A 300‑person company retires its unused SaaS vendors with an OAuth app review, token revocation, data exports and deletion attestations
A technology services company of about 300 staff headquartered in Florida, a leader in its segment.
- Scale
- About 300 users, 140 connected apps found, 31 retired or consolidated, 24 vendors fully offboarded, 1 identity provider
- Engagement
- Three weeks of discovery, then about three months to retire the first 24 vendors in waves
The challenge
Over six years, teams had signed up for dozens of SaaS tools, many by clicking Sign in with Microsoft or Sign in with Google and accepting the requested permissions. When a vendor was dropped, the subscription stopped, but the account, the connected app, the tokens it held and the data it had pulled from the company's mailboxes, drives and calendars stayed behind. A customer security review asked which outside services still held company data, and the answer was a spreadsheet that nobody trusted. Two of the vendors had since been acquired, and one had a reported breach.
Cancelling a SaaS subscription ends the invoice, not the relationship. When someone signs in to a tool with a work account, the tool may be granted a standing right to read mail, files or calendars through OAuth, and that grant keeps working until someone removes it. After six years of team-by-team purchasing, the company had dozens of those rights outstanding to vendors it no longer used, and no list of them.
We began by building the list from three independent sources, because each one hides something. The identity provider knows what has been consented to, the sign-in logs know what is actually used, and accounting knows what is paid for. The overlap is the managed estate. The differences are the interesting part: apps that are used but not paid for, paid for but not used, or granted broad access and forgotten.
Retiring a vendor became a short, fixed sequence rather than a favor to be remembered: decide what to keep, export it, revoke the access, delete the accounts and secrets, ask the vendor for written deletion, and file the answer. The order matters. Exporting first means the company never deletes the only copy of a record it must retain, and revoking tokens before the deletion request means the vendor cannot keep pulling data while it considers the request.
The company also changed the default for new apps, so the problem does not refill. Users can approve low-risk permissions from verified publishers, and everything else waits for a reviewer. In this illustrative case, the lasting result was not the 24 vendors retired but that the next customer security review could be answered from a maintained inventory.
What our team delivered
- Discovery from three sources instead of one: the identity provider's list of enterprise applications and consent grants, the sign-in logs for the past 12 months, and the accounting system's card and invoice records. It found 140 connected apps, of which 38 had no recent sign-ins, 17 held broad delegated permissions such as reading all mail or all files, and 9 were not in any contract file
- An OAuth app review: each app was given a business owner, a purpose, the permissions it holds, whether it uses delegated or application permissions, whether the publisher is verified and when it was last used. The review separated apps to keep, apps to consolidate and apps to retire, and wrote down why for each
- Token revocation as a step in the retirement of each vendor, not a hope. The team removed the app's consent grants and its service principal in the identity provider, revoked refresh tokens and sign-in sessions for the affected users, deleted application secrets and certificates, rotated any API key or webhook secret the vendor had been given and removed the vendor's service accounts. A check afterward confirmed the app could no longer obtain a token
- A tighter default for new apps: users can consent only to low-risk permissions from verified publishers, everything else goes through an admin consent workflow with a named reviewer, and app registrations the company creates are limited by owner and by expiry for their secrets
- A data-export step before closing each account: what the vendor holds, in what format, who needs it and for how long, with the export checked for completeness and stored under the company's own retention rules. For a few vendors that held records the company must keep, the export was verified before anything was deleted
- A written deletion request to each vendor under its data processing terms, citing the contract, the account identifier and the data categories, and asking for a signed attestation that the data was deleted, including from backups on the vendor's stated cycle. Attestations are filed with the contract and the date, and the three vendors that did not reply in 30 days were escalated through their trust or privacy contact
- SCIM or manual deprovisioning for the users of each retired app, a monthly report of new consent grants and unused apps, and a short checklist so that retiring a vendor in future follows the same steps in the same order
Result
Twenty-four vendors were offboarded with the tokens revoked, the data exported and a deletion attestation on file for 21 of them, and the company could answer the customer's review with a list, not a guess. The three outstanding vendors are tracked with a date and an owner. Connected apps fell from 140 to 109, none of the 17 broad-permission apps remains without an owner and a reason, and a new request now takes a day of review rather than a click. An attestation is a vendor's statement, not proof, and deletion from a vendor's backups follows its own schedule. This is an illustrative engagement that describes the kind of work our team does; details are composite.
Get this for your company
Related services with fixed prices and a written scope.
Emergency package: security engineer in 1 hour
Is your company in a cybersecurity crisis? Purchase this package and a security engineer will call you within 1 hour.
Callback within 1 hour, 24 hours a day, 365 days a year
$1,950 per incident
Initial assessment of public endpoints
What an attacker can see and reach from the internet: your domains, mail, websites, remote access and cloud exposure.
Report within 5 business days of kickoff
$1,000 per assessment
Managed IT and security (MSP)
One monthly price per team member: help desk, device management, patching, backup monitoring and security basics.
Onboarding starts within 10 business days
$100 per team member, per month
Show 5 more
Insurance-ready bundle
The three things cyber insurers and clients ask for most: an external assessment, a phishing simulation for 25 users and a disaster recovery plan.
Assessment report in 5 business days; plan draft in 15 business days
$5,400 per bundle, phishing simulation for 25 users
Managed security monitoring
Endpoint detection and response watched by our analysts, priced per device.
Agents deployed within 7 business days
$18 per endpoint, per month
Cloud security review
A review of one Microsoft 365, Azure, AWS or Google Cloud tenant against recognized benchmarks.
Report within 7 business days of read-only access
$2,800 per tenant
Cloud management
We run your Microsoft 365, Azure, AWS or Google Cloud environment: access, cost, patching, backup and security settings. Priced per month for one tenant.
Onboarding within 15 business days
$1,900 per tenant, per month
Phishing simulation
A realistic, authorized phishing campaign with short training for anyone who clicks. Priced per person.
Campaign launches within 5 business days of approval
$12 per user, per campaign
After you purchase, we contact you within 1 hour, any time of day or night, to start onboarding.
No payment is taken online. When we call you within the hour we confirm the scope and send an invoice (ACH, card or crypto).
Every sign-in, verified
Staff sign in once, but behind the scenes the device, the identity, a phone approval and your access policy are all checked before any app opens, and strangers are turned away.
Super Intelligence data flow
Every request is classified by sensitivity, so confidential data stays on models inside your walls while routine work can use the best frontier AI.
The evidence pack and who asks for what
Twelve artefacts a firm can show about its AI use, and the party that most often asks for each: an insurer at renewal, an auditor or client questionnaire, or a regulator. A typical pattern only; the exact list depends on the policy, framework and sector.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.