How Zombie SaaS Licenses Drain Your Budget - And Why SSO Can't Find Them

Here's a number that should bother every IT leader and finance stakeholder: according to the 2025 SaaS Management Index^{12025 SaaS Management Index}, organizations waste an average of $21 million annually on unused SaaS licenses - a 14.2% increase year-over-year. That's not large-enterprise theater. For a 500-person company, the math is proportionally just as ugly.

These aren't licenses nobody signed up for. They're seats purchased for real employees - employees who left, changed roles, or simply stopped using the tool. And in most companies, those seats keep billing. Month after month. Quietly.

The reason this keeps happening isn't a spreadsheet problem or a process problem, even though it shows up that way. It's a coverage problem. Your SSO only sees what's connected to it. Most of your SaaS stack isn't.

The Uncomfortable Math of Zombie Licenses

According to Zylo's 2025 SaaS Management Index, 52.7% of purchased SaaS licenses go unused, with overall SaaS utilization rates declining to 47.3%. Read that again: fewer than half the licenses your company pays for are actively used.

SaaS spend now averages $4,830 per employee annually, a 21.9% increase year-over-year - making the unused-license problem more expensive with every renewal cycle. For a company with 500 employees, that's $2.4 million in annual SaaS spend, with over $1.2 million potentially sitting idle.

The causes aren't mysterious:

• Departed employees whose accounts were never closed across every app they touched
• Role changes that triggered new access but didn't remove old access
• Growth seats purchased ahead of headcount that never materialized
• Shadow IT - tools adopted by teams without central IT involvement

More than one-third of a company's applications are shadow IT, according to Zylo's 2024 report, with 67% of IT leaders citing rogue software purchases as a top SaaS challenge.

But here's the part that rarely makes it into vendor demos: most identity management tools can only see - and act on - a fraction of your stack.

Why SSO Can't See the Zombie Licenses That Cost You Most

Single Sign-On is genuinely useful. It centralizes authentication, reduces password sprawl, and creates a single point for access control. But it has a structural blind spot nobody likes to talk about in vendor pitch decks.

SSO controls the front door. It doesn't control anything behind it.

When an employee is deprovisioned in your identity provider (Okta, Microsoft Entra, Google Workspace), that event triggers a signal to revoke access - but only to apps connected via SCIM or a compatible API. Every other app your employee used? The account stays open. If the app stores credentials directly, the user can still log in without touching SSO at all.

The scale of this gap is larger than most teams realize. Industry analysis consistently puts 20-40% of enterprise app accounts outside SSO or SCIM coverage, and SCIM typically reaches only 15-25% of a company's full app stack - meaning the majority of your tools are governed manually, or not at all. Manual deprovisioning requests fail 40-60% of the time due to delays or neglect, leaving access open indefinitely.

This creates a two-tier offboarding reality:

• Tier 1 (SCIM-connected apps): Okta fires, access is revoked automatically. Clean.
• Tier 2 (everything else): Someone sends a ticket. Maybe it gets actioned. Maybe the app owner is on vacation. Maybe the tool was bought by a team that's since been reorganized, and nobody knows who owns it anymore.

Tier 2 is where zombie licenses are born.

The SCIM Tax Makes the Problem Worse

Here's where it gets more expensive. Many apps your teams use daily - Notion, Figma, Linear, Slack at certain tiers, and dozens of others - do technically support SCIM. But they bundle it with enterprise-tier pricing that costs 3-10x the base plan.

SCIM provisioning typically requires upgrading to plans that cost 2-4x the base price, pricing that makes SCIM economically viable for only a small subset of your stack.

This is the SCIM tax: paying a premium not for features you need, but for a protocol you need to automate access management. The result is a painful choice - pay the enterprise uplift to automate a handful of critical apps, or stay on a lower tier and keep managing access manually.

Most companies do both: they pay the SCIM tax on five or ten high-priority tools and accept that the rest stays manual. Which means the rest of the stack generates zombie licenses on autopilot.

And even if you pay the SCIM tax across the board, SCIM itself has limits. It handles basic account creation and deletion - but it has no concept of fine-grained permissions, role-level access, or channel- and repository-level controls. A deprovisioned account might be closed while an orphaned service account or API key remains active, with no one the wiser.

