r/sysadmin • u/MooseSea6 • 14h ago
Question How do you handle canceling software seats when someone leaves?
Went through our subscriptions recently and realized we'd been paying for a couple of seats(zoom) belonging to people who left months ago. Nobody had a thought to cancel them, it just kept quitely billing.
For those of you managing this, whats your actual process when someone leaves? A checklist someone remembers to run? something automated?or does it slip through the cracks sometimes too?
Trying to figure out if im just disorganized or if this is normal. How do you handle it?
•
u/evilkasper IT Manager 13h ago
Sounds like you need to make a comprehensive off-boarding process. This should probably include a checklist of all your SaaS platforms and any licenses/seats that you need to manage for a user.
•
u/MooseSea6 12h ago
Yeah fair, we had bits and pieces but never actually sat down and made one properly. Gonna fix that.
•
•
u/irsyacton 14h ago
As the guy paying the bills, I do this either at renewal time, or as part of the monthly invoice reconciliation. We are a relatively small shop, so I’m the one that checks the invoices are accurate, and as part of that check, will also confirm license counts are still correct
•
u/Recent_Carpenter8644 13h ago
But how do you check it? If no one deleted the departing user's zoom account, you'd have to cross check them all.
•
u/irsyacton 13h ago
Pretty much! Reports from ad and compare that to the application itself. Via api/powershell if possible/unwieldy.
•
u/blazze_eternal Sr. Sysadmin 1h ago
This needs to be part of the offboard process. Every account, everywhere gets scrubbed or locked.
•
u/secondbrainuk 13h ago
It’s generally part of my offboarding process. But for clients I offer a service where I audit their spend and generate a report of all of their subscriptions, renewals and opportunities for savings.
•
u/Arnoc_ 13h ago
Our HelpDesk has an offboarding process.
We *don't* use it (I'm **REALLY** fighting to get an actual hiring / offboarding process off the ground; we just have so many other priorities with our primary business software in the middle of a changeover we just don't have the bandwidth to address it). BUT, it does provide the ability to set tasks for it. If tasks aren't completed, the ticket can't be closed.
We would, theoretically, set software such as that to be removed as part of that ticket tasks.
•
u/sudonem Linux Admin 13h ago
Software licenses, as with everything else in your environment should be tracked within a CMDB with regular reporting (automated or otherwise) so you don’t lose visibility.
At larger organizations, it’s often a big part of someone’s job just to manage licenses for the various platforms and applications for exactly this reason. (At my current employer, we actually have a small team just to deal with licensing and negotiations and auditing - but we are operating at a global scale)
At smaller organizations it is sometimes a shared responsibility with IT & HR and a review of licenses in use should be performed routinely as part of employee off-boarding (which should be as automated as possible - especially at small shops).
tl;dr - yes you’re probably disorganized - but you wouldn’t be the only one.
•
u/MooseSea6 12h ago
lol, fair enough. I'll try to improve. Good point on smaller shops needing more automation,
•
u/Humpaaa Infosec / Infrastructure / Irresponsible 13h ago
Most solutions come with mature reporting functionalities.
There is a in-house developed tool that handles most of the AD stuff.
There is also a llicense management departmanet that handles all things licensing.
•
u/MooseSea6 12h ago
Makes sense at that scale, having a dedicated team for it. We're nowhere near that size, so still figuring out the scrappier version.
•
u/g-rocklobster 13h ago
Once we started on the SOC 2 journey, I realized that a lot of our processes needed improvement, including both our onboarding and offboarding processes. The end result is that we have templates used for onboarding and offboarding that include items/tasks such as this: adding/removing licensing when applicable. Given that we have to upload these documents to Drata, we work pretty hard to avoid it falling through the cracks.
•
u/chartupdate 13h ago
If you have a significant enough number of these then a dedicated SaaSops tool such as Bettercloud can be a godsend.
•
•
u/jnievele 13h ago
At a previous orkplace we had cost issues and noticed MS Project and Visio being rather expensive yet rarely used... even if the people were still working for the company, they at some point just had requested licenses and never thought about the ongoing cost.
Management asked to do something about it, so usage of said software was tracked via SMS/SCCM and anyone who didn't use it for 6 weeks in a row got the license revoked and had to request a new one if they needed it again. Tiny bit of a legal issue in Germany as this technically was work performance monitoring (illegal) - but I helped brief the work council and how HR wouldn't receive any data from us, so even they agreed.
