Using Okta to Audit Your SaaS Licences: What Your Identity Provider Already Knows

If your organisation uses Okta, you already have the most valuable data for SaaS licence management. Most organisations do not know this.

Okta is your identity provider — the system that controls who has access to what. Every application connected to Okta has an assignment record: which users are provisioned, when they were last active, and whether they are still in the organisation.

That data is a direct map of your SaaS licence waste.

What Okta knows that you might not

For every application in your Okta catalogue, Okta holds:

**User assignments.** Every user who has been provisioned access to the application, regardless of whether they still work there or still use it.

**Last sign-on activity.** When each user last authenticated to the application via Okta. This is not the same as "last used" — a user who logs in and then does nothing has an authentication event — but it is the most reliable signal available at scale.

**Group memberships.** Which teams and groups are provisioned to which applications, making it easy to identify applications that were provisioned for specific projects or teams that no longer exist.

**Application count.** The total number of applications in your Okta environment, which for most mid-market organisations is 50-150 — far more than most people realise, and far more than anyone has reviewed recently.

The Okta licence audit process

**Step 1: Export your Okta application catalogue.** List every application in your Okta environment. For each, note: name, category, whether it has SCIM provisioning, and estimated cost.

**Step 2: Check assignment vs usage.** For each application, compare the number of assigned users against the number with active sign-on activity in the past 30 days. The gap is your inactive licence count.

**Step 3: Identify orphaned assignments.** Users who are no longer in your Okta directory (deprovisioned or suspended) but whose application assignments were not cleaned up. These are immediate cancellation candidates.

**Step 4: Flag zero-activity applications.** Applications with Okta assignments but no sign-on activity in 90+ days across all users. These are candidates for full cancellation.

**Step 5: Review group-based assignments.** Applications provisioned to Okta groups rather than individuals. Check whether the group membership still reflects actual need, or whether it was expanded for a project and never right-sized.

The applications where Okta data is most valuable

Okta is most useful for auditing the mid-tier SaaS stack — applications that are significant enough to cost real money but not large enough to have dedicated licence management:

**Collaboration tools** (Slack, Zoom, Loom): High per-seat costs, high churn, frequently over-provisioned for entire organisations when only specific teams need full access.

**Project management** (Asana, Monday.com, Jira): Seat counts balloon during onboarding, never contract back down after projects complete.

**Design and creative tools** (Figma, Adobe Creative Cloud): Expensive per-seat, often provisioned liberally to everyone who might need access rather than to actual users.

**Security tools** (various): Often provisioned to all employees at scale; actual usage concentrated in IT and security teams.

Connecting Okta to your spend data

The Okta audit identifies which applications have inactive users. To calculate the cost of that waste, you need to combine it with your actual spend data.

The manual approach is to match each Okta application against your accounting records — find the invoice, identify the per-seat cost, multiply by inactive users.

The automated approach is to connect both Okta and your accounting system (Xero, QuickBooks) to a platform that does the matching automatically. OTIS connects to both, cross-references them, and surfaces findings with calculated annual savings for each inactive licence set.

For most organisations running this analysis for the first time, the total recoverable waste across the Okta-managed SaaS estate is 25-40% of total SaaS spend.

Automate this analysis with OTIS

Connect your accounting system and identity provider. OTIS runs this analysis automatically and surfaces findings as they emerge.