# Monthly Okta access review to reclaim unused licenses

> Every month, find the accounts and app seats nobody has used in 60 days, then hand your team a review-ready list of licenses to reclaim.

- Workflow type: agent
- Services: Okta, Google Sheets, Slack
- Categories: Operations, Finance
- Published: 2026-08-09

## What it does

- Walks every app connected to your Okta account once a month and lists who is assigned to each one.
- Checks when each person last signed in, and spots people holding a seat on an app they have never actually opened.
- Separates real savings from accounts that are quiet for a reason, like emergency admin logins, service accounts, and people on leave.
- Logs every flagged seat in a spreadsheet and posts a Slack summary that leads with how many licenses you could reclaim.

## What you'll need

- An Okta account with admin access, so the review can see your apps, your people, and your sign-in history.
- A Google Sheets spreadsheet with a tab for the review, which the workflow adds a row to each month.
- A Slack workspace and a channel where the monthly summary should land.
- Nothing else. The review only reads and reports, it never removes anyone's access.

## Prompt

On the first Monday of every month, run an access review of our Okta org so we can reclaim licenses we are paying for but not using. This is a read-only review. Do not deactivate any account and do not remove any app assignment. Everything you find goes into a spreadsheet and a Slack summary for a human to approve.

Start by using Okta List Applications to walk our app integrations, focusing on the active ones. For each app, use Okta List Application Users to pull the people assigned to it. Also use Okta List Users to pull profile details like account status, department, and job title, since that context is what lets you tell a real person apart from a service account.

Then use Okta List System Log Events to find each person's most recent successful sign-in. Query the log with explicit start and end times and page through the results. Okta keeps System Log history for 90 days by default, so the lookback window has to stay inside 90 days. If somebody has no successful sign-in event anywhere in the window, treat that as dormant rather than an error, and record it as no sign-in in the last 90 days instead of failing the run.

Flag two things. First, any account with no successful sign-in in the last 60 days. Second, any assignment where the person has never actually signed in to that specific app during the window, even if they are signing in to Okta generally. The 60-day threshold is the main knob in this workflow, so keep it in one obvious place that is easy to change to 30 or 90 days.

Then use judgement to separate genuinely reclaimable seats from accounts that are quiet for a good reason. Break-glass and emergency admin accounts are supposed to sit unused. Service accounts and integration users often never sign in interactively at all. People on parental or medical leave will look dormant but should keep their access. Use naming patterns, job titles, departments, and account status to make the call, and when a case is ambiguous say so instead of guessing. Give every flagged item a clear recommendation such as reclaim, keep, or needs review.

Append one row per flagged item to the review tab of our access review spreadsheet using Google Sheets Append Values. Each row should capture the review date, the person's name and email, the app, the days since their last successful sign-in, whether this is a dormant account or an unused app assignment, your recommendation, and a one-line reason. Append to the existing tab and do not overwrite what is already there, since the history of past reviews is the point.

Finally, post a summary to our IT channel with the Slack Send a Message action. Lead with the estimated number of reclaimable seats, since that is the number people care about. Then break it down by app, call out the biggest single opportunities, note how many items you set aside as expected quiet accounts and why, and point to the spreadsheet for the full detail. Close by making clear that nothing has been changed and that a human needs to approve the reclaims.

## How to customize

- Change the 60-day threshold. Thirty days is aggressive and good for expensive tools, ninety days is gentler for software people only use occasionally.
- Change when it runs. The first Monday of each month is the default, but quarterly works well if your license renewals are quarterly.
- Tell it which accounts to always leave alone, such as your break-glass admin logins, shared service accounts, and anyone currently on leave.

## Example output

Monthly Okta access review: 23 reclaimable seats

Dormant accounts (no sign-in in 60+ days): 9
Unused app assignments (assigned, never signed in): 14

Biggest opportunities:
- Figma: 6 seats assigned, nobody has ever signed in
- Salesforce: 4 accounts dormant 80+ days
- Zoom: 3 seats, last sign-in over 90 days ago

Set aside as expected quiet accounts: 7
(2 break-glass admins, 4 service accounts, 1 person on parental leave)

Full detail is in the Access Review tab. Nothing has been changed. These need your approval before anyone is deactivated or unassigned.

## FAQ

### Will this deactivate anyone automatically?

No. The review only reads your account and reports what it finds. Nothing is deactivated and no app access is removed. Every recommendation waits for a person to approve it.

### How far back can it look?

Okta keeps sign-in history for 90 days by default, so the review works inside that window. If someone has not signed in at all during that time, they show up as dormant with a note rather than causing an error.

### What about our service accounts and emergency admin logins?

Those are exactly the accounts this is built not to get wrong. They look dormant by nature, so they are called out separately as expected quiet accounts instead of being counted as savings.

### What if someone is on parental or medical leave?

They get flagged as quiet but with a recommendation to keep their access and a short reason why, so nobody loses their account while they are away.

### Do I need a separate compliance tool to run access reviews?

Not for a recurring internal review like this one. You get the dormant accounts, the unused app seats, and a written recommendation each month in a spreadsheet you already own.

Use this prompt in General Input: https://www.generalinput.com/prompts/monthly-okta-access-review-to-reclaim-unused-licenses