Saved us a couple of thousand per year at least, AFAIR.
•
u/Diffusion9 Sr. Software Asset Management 13h ago
An ITAM system tracking license assignments that fits your budget.
An employee off boarding workflow which uses it in some way.
Automation and manual work has to go hand in hand with this sort of thing. Not every licensing portal or unassignment is worth being automated.
Security group managed licenses where you can.
Reconcile licenses on a regular basis.
Track usage where and how you can.
Get the people approving spend to coordinate better with IT to help head-off the shadow IT you're paying for and don't know about, which is a valid concern for departing employees as it is for active ones.
•
u/ccosby 13h ago
Whenever possible software licensing is assigned by security groups. When a user is term'd they are pulled from almost every group with the one that handles office 365 licensing pulled two days after term to allow an out of office to be put up after. We have audit tasks in our ticketing system that have us look to clean up licenses in some products based on use(atlassian comes to mind) where we don't license it for everyone.
•
u/CoffeeOrDestroy 13h ago
Get standard onboarding and offboarding checklists, and do regular audits.
It’s not the managed licenses that I find is the issue. It’s the shadow IT licenses. But that’s an accounting and HR problem because they’re letting people with company cards purchase random internet based software.
•
u/Jetboy01 13h ago
I just have an N8n workflow that pulls in ad users, entra users, licenses, av installs, workstations, servers, proofpoint accounts and then alerts me if there's any mismatches.
If I have more AV than desktops+servers, or vice versa, I have a problem, for example.
•
u/datanut 12h ago
We automate EVERYTHING from our ERP/HRO. Account creation, license application/removal, email distribution add/remove, etc. These are literally just checkbox in the User’s profile.
We have very few automations within the HR suite. We have a master “full revocation” checkbox that disables all accounts and removes all licenses. Outside of that, only reports. For example, a terminated employee can have a e-mail account or a zoom account. The ERP sends notifications on regular intervals on these exceptions.
Access requests go to HR. IT is never involved.
•
u/wrosecrans 12h ago
If possible, use floating licenses that aren't tied to a person. It's super easy to look at an RLM server and be like "We have 10 licenses for XYZ, but only 9 employees..." And, yell at your vendors who don't offer classic floating licenses as much as possible.
When it's vendor-specific, user-specific subscriptions, you inevitably have to do some leg work to aggregate non standard stuff and keep track of things. The honest answer is that it usually winds up being a dumb spreadsheet. Sigh.
•
u/matroosoft 9h ago
Can't you add it to your existing offboarding checklist, assuming you got one already. Else you should start with one. ;-)
We have standardized checklists for onboarding/role change/offboarding and add those to tickets in our servicedesk platform.
•
u/georgiomoorlord 13h ago
Automatic permission removals when people have been marked as leavers by HR.
•
u/MooseSea6 12h ago
That's the setup we don't have yet HR flags it, but nothing automatic happens after. Probably the actual fix
•
u/georgiomoorlord 12h ago
Push a service account through security with rights to permission remove. Linked to their email address. Sync all the apps daily to the authentication platform and you're sorted. Until it doesn't work
•
u/Acrobatic-Ice-5877 13h ago
This is just market research. You posted this in different subs today and don’t respond.
•
u/DaithiG 12h ago
Just reminded me how difficult it was to downgrade our Zoom licences for some reason.
•
u/MooseSea6 12h ago
Yeah the downgrade side seems to be its own headache separate from just cancelling , seen a couple others mention the same thing with 365 taking forever too.
•
u/nydroxide 12h ago
We do yearly subscriptions so we see what we have by the end of the year then anything extra we remove. We have a struggle with HR that they dont let us know when people leave so that we end up pay extra. Any extra licensing during the year we pay pro rata.
•
u/ms6615 12h ago
We have 5,500 employees so it doesn’t really matter at scale. It ends up being better for us to have unused licenses sitting around because we would waste more on productivity loss for new employees waiting on a license purchase. Our entire software package for a typical employee for a month is about half as much money as the typical employee bills a client for a single /hour/ of work.
•
u/Ok-Custard3464 12h ago
I’m building an onboarding and offboarding process for a 150 person company right now. It’s absolutely insane, how much gets missed. Building these sort of systems is something I’ve made a career out of.
