If SaaS renewals are getting expensive, start by checking who still has access and whether that access is actually being used. Microsoft Entra access reviews can help you remove stale assignments, while Microsoft Entra license usage insights show which paid features are being used and which are not. Used together, they turn renewal cleanup from a guess into a repeatable process.
Why access reviews and license insights belong in the same cleanup
A common mistake is to review only invoices or only user lists. That misses the link between access and cost. Microsoft’s access review guidance says access reviews can be scheduled or run ad hoc to discover who has access to applications, groups, access packages, and roles, and they can be delegated to business owners, managers, or users for self-attestation Microsoft Entra access reviews. Microsoft also says review outcomes can be automated, including removing access when a review ends.
The license side matters too. Microsoft Entra license usage insights shows purchased entitlements and feature usage in the Entra admin center, including Microsoft Entra ID P1, P2, and Suite entitlements, with usage metrics such as Conditional Access users and Risk-based Conditional Access users Microsoft Entra license usage insights. Microsoft notes that the data reflects last month’s usage and may take up to three days to update, so treat it as a planning signal rather than live telemetry.
For small businesses and IT teams, the practical goal is simple: remove access that no one can justify, then use the results to decide whether the related license should be renewed, reduced, or reallocated.
A repeatable cleanup process before renewals
Start with a short, named scope instead of trying to clean up every application at once. Microsoft recommends piloting access reviews on a small group and noncritical resources first Plan a Microsoft Entra access reviews deployment. That advice fits renewal cleanup well.
Use this sequence:
- Pick one SaaS app or one access package tied to a renewal.
- Check the current assignments and identify the business owner or reviewer.
- Run an access review for users, groups, or access packages that control access to the app.
- Ask reviewers to approve, deny, or apply recommendations based on sign-in activity.
- Remove access for users who no longer need it, either manually or through automatic review outcomes.
- Compare the remaining access list with license usage or feature usage data.
- Record what changed before the renewal decision is made.
Microsoft says access reviews can be configured so that if reviewers do not respond, the system can take recommendations or remove access automatically Create an access review of an access package in entitlement management. That helps when business owners are busy, but it also raises the stakes: you need a clear approval rule and a rollback plan before enabling auto-apply.
A useful operating rule is to separate three questions:
- Should this person still have access?
- Does the person still need the specific feature or package that license enables?
- If not, should the account be removed, downgraded, or moved to a lower-cost option?
What to verify before and after the review
Verification matters because access cleanup can break work if it is done blindly. Microsoft recommends confirming that email addresses are valid for review communications, documenting removed access in case it must be restored, and monitoring audit logs during a pilot Plan a Microsoft Entra access reviews deployment. Those are good controls for any cleanup cycle, not just pilots.
Before the review starts, verify these items:
- The app or access package is integrated with Microsoft Entra ID.
- The right reviewer is assigned, such as a business owner, manager, or named delegate.
- Review timing matches your renewal calendar.
- You know what happens if a reviewer does not respond.
- You can restore access quickly if a mistake is made.
After the review ends, verify more than just the approval status. Check whether removed users still have dependent access elsewhere. Microsoft notes that access reviews can cover applications, groups, access packages, Microsoft Entra roles, and Azure resource roles, so a single cleanup may affect several layers of access Manage user access with Microsoft Entra access reviews. A person may no longer need access to one app but may still need a related group or package.
Then compare the access results with license usage insights. Microsoft says the license usage page shows purchased entitlements, feature usage, and a six-month usage pattern view, with separate views for active users and guest users Microsoft Entra license usage insights. If a license is barely used, that does not automatically mean it should be removed. But it does mean you should ask whether the assigned users still need the capabilities tied to that license tier.
Tradeoffs: automation, ownership, and licensing
Access reviews are useful partly because they shift decisions away from IT alone. Microsoft’s planning guidance says business owners can be delegated to review continued access, which improves accountability but requires training and clear responsibility Plan a Microsoft Entra access reviews deployment. That is a tradeoff: better ownership, more coordination.
Licensing is another tradeoff. Microsoft says access reviews require Microsoft Entra ID Governance or Microsoft Entra Suite for member users, and some capabilities may work with Microsoft Entra ID P2 Microsoft Entra licensing. Microsoft also says entitlement management and access reviews can have different requirements depending on the scenario, and guest-related capabilities may have separate billing considerations. Because licensing changes over time, confirm the current Microsoft licensing page before budgeting.
For teams already using Microsoft 365 Business Premium or Entra-based plans, this matters because the needed rights may already exist, but the exact feature set can vary by edition and subscription mix. Do not assume every review or entitlement management feature is included. Check the license matrix for the resource type you want to govern.
The practical payoff is not just security. Access reviews and license insights give you a process to trim stale access before renewals, so you can make a cleaner renewal decision and explain it with evidence instead of intuition.
A simple monthly workflow to keep the cleanup going
Once the first review is done, make it a recurring process:
- Two weeks before renewal planning, export the current access list.
- Run an access review for the app, group, or access package.
- Review sign-in activity and usage recommendations.
- Remove stale access and document exceptions.
- Check the license usage page for the related Microsoft entitlement.
- Decide whether to renew, reduce, or reassign capacity.
- Keep the reviewer list and timing consistent for the next cycle.
If you want the process to stick, assign one owner for the review calendar, one owner for approvals, and one owner for the renewal decision. That keeps the work from becoming a one-time cleanup that nobody repeats.
For a related process view, see how to build a simple software license review process and how to trim unused software access before renewals. If you are planning the wider operating model, it also helps to use Entra workflows and access reviews together.
Used this way, identity governance becomes a renewal discipline, not just a security control. It helps you remove stale access, verify what is actually being used, and bring more accuracy to SaaS spending decisions.