IT playbook · AI Employee: Ivy

License Reclamation

Wasted licence spend down 20% quarter-over-quarter

Install this playbookBack to marketplace
The problem

SaaS licences are the tax that grows quietly. Every employee onboarded gets a seat; every offboarded employee... often still holds one. Every trial that gets forgotten becomes a paid seat. Every team's over-purchase ("we might need 20 later") becomes 15 seats that never get used. Annual SaaS spend grows 15-25% year-over-year on autopilot, and 20% of it isn't touching any human.

At a glance
Trigger
Cron (quarterly)
Approvals
Owner can override before revoke
What it does
Writes to your systems
Systems
Okta · M365 · Google Workspace · Adobe · Zylo
How it feels in production

An hour-by-hour walkthrough.

First Monday of the quarter. Ivy runs the reclamation scan. Reads seat assignments from Okta (SSO-managed), M365, Google Workspace, Slack, Adobe, Datadog, Figma. Cross-references with actual last-active timestamps per user per SaaS. Finds: 34 seats unused for > 60 days. Categorises them: 12 from offboarded employees (accounts should have been reclaimed but weren't — offboarding gap), 15 from active employees who never used the tool (over-provisioning), 7 from employees who moved teams and no longer need it. For the 12 offboarded: auto-revoke immediately. Notify HR + IT that these accounts existed and were missed by the offboarding playbook — a signal that offboarding coverage has a gap. For the 15 active-employee unused: Slack DM to each user with a 7-day window to justify keeping the seat. "We noticed you haven't used Figma in 90 days. Reply KEEP if you need it, or we'll reclaim." For the 7 team-changed: notify the license owner (usually a team lead or department admin) for a keep/revoke decision. Same 7-day window. Day 8. Aggregate: 24 seats reclaimed, $8,400/year saved, 10 users kept their seats (with a note about why). Quarterly report posts to finance + IT leadership with the trend line.
How it works

Step by step.

  1. 01

    Scan usage across SaaS

    Read seat assignments + last-active timestamps for each managed SaaS. Sources include SSO events (Okta, Google Workspace), API-native activity signals, and SaaS-management-platform data where available.

    Okta · M365 · Google Workspace · Slack · Adobe · Zylo · Torii
  2. 02

    Identify seats unused > 60 days

    Threshold configurable per SaaS ("unused" for Slack means 60 days without an action; for Datadog it's different). Categorise: offboarded / active-unused / team-moved.

    Analysis · Context Graph
  3. 03

    Notify owner with 7-day window

    For active-user unused: DM the user with reclamation notice. For team-changed: DM the license owner. Both parties can respond KEEP + reason or accept the reclaim. Deadline enforced automatically.

    Slack · Email
  4. 04

    Revoke or reassign on timeout

    On timeout without response: reclaim. On KEEP: log the reason for the next scan. On team-moved with reassignment: transfer the seat to the new team owner. All writes idempotent.

    Okta · SaaS admin APIs
Systems and wiring

What you connect to make this run.

Okta · Microsoft Entra ID

read+write

SSO events read for last-active detection. Seat reclamation writes via the SaaS's own admin API (M365 licence release, Google Workspace user deletion, Slack account deactivation).

Zylo · Torii · Nudge Security

read

SaaS-management platform integration for tools without native activity APIs. Shadow-IT discovery + usage-based reclamation.

Slack · Teams · Email

write

Nudge cadence + response collection. Users respond in-thread; automated timeout enforcement.

What changes

Before and after, honestly.

SaaS spend waste (unused seats)
Before
15-25% of total spend
After
Under 5% (steady-state after 2 quarters)
Time to catch offboarded accounts
Before
Discovered at quarterly audit, weeks after termination
After
Within 60 days via reclamation scan (or immediately via offboarding playbook)
IT admin time on licence management
Before
~10-20 hours per quarter
After
Zero on the reclamation itself; time on exception review only
Employee friction from reclamation
Before
Sudden loss of access with no warning
After
7-day notice + reply-to-keep — friction near zero
Related

Playbooks that pair with this one.

IT

Proactive Device Health

Complementary optimisation — reclaim licences AND monitor device health quarterly.

HR

Employee Offboarding

Reclamation catches accounts that offboarding missed — a signal to close the gap in offboarding coverage.

Finance

License Cost & Renewal Tracking

Reclamation savings feed into renewal negotiations.

Security

User Access Reviews (UAR)

Access reviews + reclamation together drive least-privilege access at scale.

Frequently asked

Answers about this playbook.

What counts as 'unused' for each SaaS?

Per-SaaS configurable. Slack: no message sent or channel joined in 60 days. Figma: no file opened. Datadog: no dashboard viewed. Defaults tuned per SaaS; can override per your workflow.

What if a user is on vacation and misses the 7-day nudge?

Nudge cadence respects out-of-office signals from calendar. If the user is on approved leave, extend the deadline; nudge again on their first day back.

Can we exempt specific users or teams?

Yes — exclusion list per team or per user. Common exclusions: sales leaders who use CRM sporadically for high-value deals, exec team, security team's Datadog for on-call.

How does this integrate with Zylo or Torii?

Coexists. Zylo/Torii provide the discovery + usage signal for SaaS without native APIs. Ivy adds the reclamation action + notification flow on top. Bring your existing SAM tool.

Can we auto-reclaim without user notification?

Only for offboarded accounts (auto-reclaim on termination). Active-user unused seats always get the 7-day notice — reclaiming silently is a friction moment worth avoiding.

See it run on your data.

Free plan, no credit card. Connect the systems this playbook needs and run it against a past event first.

Book a demoMore IT playbooks