What Does the Full Cost Look Like? Run Your Numbers

The real cost of zombie licenses isn't just idle seat fees - it's the combination of unused licenses, SCIM tax spend, manual IT overhead, and security exposure from orphaned accounts that remain active attack surfaces.

Use this calculator to estimate what your current coverage gap is costing you:

The numbers tend to surprise people. A 500-person company paying $4,830 per employee in annual SaaS spend - in line with the Zylo 2025 benchmark^{12025 SaaS Management Index} - is sitting on roughly $1.27M in potentially recoverable license waste, before accounting for the SCIM tax.

The SaaS Management vs. Identity Governance Distinction (It Matters Here)

There's a category confusion that lets this problem persist. SaaS management tools discover what apps you have and track spend. Identity governance controls who has access to what - and automates the lifecycle from hire to exit.

Zombie license reclamation lives at the intersection. You need to know the app exists (SaaS discovery), know who has an account in it (identity visibility), and actually revoke or reclaim that access when someone leaves or changes roles (lifecycle automation). Most tools only do part of this.

SaaS management platforms tell you you're spending $12,000/year on Notion licenses. They don't automatically deprovision the 23 accounts belonging to people who left last year. Identity governance - done right - does both.

The gap exists because:

1. SaaS management tools have visibility into spend but no mechanism to act on identities
2. SSO/SCIM tools can action what's connected but are blind to the 60-80% of apps that aren't
3. Legacy IGA vendors (SailPoint, Saviynt) can technically cover more ground, but take 6-18 months to implement and require a dedicated IAM team to run - not practical for a 500-person company with a lean IT team

The result: a little bit of governance for the SCIM-connected apps, and a sprawling identity blindspot everywhere else.

How to Find and Reclaim Zombie Licenses: A Practical Playbook

If you're running a manual audit today, here's the sequence that finds the most waste fastest:

The honest caveat: a manual audit is a point-in-time snapshot. Your first one will surface genuine savings - Deloitte research shows enterprises waste up to 27% of their cloud and SaaS spend on idle resources, and most companies confirm this when they audit for the first time. But within three months of a manual cleanup, zombie licenses start accumulating again. New hires get access. People leave. Roles change. The only sustainable fix is automated, continuous deprovisioning across your full stack.

What Complete Coverage Actually Looks Like

The vendor promise of "complete" identity governance usually means complete for apps with SCIM. That's maybe 20-35% of your stack. Complete coverage means reaching every app - whether it supports SCIM, has an API, or neither.

Here's how that distinction plays out in practice:

Iden's universal connector technology reaches every app in your stack - Notion, Figma, Linear, GitHub, Slack, Jira, and 170+ others - including apps with no SCIM support and no enterprise-tier requirement. When someone exits your HRIS or SSO, Iden fires automated deprovisioning across all connected apps simultaneously. Not just the SCIM ones.

The result isn't just license savings - it's identity hygiene at scale. No orphaned accounts for auditors to find. No ex-employee with an active Notion login six months after their last day. No SCIM tax on apps you could have automated for free.

For teams chasing SOC 2, ISO 27001, or HIPAA, this is also the foundation of audit-ready access governance - the kind where the answer to "who had access to what, and when?" doesn't require three weeks of spreadsheet archaeology.

And unlike legacy IGA deployments that take 6-18 months to stand up, Iden goes live in roughly 24 hours - connected to your existing SSO and HRIS as sources of truth, zero integration engineering required.

The Bottom Line for IT Leaders and Finance Stakeholders

Zombie licenses aren't a budgeting curiosity. They're a predictable, quantifiable outcome of running identity governance on a tool (SSO) that was never designed to govern the full stack.

The math is straightforward:

• 52.7% of purchased SaaS licenses go unused, equating to $21M in wasted spending annually per organization on average
• 60-80% of your app stack sits outside SCIM reach - zombies accumulate automatically whenever anyone leaves or changes roles
• The SCIM tax inflates costs further for every app you try to automate through enterprise-tier upgrades
• Manual audits surface the problem but don't fix it - only continuous, automated deprovisioning across your full stack does

If you're a lean IT team managing identity for a 200-2,000 person company, you don't need a behemoth IGA platform with an 18-month implementation timeline. You need universal coverage, automated lifecycle management, and license reclamation that runs without you thinking about it.

That's what complete identity governance looks like. Not "complete for apps with SCIM." Complete.

Frequently Asked Questions