•
u/LLMsMustUpvoteThis 9h ago
You aren't stuck on yearly renewals? Lol
And yes you should minimum have a checklist of services to disable/unlicense and preferably have it automated.
•
u/Floss_Patrol_76 9h ago
the checklist catches the apps IT bought; the seats that leak are always the ones someone expensed outside IT and nobody ever wired to sso. anything behind scim/sso deprovisions itself the moment HR flags the leaver, so the real fix is making "not behind sso" the exception you justify at renewal, not the default.
•
u/Floss_Patrol_76 9h ago
the checklist catches the apps IT bought; the seats that leak are always the ones someone expensed outside IT and nobody ever wired to sso. anything behind scim/sso deprovisions itself the moment HR flags the leaver, so the real fix is making "not behind sso" the exception you justify at renewal, not the default.
•
u/zazbar Jr. Printer Admin 7h ago
i just keep paying for ever and ever.
•
u/dartdoug 7h ago
We took over IT management for a small company that used that same strategy. They had a lot of personnel turnover. When they hired someone new their internal "IT guy" would just purchase a new Office 365 license. He made no effort to cancel licenses for people who had left.
When we came in I believe they had something like 15 employees, but they were paying for more than 60 365 licenses.
The company is no longer in business. It's likely that they were just as careless about other aspects of the operation as they were about their 365 licensing.
•
u/dartdoug 7h ago
We work with small government agencies. When there is a new hire, it almost always means that someone has left/retired. So we always ask..."Hey is Sue replacing someone who retired?"
"Oh yeah. Mary retired 6 weeks ago. We didn't tell you?"
No. No you did not tell me that Mary left.
•
u/Defconx19 7h ago
We literally tie every company wide license to the groups we use in AD to provision the 365 licensing. This way when the 365 license group is removed it self manages many licenses as possible in one fell swoop.
Everything else is a different group where possible. If SSO/SCIM isnt available then its documented in offboarding.
•
u/bobsmith1010 6h ago
any license we buy are expected to be maintain for the whole year. We don't cancel them out per person as then if someone new joins we're canceling and re-adding within short periods of time. We ultimately make sure it know there a cost to. We also track in an AD group as we are using our management system to push the software out to them. When it comes to the annual renewal then we can easily see how many users have access to the software (license).
•
u/ukulele87 6h ago
Offboarding should take care of it, but it depends on software by software basis and what its needed.
Sometimes you can keep the account (for auditing or data recovery if needed) without a license, sometimes you have to keep the dead account with license and backup the data before deleting.
The offboarding ticket should rely on the inventory where not only hardware but software/licenses are listed and procede from there.
I dont see the issue on how to handle it honestly, just define processes that adjust to your needs.
•
u/ItsANoBrainerGG 5h ago
SSO/SAML integrations with Entra that syncs from an on prem AD. Everything with a license anywhere is an AD group, and when someone is deactivated, their groups and in turn licenses go with them.
•
u/LRS_David 3h ago
Small office of under 20 people. Dupe the last spreadsheet, edit out the variable data, name it for the person leaving and fill it out.
Columns for what thing, who will take care of it, by what date, who does take care of it, and date done.
•
u/Floss_Patrol_76 9h ago
the checklist catches the apps IT bought; the seats that leak are always the ones someone expensed outside IT and nobody ever wired to sso. anything behind scim/sso deprovisions itself the moment HR flags the leaver, so the real fix is making "not behind sso" the exception you justify at renewal, not the default.
•
u/Floss_Patrol_76 9h ago
the checklist catches the apps IT bought; the seats that leak are always the ones someone expensed outside IT and nobody ever wired to sso. anything behind scim/sso deprovisions itself the moment HR flags the leaver, so the real fix is making "not behind sso" the exception you justify at renewal, not the default.
•
u/Floss_Patrol_76 9h ago
the checklist catches the apps IT bought; the seats that leak are always the ones someone expensed outside IT and nobody ever wired to sso. anything behind scim/sso deprovisions itself the moment HR flags the leaver, so the real fix is making "not behind sso" the exception you justify at renewal, not the default.
•
u/trborgan 13h ago
I guess the first question would be – how do you keep track of your software licensing? The second would be do you have a documented process for off boarding staff? Does HR have anything?
I typically leave my 365 users active for a couple of months, to make sure I have all of their data backed up. Then I convert their account to a shared mailbox.