SaaS Cost Management — SaaS Sprawl, License Optimization, Usage Tracking, Vendor Consolidation

# Analyze credit card statements for recurring SaaS charges
import csv
from collections import defaultdict

def analyze_saas_spend(transactions_csv):
    """Identify SaaS subscriptions from transaction data"""
    saas_providers = {
        'slack.com': 'Slack',
        'github.com': 'GitHub',
        'atlassian.net': 'Jira/Confluence',
        'datadoghq.com': 'Datadog',
        'newrelic.com': 'New Relic',
        'sentry.io': 'Sentry',
        'figma.com': 'Figma',
        'notion.so': 'Notion',
        'asana.com': 'Asana',
        'miro.com': 'Miro',
        'zoom.us': 'Zoom',
        'google.com workspace': 'Google Workspace',
        'microsoft.com 365': 'Microsoft 365',
    }

    subscriptions = []
    total = 0

    with open(transactions_csv) as f:
        reader = csv.DictReader(f)
        for row in reader:
            description = row.get('Description', '').lower()
            for domain, name in saas_providers.items():
                if domain in description:
                    amount = float(row.get('Amount', 0))
                    subscriptions.append({
                        'name': name,
                        'amount': amount,
                        'date': row.get('Date'),
                        'frequency': 'monthly'
                    })
                    total += abs(amount)
                    break

    return subscriptions, total

# Using Google Workspace admin to find connected apps
# Admin Console → Security → API Controls → Domain-wide Delegates

# Using Okta/SSO logs to identify unmanaged apps
okta list apps --status INACTIVE
okta report users --format json | jq '.[].appLinks | keys[]'

# Network-based detection (DNS queries to SaaS domains)
tcpdump -n 'port 443' | grep -E "(slack|zoom|teams)\.com"

import requests
from datetime import datetime, timedelta

class LicenseOptimizer:
    """Analyze SaaS usage and recommend license changes"""

    def check_slack_usage(self, api_token):
        """Identify inactive Slack users"""
        headers = {'Authorization': f'Bearer {api_token}'}
        response = requests.get(
            'https://slack.com/api/team.inactive.users',
            headers=headers
        )
        inactive = response.json().get('users', [])

        report = []
        for user in inactive:
            report.append({
                'name': user['name'],
                'email': user.get('profile', {}).get('email'),
                'last_active': user.get('updated'),
                'recommendation': 'Downgrade to deactivated'
            })
        return report

    def check_github_usage(self, token, org):
        """Find GitHub users who haven't committed in 90 days"""
        headers = {'Authorization': f'token {token}'}
        cutoff = datetime.now() - timedelta(days=90)

        response = requests.get(
            f'https://api.github.com/orgs/{org}/members',
            headers=headers
        )

        inactive = []
        for member in response.json():
            # Check last commit date
            events = requests.get(
                member['events_url'].replace('{/privacy}', ''),
                headers=headers
            ).json()

            last_push = None
            for event in events:
                if event['type'] == 'PushEvent':
                    last_push = datetime.fromisoformat(
                        event['created_at'].replace('Z', '+00:00')
                    )
                    break

            if not last_push or last_push < cutoff:
                inactive.append({
                    'login': member['login'],
                    'last_commit': str(last_push) if last_push else 'Never',
                    'recommendation': 'Consider removing from paid seats'
                })

        return inactive

def deprovision_inactive_users():
    """Automatically downgrade users inactive for 90+ days"""

    inactive_users = get_inactive_users(days=90)

    for user in inactive_users:
        # 1. Notify user
        send_email(
            to=user['email'],
            subject="Your license will be downgraded",
            body=f"You haven't used {user['tool']} in 90 days..."
        )

        # 2. Give 7-day grace period
        # (handled by scheduling this function to run again)

        # 3. Deprovision
        if user['days_inactive'] > 97:  # 90 + 7 grace
            deprovision_saas(user)
            print(f"Deprovisioned {user['email']} from {user['tool']}")

def calculate_negotiation_leverage(current_spend, users):
    """Calculate potential savings from contract negotiation"""

