PDF invoices to extract vendor name, billing amount, billing cycle, and where available, seat count. This works without any vendor cooperation — it's reading what's already in your inbox.
Login signals answer "who touched this." Last-login timestamps from Google Workspace, Microsoft 365, Okta, or any SAML-based SSO give you a per-user activity fingerprint. If a user authenticated into a tool in the last 30 days, they're active. If the last login was 60 days ago, that's a flag worth examining.
API usage goes deeper. Tools like Slack, Zoom, and Notion expose usage endpoints that report call frequency, message counts, or document activity per user or workspace. A user who logged in once to check a notification but never sent a message is technically "active" by login data alone — but their API usage score tells the full story.
The three streams are cross-referenced to produce a per-seat utilisation score. A seat that's flagged dormant by all 3 signals is near-certain waste. A seat flagged only by invoice (no SSO data because the tool wasn't added to SSO) goes into a different queue: possible shadow IT, lower confidence, needs human review.
Action: Before connecting any monitoring tool, ask your vendor whether they expose a usage API. If they do, that's the difference between a utilisation score and a guess.
Run a free SaaS spend audit — find every hidden subscription
The Signal Hierarchy: From Invoice to Dormant Seat
The process runs in stages, and understanding the stages matters for trusting the output.
Step 1 is invoice ingestion. The system surfaces "this tool exists and costs X per cycle." At this point, you have a list of vendors and spend figures. Nothing about usage yet.
Step 2 is the identity layer. The invoice gets mapped to actual named users on the account via directory sync. This is where you find out that the "20-seat Zoom licence" maps to 20 specific email addresses, and 3 of them belong to people who left the company.
Step 3 is the usage layer. Each user gets scored: active (logged in and meaningfully engaged), low-use (logged in but no measurable activity), or dormant (no login in 30 or more days). The confidence of the dormancy flag depends on how many signals support it.
Threshold tuning matters here. Thirty days of zero login is a sensible default for collaboration tools. For a finance or compliance platform, the right threshold might be 60 days, because a CFO approving quarterly audits is a legitimate infrequent user, not a dormant seat. Good AI monitoring systems let you set per-tool thresholds rather than applying one rule across the entire stack.
How Easexpense AI CIO Implements This in Practice
Our AI CIO connects to your environment through read-only OAuth. For Gmail and Outlook, we request scopes that allow us to parse forwarded invoices and SaaS receipts — we don't store email body content, only the structured metadata extracted from it. Security teams can review exact scope grants before any connection is made.
Google Workspace and Microsoft 365 directory sync maps licences to real user accounts and pulls last-active timestamps from the Reports API. This runs automatically once the connection is authorised. No manual exports, no CSV uploads.
For our anchor vendor partners (Slack, Zoho, AWS), we pull seat-level activity directly via their API connectors. This gives us the granular usage data that goes beyond "logged in" to "actually did something." For vendors that don't expose usage APIs, we fall back to invoice-only signals with a clearly labelled lower confidence score in the dashboard.
The alerts engine fires renewal notifications at 45, 30, and 7 days out, and each alert includes the current dormancy count attached. So your 45-day Slack renewal alert doesn't just say "₹72,000 due in 45 days." It says "₹72,000 due in 45 days — 12 seats have had zero activity for 30+ days. Potential saving: ₹10,800/month."
The Admin Hub dashboard gives a single view: licence count, active count, dormant count, and monthly INR burn per tool. Finance sees the spend. IT sees the seat-level detail. No separate reports to reconcile.
Action: When evaluating any SaaS monitoring platform, ask specifically: does the dormancy alert include an INR figure? An alert without a cost attached rarely gets acted on.
Shadow IT: The Seats No One Admitted to Buying
Shadow IT in the SaaS context means tools purchased on personal or team credit cards without IT or finance visibility. They're not in the directory. They're not in the SSO. They're invisible to every tool that relies on identity-layer data alone.
Invoice parsing is what surfaces them. If a designer signed up for Canva Business on their personal card and the receipt hits their work Gmail, the AI finds it. If an engineering team put Notion Plus on a team Razorpay card and the monthly receipt goes to a shared inbox, the AI finds it. SSO logs can't see what was never added to SSO. Invoice parsing doesn't care.
This is a meaningful problem for Indian SMBs specifically. Common patterns we see: Canva Business on a designer's card at ₹3,999/month, Notion Plus on an engineering team account at ₹800/seat/month across 12 seats, and Loom Pro on a sales team card that finance has never seen. Individually small. Collectively, a significant undocumented spend line.
Beyond the direct cost, there are two other risks. First, data residency: tools bought outside IT review may store company data in regions that conflict with your internal policy or client contracts. Second, GST input tax credit is lost on undocumented purchases. If the invoice isn't in the company's name with a valid GSTIN, you can't claim ITC. At 18% GST on software, that's real money left on the table.
