why do deprovisioned users still consume licenses after offboarding failed
Explains why deprovisioned users keep consuming licenses and fixes it by adding per-app license removal to the offboarding workflow. Use when license counts stay high after offboarding. Not for IdP account-deletion failures.
TL;DR
The license lives in the app, not the IdP. Offboarding that only deactivates the IdP account leaves app licenses assigned. Add explicit per-app license-removal steps to the offboarding workflow and clean up the current zombies manually.
why do deprovisioned users still consume licenses after offboarding failedUse this when
- License counts stay high after users are offboarded.
- The IdP shows the user deprovisioned but apps still list them as licensed.
- Finance questions the SaaS bill after a round of departures.
Not for this skill when
- The IdP account itself is still active. Fix the deprovision first.
- Licenses are consumed by active users. That is a purchasing question.
- A single app holds the license. Fix that app directly.
Steps
- List the apps where the departed user still holds a license. Verify: you have the full list, not just the obvious apps.
- For current zombies, remove the licenses manually per app. Verify: each app's license count drops.
- Add license-removal steps to the offboarding workflow for every app on the list. Verify: the workflow covers all of them.
- Re-run offboarding for the affected users through the fixed workflow. Verify: it completes.
- Verify license counts drop and stay down after the next offboarding. Verify: the fix holds.
Variant phrasings
licenses not freed after offboarding
The symptom-first phrasing.
zombie licenses
The short search.
deprovisioned user still licensed
The state-first phrasing.
Compatibility: Any IdP plus SaaS app combination. The pattern is universal.
Why it happens
IdP deprovisioning and app license assignment are loosely coupled. Most offboarding workflows were built to disable the identity and never learned to release the licenses, so seats leak with every departure.
Edge cases / pitfalls
- Apps where deprovisioning should free the license but the connector is broken; fix the connector, not just the workflow.
- Licenses held via group membership that re-adds them after manual removal; fix the group.
- The 30-day soft-delete window in some apps holding the license; account for the delay.
- Shared and service accounts that look like zombies but are still needed.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst4iYHmesrgNl3UCLHx2w