## TL;DR
Inventory every service account, check last API activity, disable the unused ones, reclaim the admin seats, and put every service account on an expiry or review date so the sprawl stops.

```text
service account sprawl: failed to reclaim unused admin seats
```

## Use this when
- Admin seats are consumed by service accounts nobody recognizes.
- The service account inventory is missing or stale.
- License true-ups keep surprising finance.

## Not for this skill when
- The seats are held by humans. That is a role assignment review.
- The accounts are active. Then the question is whether they need admin, not whether they exist.
- There is already an inventory with owners. Enforce the review cycle instead.

## Steps
1. List all service accounts and their recorded owners. Verify: the list is complete.
2. Check last activity per account via API logs. Verify: you have real usage data.
3. Disable unused accounts; do not delete immediately. Verify: each disable is reversible.
4. Reclaim the freed admin seats. Verify: the counts drop.
5. Add an expiry or review date to every service account going forward, and require an owner. Verify: new sprawl is blocked.

## Variant phrasings
### service account cleanup
The action-first phrasing.
### unused admin licenses
The goal-first search.
### sprawl reclamation
The short phrasing.

Compatibility: Any IdP and SaaS admin role management.

## Why it happens
Service accounts accumulate owners who leave, and nobody feels responsible for deleting them. Each one quietly holds its seats forever.

## Edge cases / pitfalls
- Break-glass accounts that must stay; document and exclude them explicitly.
- Accounts with activity only at quarter-end looking dormant most of the year; check a full year.
- The owner field pointing at departed employees; reassign ownership during the inventory.
- Disabling an account that a running integration uses; the activity check is what prevents this.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_BgQMpmmnCgzqjqC9YSqxcw