    # Typical enterprise discount tiers
    discount_tiers = [
        (10000, 0.10),     # $10k → 10% off
        (50000, 0.20),     # $50k → 20% off
        (100000, 0.30),    # $100k → 30% off
        (500000, 0.40),    # $500k → 40% off
    ]

    leverage = 0
    for threshold, discount in discount_tiers:
        if current_spend >= threshold:
            leverage = discount

    return {
        'current_spend': current_spend,
        'current_users': users,
        'max_discount_pct': leverage * 100,
        'potential_savings': current_spend * leverage,
        'negotiation_tips': [
            "Ask for multi-year commitment discount (15-25%)",
            "Request usage-based pricing instead of per-user",
            "Negotiate a 90-day break clause",
            "Ask for free professional services hours",
            "Request a dedicated account manager"
        ]
    }

def evaluate_saas_request(request):
    """Evaluate a new SaaS purchase request"""

    checks = {
        'has_existing_tool': check_tool_overlap(request['category']),
        'has_budget': request['annual_cost'] < available_budget(),
        'security_approved': security_review(request['vendor_url']),
        'legal_approved': legal_review(request['terms_of_service']),
        'has_owner': request['owner'] is not None,
    }

    if any(not v for v in checks.values()):
        failing = [k for k, v in checks.items() if not v]
        return {
            'approved': False,
            'reasons': failing,
            'suggestion': f"Consider using existing {find_existing_tool(request['category'])}"
        }

    return {
        'approved': True,
        'annual_cost': request['annual_cost'],
        'budget_code': assign_budget_code(request['department'])
    }

{
    "tools": [
        {
            "name": "GitHub",
            "category": "source_control",
            "vendor": "Microsoft",
            "plan": "Team",
            "cost_per_user": 4,
            "total_users": 150,
            "annual_cost": 7200,
            "owner": "engineering@company.com",
            "contract_end": "2027-06-30",
            "usage_rate": 0.85,
            "alternatives": ["GitLab", "Bitbucket"]
        }
    ]
}

#!/bin/bash
# saas_audit.sh — Automated SaaS spend audit
# Detects known SaaS subscriptions and estimates costs

echo "=== SaaS Spend Audit ==="
echo "Date: $(date)"
echo ""

# Detect installed SaaS tools via browser history (Chrome)
detect_from_chrome() {
    local history_path="$HOME/.config/google-chrome/Default/History"
    if [ -f "$history_path" ]; then
        echo "--- Browser-based SaaS detection ---"
        sqlite3 "$history_path" \
          "SELECT DISTINCT url FROM urls WHERE url LIKE '%slack.com%' OR url LIKE '%github.com%' OR url LIKE '%figma.com%'" \
          2>/dev/null | head -10
    fi
}

# Detect via running processes
detect_from_processes() {
    echo ""
    echo "--- Installed SaaS desktop apps ---"
    for process in slack zoom teams notion figma; do
        if pgrep -x "$process" >/dev/null 2>&1; then
            echo "Running: $process"
        fi
    done
}

# Detect via config files
detect_from_config() {
    echo ""
    echo "--- SaaS config files detected ---"
    local config_dirs=(
        "$HOME/.slack"
        "$HOME/.zoom"
        "$HOME/.config/Notion"
        "$HOME/.gitconfig"
        "$HOME/.npmrc"
    )
    for dir in "${config_dirs[@]}"; do
        if [ -f "$dir" ] || [ -d "$dir" ]; then
            echo "Config: $dir"
        fi
    done
}

# Estimate total based on user count
estimate_saas_cost() {
    echo ""
    echo "--- Estimated Monthly SaaS Cost ---"
    local developers=0
    if [ -d "$HOME/projects" ]; then
        developers=$(ls -d "$HOME/projects"/*/ 2>/dev/null | wc -l)
    fi

    # Typical per-developer SaaS cost: ~$150/month
    local estimated=$((developers * 150))
    echo "Developers detected: $developers"
    echo "Estimated SaaS cost: \$${estimated}/month"
    echo "Estimated annual: \$$((estimated * 12))/year"
}

detect_from_chrome
detect_from_processes
detect_from_config
estimate_saas_cost

echo ""
echo "=== Recommendations ==="
echo "1. Run a formal 30-day SaaS discovery (use credit card data)"
echo "2. Identify tools with <70% active usage rate"
echo "3. List redundant tools in same category"
echo "4. Schedule vendor consolidation review"