The hidden offboarding step draining your budget

There’s a good chance something important is missing from your IT team’s offboarding checklist, and it may be causing a steady drip of unnecessary, wasted spend. The source of this leak? No, it’s not the unreturned laptops; it’s the licenses for SaaS apps that employees use every day. 

The SaaS landscape is littered with apps outside IT’s direct control, and when there’s employee turnover, it’s often difficult to ensure that every license across every app is accounted for. One symptom of this problem is that former employees often retain access to apps long after they should have been revoked. In fact, 1Password’s research found that 38% of employees have accessed a prior employer’s accounts after leaving the company. That’s not so much a leaky faucet as a burst pipe.

The problem here is that the average IT stack wasn’t built for comprehensive offboarding. The majority of IT teams handle offboarding through a combination of automation and manual processes, but this piecemeal approach is both time-consuming and error-prone. While you can achieve some level of centralized, automated onboarding via IdP/SSO, it can only revoke access to SSO-managed apps, and on average, only about two-thirds of a company’s apps are behind SSO. And, depending on the level of integration between the SSO provider and app vendor, you may only be able to revoke a user’s access, rather than deleting and reclaiming the user’s license.

And what about unsanctioned, shadow IT apps? 52% of employees admit to downloading work apps without IT approval, and these can remain active for years, silently draining budget and putting company data at risk.

If these problems sound familiar, it could be time to rethink your SaaS discovery and offboarding processes. This blog explores the costs associated with incomplete offboarding. It highlights how a SaaS management platform (SMP) can complement your IdP to deliver more comprehensive, cost-effective deprovisioning while reducing IT burden.

The cost of improper SaaS offboarding

How much money could you claw back by identifying and closing orphaned accounts? To estimate how much budget businesses lose on unused subscriptions, let’s start with shadow IT. Our research found that a single employee uses an average of five shadow IT applications, so let’s calculate how those costs can add up at an imaginary organization with 500 employees.

• 500 employees, with a 15% annual turnover rate = 75 leavers per year

• 75 leavers x 5 shadow IT apps = 375 orphaned licenses

• Assume an average license cost of $17/per user (the cost of a Jira Premium subscription)

• 375 x $17 = $6,375 in wasted spend annually

And remember, shadow IT only accounts for a fraction of improperly offboarded accounts. The actual costs are much higher when you factor in approved apps that aren’t behind SSO, or for which the SSO integration doesn’t reclaim licenses during offboarding.

The labor cost of manual deprovisioning

Offboarding is an expensive process, both in terms of wasted budget and wasted time. According to a Ponemon Institute report, deprovisioning an exiting employee – including identifying unsanctioned apps – requires approximately eight hours of work. Automating these processes with an SMP frees up IT to focus on more strategic projects that deliver greater business impact. 

For example, Moonpig, an online retailer, used Trelica by 1Password to improve efficiency and compliance in their offboarding process. According to Bill Penberthy, their head of IT: “Trelica replaced up to three hours of manual work per leaver with just 25 minutes of auditable, repeatable processes, allowing us to focus on value-added projects and supporting our end users in the best way possible.”

Cybersecurity and non-compliance costs 

When sensitive customer, employee, and internal data are left exposed in unsanctioned applications and orphaned accounts, they become targets for cybercriminals. Fixing the damage from a data breach can be a significant undertaking. The Ponemon Institute estimated that the average annual cost to U.S. companies for investigating and remediating cybersecurity incidents related to unsanctioned SaaS apps exceeds a quarter of a million dollars.

In terms of compliance, incomplete offboarding, including leaving orphaned SaaS accounts, can lead to privacy, legal, and regulatory compliance issues, as well as fines related to data protection laws such as GDPR and HIPAA. Conducting regular access reviews (not just revoking access during offboarding) is a crucial step to ensure least privilege and minimize data exposure. Trelica by 1Password’s automated access reviews simplify compliance by providing a detailed, exportable audit trail of every access decision for auditors. 

Offboarding also has a direct impact on business continuity. Moonpig, for example, used Trelica by 1Password to shut down unsanctioned SaaS accounts, redirect emails, and transfer departing employees’ Google Workspace files to designated colleagues, ensuring that no vital data was lost. 

How IdPs and SaaS Management Platforms work together for secure offboarding

No matter how robust your SSO strategy is, it’s inevitable that some SaaS apps will live outside it. These are often legitimate applications, but they’re not integrated with SSO for reasons such as: 

• The SaaS vendor doesn’t support the integration

• It’s too time-consuming or complicated to integrate

• The organization hasn’t paid for the enterprise license tier 

Even for integrated apps, an IdP often can’t automate critical offboarding steps like transferring data, delegating inboxes, or handling license repurposing.

Okta was covering some of our employee offboarding needs for a subset of apps, but often by removing access only and not actual accounts & licenses - this left significant cost and compliance gaps. Trelica workflows operate seamlessly with Okta and our ITSM (Zendesk) to reclaim leavers’ software licenses, allocate them to other employees as needed, or drop them to reduce our overall licensing costs.” -Bill Penberthy, Head of IT, Moonpig

SMPs like Trelica by 1Password fill these gaps by managing the entire app lifecycle: discovering shadow IT, provisioning access, conducting regular access reviews, and providing comprehensive offboarding. However, not all SaaS management platforms are the same. When looking for an SMP, ensure it can: 

• Combine SaaS usage data with information about SaaS contracts

• Continuously discover all the work-related apps employees use, including managed apps, Shadow IT, OAuth (“sign in with Google”), and integrations with business systems

• Revoke access to every app (including apps outside SSO) during offboarding

• Remove licenses when employees leave

• Offer a wide breadth of native integrations, connecting with hundreds of apps that employees use

• Build a unified inventory of all apps, users, licenses, and contracts for a single source of truth

Why Trelica by 1Password is IT’s offboarding friend

Trelica by 1Password complements your IdP by extending governance to sanctioned and unsanctioned SaaS apps, allowing IT teams to delete and reclaim licenses – not just revoke access. Other offboarding benefits include: 

• Business continuity: Automatically prompts managers to save and transfer assets, like files and email inboxes, when employees leave.

• License management: Automatically identifies which licenses are actually in use and whether licenses should be revoked or reassigned. This includes automatic communication with employees and managers via Slack and Microsoft Teams to ask if they still require a specific app license. 

• Redundant applications & spend optimization: Helps IT and finance teams identify redundant apps and streamline upcoming renewals. This enables companies to cut waste and make smarter SaaS investments.

• Clear audit trails: Documented proof that orphaned accounts have been closed and data deleted for compliance.

Want to learn more about how SaaS management platforms can help IT provide more comprehensive and cost-effective offboarding? Download The IT manager’s guide to streamlining onboarding and offboarding and explore best practices.