Identity line items were the single most over bought entitlement after unused Sales Cloud seats, and a mapping exercise moved 12 to 25 percent of the spend
The price per user is not the problem. The population attached to it is, and most of that population already holds the entitlement somewhere else.
Prepared by Redress Compliance · August 18, 2026 · Salesforce estate reviews. 20 to 30 estates reviewed, 2024 to 2025.
Executive summary
External blocks were sized for peak registration, leaving 30 to 50 percent of paid monthly active capacity dormant. Registrations are not actives, and only one of the two is billed for.
Internal users were assigned standalone seats they already held through their platform licence, a duplicate cost of 5 to 12 percent that no negotiation would ever have surfaced.
Verification credit packs expired unused in 2 of 5 estates, a pure write off of the entire prepaid amount rather than a partial one.
A disciplined mapping exercise moved 12 to 25 percent of the spend. Every lever here is an entitlement decision rather than a negotiation favour.
What is actually being licensed?
Three products covering three different populations. Getting the population right is the whole exercise, and it is done before any rate is discussed.
- Internal employees authenticate through the capability bundled in standard licences.
- External customers and partners are covered by the external product, billed on monthly active users.
- Step up checks are covered by verification credits, which expire.
Single sign on ships inside the core licence
You rarely need a separate purchase to enable it for employees who already hold a seat. The bundled internal entitlement is confirmed in the product documentation, which makes a standalone internal purchase a mapping error rather than a choice.
Why does monthly active sizing matter so much?
Because the external product sells in blocks of monthly active users, not registrations. A community with 100,000 registrations and 20,000 monthly actives needs the 20,000 tier, per the platform pricing page.
Estates sized to peak registration instead left 30 to 50 percent of paid capacity dormant. That is not a discount problem. It is a tier that was chosen against the wrong denominator.
| Lever | What it corrects | Where the waste sits |
|---|---|---|
| Deduplication | Internal users on standalone seats | A duplicate entitlement worth 5 to 12 percent |
| Active user sizing | External blocks matched to real monthly actives | 30 to 50 percent of paid capacity dormant |
| Credit pacing | Verification credits bought to consumption | Full write off where the pack expires |
The Salesforce licence optimisation brief
Strip the over bought lines out of the estate before the renewal prices them again.
Get the brief →What 20 to 30 Salesforce estates showed
Across roughly 20 to 30 Salesforce estates reviewed between 2024 and 2025, Identity line items were the single most over bought entitlement after unused Sales Cloud seats. Three patterns recur.
- External blocks were sized for peak registration, leaving 30 to 50 percent of paid monthly active capacity dormant.
- Internal users were assigned standalone seats they already held through their platform licence, a duplicate cost of 5 to 12 percent.
- Verification credit packs expired unused in 2 of 5 estates, a pure write off of the whole prepaid amount.
Every lever here is an entitlement decision rather than a negotiation favour, which is why mapping discipline beats discount chasing on this line.
- Your agreements decoded into plain English before the auditor interprets them for you
- Coverage grid: liability caps, intellectual property protections and service levels checked in one pass
- A defensible position paper generated in minutes rather than weeks
What happens to unused verification credits?
They expire. In 2 of 5 estates the pack ran out of time rather than out of credits, which writes off the entire prepaid amount rather than a proportion of it.
Pace credits to consumption, never ahead of it
Buying ahead of demand converts budget into an expiry date. The correct pattern is to buy against measured step up volume and top up, which costs marginally more per credit and far less per year.
Watch the briefing · 4:44Shrinking a Salesforce EstateWhere the entitlements you already hold make a purchase unnecessary.
What wins the renewal on this line?
Arriving with the mapping already done. Deduplicate the internal population, size external blocks to real monthly actives, and pace the credits, all before the quote is built rather than after.
Three corrections, no concession required
The three corrections together moved 12 to 25 percent of Identity spend in the estates reviewed, and none of them required a concession from the vendor. They required a list.
The wider entitlement picture, and where the rest of the over buying sits, is worked through in the Salesforce licensing guide and the Salesforce hub.
What the reviews measured, 2024 to 2025
Two cuts of the engagement file show where the money was already yours.
Where blocks were sized to peak registration rather than to the monthly active population that is actually billed.
Standalone seats assigned to internal users who already held the capability through their platform licence.
Neither figure came out of a negotiation. Both came out of comparing two lists that the estate already held.
Your first five moves
- List every internal user holding a standalone seat and remove the duplicates, since the capability is bundled in standard licences and the duplication ran 5 to 12 percent.
- Size external blocks to measured monthly actives rather than to registrations, which is where 30 to 50 percent of paid capacity was sitting dormant.
- Stop buying verification credits ahead of demand, because the packs expired unused in 2 of 5 estates and expiry writes off the whole prepaid amount.
- Check whether a separate purchase is needed for single sign on at all, since it ships inside the core licence for employees who already hold a seat.
- Bring the completed mapping to the renewal rather than a discount ask. The Salesforce practice runs the entitlement comparison before the quote is built.
Frequently asked questions
Which users need a paid Identity seat?
External customers and partners, billed on monthly active users, plus step up checks paid for in verification credits. Internal staff are usually covered already through their standard licence.
Do you need Identity for single sign on?
Rarely. Single sign on ships inside core licences, so a separate purchase to enable it for employees who already hold a seat is usually a mapping error rather than a requirement.
How are external users billed?
In blocks of monthly active users. A community with 100,000 registrations and 20,000 monthly actives needs the 20,000 tier, which is the correction most estates have never made.
How much capacity sits dormant?
Between 30 and 50 percent of paid monthly active capacity, in estates that sized their blocks against peak registration rather than against measured actives.
What is the duplicate internal cost?
Between 5 and 12 percent, from internal users assigned standalone seats they already held through their platform licence. It is invisible on a quote and obvious on two lists.
Do verification credits expire?
Yes, and in 2 of 5 estates the pack expired unused. Expiry writes off the entire prepaid amount rather than a proportion, so credits should be paced to consumption.
How much does the mapping exercise move?
Between 12 and 25 percent of Identity spend in the estates reviewed, without any concession from the vendor. Every lever is an entitlement decision rather than a negotiation.
Is discount chasing worth it on this line?
Less than mapping. The headline price per user matters far less than the population attached to it, and most of that population is already covered elsewhere.
When should the exercise run?
Before the renewal quote is built. A corrected population changes the tier and the block count, which is a different conversation from asking for points off the wrong number.
What is the second most over bought line?
This one was the most over bought entitlement after unused Sales Cloud seats, which is where the same discipline should be applied first.