What makes an application "unused"?

An application is flagged if it hasn't had any user login within the configured inactivity window (default: 90 days) OR if it has fewer assigned users than the configured minimum. Either condition is enough to include it.

What does it handle and what does it hand off to a human?

Harmony handles detection, deduplication, CSV generation, and ticket creation. All decisions about retiring, investigating, or keeping each application are made by IT via the ticket.

Will the same app show up every week?

Not more than once within the frequency window. The frequency gate (default: 7 days) suppresses apps already reported within that window. An app flagged last Monday won't appear in a new ticket until at least the following Monday. Apps that gain activity (a user logs in) between runs won't be flagged again.

What does it need to be connected to before it works?

At minimum one IdP integration (Okta, Entra, or Google Workspace) must be configured and syncing application activity data into Harmony. The workflow template must be explicitly enabled per tenant (disabled by default).

All agents

Finance

Unused Application Discovery

Surfaces applications with low or no usage so IT can reclaim licenses and reduce SaaS spend.

Book a demo How it works

Works with

One run, end to endResolved

1Runs periodic usage analysis across all connected SaaS applications
2Identifies licenses with no activity beyond the configured threshold
3Distinguishes newly unused licenses from those already being tracked
4Notifies managers to confirm whether licenses should be reclaimed
5Compiles a report highlighting potential cost savings
6Creates a ticket with license reclamation recommendations

Overview

What Unused Application Discovery does

Unused Application Discovery is Harmony's automated monitoring workflow for identifying IdP-integrated applications that are sitting idle - no user logins within a configurable window, or fewer assigned users than a minimum threshold. Running weekly, Harmony scans Okta, Microsoft Entra, and Google Workspace for low-activity applications, filters out recently-reported ones to avoid repeat tickets on the same apps, generates a CSV report, and creates an IT desk ticket. IT can then clean up, retire, or investigate each flagged application.

Who it's for

Who Unused Application Discovery Is For

Persona

IT and software asset management teams responsible for application catalog hygiene and license optimization.

Pain point

Organizations accumulate applications over time - pilot tools that were never adopted, integrations that fell out of use, or apps that the whole team moved away from. Without monitoring, unused applications sit in the IdP indefinitely, consuming licenses, expanding the attack surface, and cluttering the catalog. This workflow surfaces them automatically so IT can take action.

How it works

How Unused Application Discovery Works

Trigger

A cron schedule fires (default: weekly, Monday at 8 AM UTC). Schedule and timezone are configurable per tenant.

1
Query unused IdP applications
The workflow queries all application instances in the configured IdPs for those meeting one or more unused criteria: no user login in the last N days (default: 90), or fewer than the minimum user count (default: 0). New vs. previously-seen status is tracked per application.
2
Frequency filter
Applications already reported within the re-reporting window (default: 7 days) are filtered out to avoid duplicate tickets on the same apps.
3
CSV report
All newly-flagged applications are serialized into a CSV report (idp_unused_apps_report).

Outcome

A ticket titled "IDP Applications With No Recent Activity Detected" is created with the CSV attached.

Capabilities

Dual detection criteria

Flags applications based on inactivity (no user login in the last N days) OR low user count (fewer than a configured minimum), or both - catching different types of underused apps.

Cross-IdP scan

Queries Okta, Microsoft Entra, and Google Workspace simultaneously for unused application instances.

New vs. existing tracking

Marks applications as "NEW" in the report if they've never been flagged before, and as existing if they've been previously reported - helping IT prioritize fresh findings.

Frequency-gated re-reporting

Suppresses apps already reported within the configured window (default: 7 days) to keep ticket noise low.

CSV export

Produces a structured idp_unused_apps_report.csv for review and action.

Configurable thresholds

Both the inactivity window (days without login) and the minimum user count threshold are configurable per tenant.

Configurable schedule

Cron schedule and timezone are fully configurable per tenant (default: weekly).

Use cases

Main use cases

Quarterly Application Catalog Cleanup

IT wants to identify all applications that haven't had a single user login in the last 90 days, as candidates for retirement. The workflow flags all IdP-integrated apps with no logins in 90 days, generates the CSV, and creates a ticket. IT uses the report to initiate retirement or investigation for each flagged app.

License Optimization Audit

IT suspects some licensed applications have very few actual users and could be downgraded or cancelled. The minimum user count threshold can be set to a meaningful number (such as flag apps with fewer than 5 users), producing a list of apps with low adoption that could be candidates for license reduction.

Post-Merger Application Hygiene

Following a company merger, the combined catalog contains dozens of applications from both organizations. Many may be duplicates or unused. The weekly scan surfaces apps from all connected IdPs that have gone idle since the merger, giving IT a data-driven list to rationalize the combined catalog.

Integrations

Integration	Role in the agent flow
Okta	Queried for application instances and their last login activity and user counts
Microsoft Entra	Queried for application instances and their last login activity and user counts
Google Workspace	Queried for application instances and their last login activity and user counts
Service Desk (internal)	Ticket created with CSV report; tracked by IT for cleanup and retirement actions

FAQ

It's a scheduled Harmony workflow, not an interactive chatbot. It runs on a cron schedule (default: weekly) and creates a ticket if idle applications are found. No user conversation is needed.

Works alongside

More agents for the same team