When our system flags shadow IT, it routes the tool to admin review rather than auto-cancelling. Auto-cancelling would be the wrong call — some shadow IT is entirely legitimate, just purchased without going through the right process. The admin decides whether to formalise the subscription, consolidate it into an existing licence, or remove it.
Key takeaway: Shadow IT is invisible to identity-layer monitoring. Invoice parsing is the only signal that catches tools bought outside the company's SSO and procurement process.
Talk to our team about what's hiding in your SaaS stack — book a 15-minute call.
Integrations That Make This Work: A Technical Walkthrough
The OAuth 2.0 scopes we request are deliberately narrow. For Google Workspace, that means the Admin SDK Reports API (for login and activity signals) and Gmail read-only (for invoice parsing). We don't request Drive access, Calendar access, or anything that touches content beyond billing emails. Security teams can verify this in the OAuth consent screen before authorising.
Architecture matters for accuracy. A webhook-first approach means that when a user is deactivated in Google Workspace, that event triggers an immediate re-score of their associated SaaS licences rather than waiting for the next scheduled poll. Mid-cycle changes get caught within minutes, not on the next monthly sync. This is particularly relevant for offboarding workflows, where a dormant seat can become an active security risk if not reclaimed promptly.
API polling is batched and scheduled to respect vendor rate limits. We don't hammer Slack's API at 9 AM when everyone else is also calling it. Calls are distributed across off-peak windows and cached appropriately so the dashboard reflects near-real-time data without triggering throttling.
Processed metadata is isolated per customer tenant. We store extracted invoice signals (vendor, amount, cycle, seat count), activity scores, and renewal dates. We don't store email body content, file data, or message history. Each tenant's data is logically isolated with separate encryption keys.
When a vendor doesn't expose a usage API, the system falls back to invoice-only monitoring, clearly flagged with a lower confidence score. You still know the tool exists and what it costs. You just don't have the per-seat activity layer. That flag is explicit in the dashboard, not hidden.
Turning Dormant Seat Alerts into Actual Savings
An alert without a workflow is just noise. The reclamation process matters as much as the detection.
The playbook we recommend: notify the seat owner directly when their account is flagged dormant, with a 5 business day window to respond. If no response, escalate to their manager. After manager confirmation, the seat is removed. The whole sequence can be configured in the Admin Hub and runs without manual chasing from IT.
For a 100-person Indian company, we typically see 10-20% licence reduction within 60 days of monitoring going live. On a SaaS spend of ₹8 lakh per month, that's ₹80,000 to ₹1.6 lakh in monthly savings from a single workflow change.
There's a GST angle here worth noting. When reclaimed seats reduce the next vendor invoice, the taxable base drops. If your company is GST-registered and the vendor issues a credit note for the removed seats, you're also reducing the IGST or CGST+SGST reconciliation burden on your GSTR-2B. The saving is on both the subscription cost and the tax reconciliation overhead. Worth confirming with your CA whether a credit note is issued for mid-cycle removals, since vendor practices vary.
Savings compound differently depending on what you do with the reclaimed budget. Some companies use it to fund tools they actually needed but couldn't justify. Others simply reduce opex. Either way, the first reclamation cycle tends to generate enough ROI to fund the monitoring layer itself many times over.
Watch out: Reclaiming seats without notifying the owner first creates support tickets and resentment. Always give the user a 5-day response window before removing access — it changes the perception from "IT is cutting tools" to "IT is managing spend responsibly."
Spreadsheet vs. AI Monitoring: A Side-by-Side Reality Check
Let's be specific about the gaps.
Update frequency: A spreadsheet gets updated monthly at best, usually when someone notices something is wrong. AI monitoring updates continuously, with webhook-driven re-scores on identity events and daily invoice scans.
Coverage: A spreadsheet contains the tools someone remembered to list. AI monitoring covers every tool that appears in an invoice or login log, including the ones the ops person who built the sheet never knew existed.
Accuracy: Human error in formulas and stale data are structural problems in spreadsheets. Multi-signal confidence scoring with explicit confidence flags is a structural advantage of AI monitoring. You know when a signal is weak; the spreadsheet doesn't tell you when a formula is wrong.
Effort: Finance ops teams typically spend 4 to 8 hours per month maintaining a SaaS inventory spreadsheet. An alert-only workflow — where the system only surfaces items that need a decision — collapses that to under an hour of review.
The break-even math is straightforward. For a company spending ₹5 lakh per month on SaaS, finding and removing just 5% waste (₹25,000/month) covers the cost of a monitoring platform several times over within the first month of use.
Key takeaway: The comparison isn't really spreadsheet vs. AI. It's "paying for waste you can't see" vs. "paying a fraction of that waste to eliminate it."
Getting Started: What the First 30 Days Look Like
Day 1: connect Gmail or Outlook via OAuth. Invoice parsing surfaces your initial tool list within a few hours of the first sync. Most customers are surprised by 3 to 5 tools they'd forgotten about in the first pass.
