Salesforce Over-Licensing: How to Find It Before Your Contract Auto-Renews

TL;DR: Over-licensing happens in three layers: base seat bloat (you bought more Enterprise/Unlimited licenses than people use), PSL sprawl (premium add-ons assigned to dormant users), and license pool underutilization (entire license types with less than 70% adoption). Most companies only check the first one. The second and third are where the real money hides.

Here's a pattern that plays out at hundreds of mid-market companies every year: a Salesforce org starts with 100 Enterprise licenses. Hiring is good, so the admin requests 50 more. Two departments get restructured, 30 people move to roles that don't touch Salesforce, but nobody deactivates their accounts. IT provisions Agentforce licenses for a pilot that gets deprioritized. Einstein gets bundled into a renewal because the AE offered a discount on volume.

Three years later, the org has 200 Enterprise licenses, 40 Agentforce seats, and 25 Einstein licenses. Actual weekly active users: 112. The contract auto-renews in 47 days.

That's over-licensing. And it's more common than most admins realize.

The Three Layers of Over-Licensing

Over-licensing isn't one problem — it's three overlapping problems that compound at renewal.

Layer 1: Base seat bloat

This is the obvious one. You purchased X Enterprise (or Unlimited, or Platform) licenses and fewer than X people use Salesforce regularly. The gap between purchased and active is your seat bloat.

The naive approach: count users where IsActive = true and LastLoginDate is older than 90 days. That gets you a number, but it's a snapshot — it catches vacation weeks, onboarding delays, and seasonal patterns.

The better approach: track your average active seat count across 8–12 weeks of LoginHistory data. Count distinct users with at least one login per week, average across the window. Compare that average against your purchased count.

A company with 200 purchased Enterprise licenses and a 12-week average of 118 active users has an 82-seat gap. At the post-August 2025 list price of $165/user/month, that's $13,530/month — $162,360 annually — in licenses that are not generating any value.

Layer 2: PSL sprawl

Permission Set Licenses are where over-licensing gets expensive fast. These are premium add-ons assigned per-user:

• Agentforce: $165/user/month
• Revenue Intelligence: $200/user/month
• Einstein: $50/user/month
• Sales Engagement: $50/user/month

PSL sprawl happens when these get assigned during a pilot or rollout, and nobody cleans them up when the user goes inactive. The admin who provisioned them has moved on. The user who was supposed to adopt them never did. The license keeps billing.

The detection query is straightforward — cross-reference PermissionSetLicenseAssign records against user login activity. Any PSL assigned to a user who hasn't logged in for 90+ days is waste. Any PSL assigned to a user who has never logged in is pure waste.

In a typical mid-market org, PSL waste adds 15–30% on top of the base seat bloat number. It's often the finding that gets the CFO's attention because the per-seat prices are higher and the waste is more defensible.

Layer 3: License pool underutilization

This one is less obvious. Salesforce orgs often have multiple license types — Enterprise, Platform, Identity, Community, plus various add-on pools. Each pool has a purchased count and a used count. If any pool is below 70% utilized, that's a negotiation lever.

The tricky part: some license types are free or system-allocated (Chatter Free, Guest User License, Lightning Login). You need to filter those out before calculating utilization. There are 19+ license types that Salesforce provisions automatically and don't represent purchased spend.

License pool underutilization is especially common after acquisitions or org consolidations, where purchased counts from two contracts get stacked but actual usage doesn't double.

Why Auto-Renewal Is the Real Problem

Most Salesforce enterprise contracts include an auto-renewal clause. If you don't give written notice of changes within a specified window (typically 60–90 days before the renewal date), the contract renews at the current terms — same seat count, same add-ons, usually with a 3–7% annual uplift baked in.

That means every seat you don't actively remove before the notice window closes is locked in for another year. Over-licensing doesn't fix itself. It compounds annually.

The math is brutal. A 50-seat over-purchase at $165/month, left unchecked for 3 years with a 5% annual uplift:

• Year 1: $99,000
• Year 2: $103,950
• Year 3: $109,148
• Total: $312,098 in unused licenses

That's a headcount. That's a tool budget. That's a project that didn't get funded because the Salesforce line item ate it.

How to Find Over-Licensing in Your Org

Step 1: Pull the raw numbers

You need three data sets:

1. User license inventory: Query UserLicense for TotalLicenses and UsedLicenses per license type. This gives you purchased vs. allocated.
2. Login activity: Query LoginHistory for distinct user IDs per week over the last 90 days. This gives you actual usage, not just allocation.
3. PSL assignments: Query PermissionSetLicenseAssign joined against user login data. This gives you add-on waste.

Step 2: Filter the noise

Not every inactive account is over-licensing. Exclude:

• System accounts (usernames matching the @00d org ID pattern, service accounts like “Automated Process”)
• Users created in the last 30 days (onboarding grace period)
• Free/system license types (Chatter Free, Guest User, Lightning Platform Portal, etc.)
• Integration users on dedicated Integration User licenses (these are intentionally non-interactive)

Step 3: Calculate the savings

For each layer:

• Seat bloat: (purchased − avg active) × per-seat monthly cost × 12 = annual savings
• PSL waste: sum of (inactive PSL assignments × per-SKU monthly cost) × 12
• License pool gaps: (purchased − used) per underutilized pool × estimated per-seat cost × 12

Present the total as an annual number. “$247,000 in annual Salesforce spend on unused licenses and add-ons” is the sentence that gets a meeting with Finance.

Step 4: Track it over time

A one-time audit is useful. A weekly audit that shows a trend line is powerful. If your over-licensing is consistent across 8–12 weeks of data, it's not an anomaly — it's structural. That's the evidence that holds up in a renewal negotiation.

Track three metrics weekly: active user count (from LoginHistory), total purchased licenses (from UserLicense), and estimated monthly savings (from your rules). Plot them. The gap between the first two lines is your over-licensing, and the third line is what it costs.

What to Do Once You Find It

Before the renewal window

• Deactivate truly inactive users (90+ days, no upcoming need). This reduces your UsedLicenses count, which is your starting position for seat reduction.
• Revoke PSL assignments on inactive users. Unassigning Agentforce from 15 dormant accounts doesn't break anything — those users weren't using it.
• Document everything. Your AE will ask “are you sure those users won't need access?” Have the login history ready.

At the negotiation table

• Lead with the annual savings number, not the seat count. “$247K in unused licenses” frames the conversation differently than “we want to drop 80 seats.”
• Separate base licenses from add-ons. Negotiate each line independently. AEs bundle to obscure individual price increases.
• Resist the multi-year discount if your seat count is declining. A 15% discount on a 3-year lock with 80 excess seats costs more than right-sizing annually.

The Auto-Renewal Trap Is Avoidable

Over-licensing isn't a technical problem. It's an operational one. Salesforce doesn't send you a utilization report. Optimizer was retired, and there's no dashboard that says “you're paying for 200 licenses and using 118.” The data exists in LoginHistory, UserLicense, and PermissionSetLicenseAssign — but nobody queries it until the renewal conversation is already underway.

The companies that avoid the trap are the ones that start measuring at T-90, not T-30. They have trend data, not snapshots. And they walk into the renewal conversation with a number their AE can't dismiss.