Days 3 to 5: Google Workspace or Microsoft 365 directory sync adds the user-to-licence mapping. You can now see not just "we pay for Notion" but "we pay for 25 Notion seats and here are the 25 accounts."
Day 7: the first dormant seat report appears, with INR cost attached to each flagged user. This is the report most customers print and bring to their next CFO meeting.
Day 30: the renewal calendar is fully populated, the first reclamation workflow has been triggered, and you have a clear picture of what the next 90 days of renewals look like with dormancy counts attached to each one.
Before setting up full monitoring, the fastest first step is to run the inbox scan. It takes about 30 seconds to connect and surfaces everything that's been quietly billing your company — no integrations required for the initial audit. Once you see the list, the case for full monitoring makes itself.
Run the free SaaS spend audit — see what's hiding in your inbox before the next renewal hits.
If you want to see this applied to your specific stack — with INR figures attached and a renewal timeline — our team does a 15-minute walkthrough that covers your actual tool inventory. No preparation needed on your end.
Frequently asked questions
How does AI SaaS license monitoring detect dormant seats without accessing private user data?
The system uses read-only OAuth scopes to pull last-login timestamps and API call frequency — not message content, file data, or anything a user would reasonably consider private. For Google Workspace, this means the Reports API surfaces activity signals (did this user authenticate? did they make API calls?) without ever touching email bodies or documents. The specific scopes requested are visible on the OAuth consent screen before you authorise, so your security team can review them in full. Most security teams find the scope list considerably narrower than they expected. You can revoke the OAuth grant at any time and all processing stops immediately.
Can AI monitoring catch SaaS tools that were never added to our SSO or directory?
Yes, and this is precisely the gap that invoice parsing fills that SSO logs cannot. If a team member signs up for a tool on their personal card and never connects it to Okta or Google SSO, it's invisible to the identity layer but will still generate a recurring invoice that the AI parses from Gmail or Outlook. That's the mechanism by which shadow IT surfaces. In practice, it's not unusual for the initial inbox scan to reveal 5 to 10 tools that never went through any procurement process. These are flagged for admin review rather than auto-cancelled, because some are legitimate tools that simply bypassed the formal process.
What is a reasonable dormancy threshold before flagging a SaaS seat for reclamation?
Thirty days of zero login activity is a sensible default for collaboration and productivity tools like Slack, Notion, or Zoom. Finance, compliance, or audit tools often warrant a longer window of around 60 days, because their users may be genuinely infrequent but entirely legitimate — a CFO who logs into the board reporting tool once per quarter isn't a dormant seat. Good AI monitoring platforms let you set per-tool thresholds rather than applying one blanket rule. The key is being explicit about the threshold for each category of tool and reviewing it once a year, since usage patterns change as the company evolves.
How much time does it take to set up AI-driven SaaS monitoring for a 150-person company?
Connecting Gmail or Outlook via OAuth takes under 2 minutes. The initial invoice scan that surfaces your full tool list typically completes within a few hours of the first sync. A full dormancy report with per-seat utilisation scores is usually ready within 5 to 7 days once the directory integration is live, since the system needs a short observation window to establish baseline activity patterns. No professional services engagement or IT project is required for companies under 500 seats. The setup is self-serve and the first meaningful output (your tool list with costs) appears the same day you connect.
Does AI license monitoring work if we pay SaaS vendors through multiple cards or bank accounts?
Invoice-based discovery doesn't depend on card data at all. It reads billing confirmation emails and PDF invoices from your connected inbox, so as long as receipts arrive in the connected Gmail or Outlook account, the tool is detected regardless of which card was charged. This is actually one of the more useful properties of the approach: it catches personal card purchases that finance never sees in the bank feed or expense system. The one scenario where tools get missed is if the receipt goes to a personal email account that isn't connected, which is rare but worth noting.
How is AI SaaS monitoring different from what our ERP or expense management tool already does?
ERP and expense tools capture what was approved and reimbursed. They rarely map spend back to named seats, and they have no connection to login or usage data. An ERP can tell you the company spent ₹2.4 lakh on Notion last year. It cannot tell you that 18 of 60 seats have had zero activity for 45 days, or that 4 of those seat holders left the company. That gap — between "we paid for this" and "this is actually being used" — is exactly what AI license monitoring closes. The two tools are complementary rather than substitutes; you need both the financial record and the usage signal to make good reclamation decisions.
What happens to GST input tax credit when we reclaim and remove unused SaaS seats mid-cycle?
When a vendor issues a revised or reduced invoice after seat removal, the lower taxable base reduces the IGST or CGST+SGST charged on that invoice. If your company is GST-registered, this also reduces the ITC you need to reconcile in your GSTR-2B, which simplifies the matching process marginally. The more material question is whether the vendor issues a credit note for the mid-cycle seat removal or simply reflects the change in the next billing cycle — practices vary significantly by vendor. It's worth asking your CA to confirm how to account for the credit note and whether any reversal is required for ITC already claimed on the original invoice.