Review SaaS Subscriptions

[SrinivasRamanu1]

SaaS Subscriptions are downloaded from respective SaaS portals such as Microsoft 365, Adobe, Zoom are many more.  Check the List of SaaS Subscription integrations that ServiceNow SAM Pro supports. Once the integration is completed the data on subscription is loaded into the subscription records.  SaaS Subscription records sometimes have issues related to unrecognized subscription identifiers, unresolved user resolution, missing subscription last activity, etc.

The following process would help you resolve them one by one with a clear explanation of the steps. 

Process Explanation

Activity S.No.	Activity	Activity Details
1.1	Review ingested subscriptions	Once the SaaS Integration is set up and ServiceNow has data on the subscriptions from the respective SaaS portals. It is important for SAM analysts/managers to review some key aspects:  Recommended Actions for SAM Managers/Analysts:  Check if there are any subscription job failures: this is to ensure that all ServiceNow jobs have successfully executed to get in the right data from the SaaS Portals  Check with the SaaS Portal admin (such as M365 admin) to determine if the total number of subscriptions match in the Portal and ServiceNow; this will ensure that ServiceNow has the entire set of data extracted from the SaaS portal  Review attributes of subscription records to determine if ServiceNow has pulled in the required attributes from the SaaS Portals. Check the details of which SaaS integration populates which data fields on the subscription records - Explanation of SaaS Subscription record fields  You may want to understand the M365 integration architecture in details here
1.2	Review subscription ingested with unrecognized subscription identifier	A subscription identifier is a technical reference (such as a SKU or service plan ID) retrieved from the SaaS portal. It specifies which product or service plan a user is subscribed to. ServiceNow uses these identifiers to automatically map the correct software model.  For example:  VISIOCLIENT → maps to Microsoft Visio Plan 2  ENTERPRISEPACK → maps to Office 365 E3  If a subscription identifier is unrecognized in ServiceNow, it is typically due to missing or outdated content on the platform.  Recommended Actions for SAM Managers/Analysts:  Update ServiceNow Content:  Ensure your instance has the latest content. ServiceNow updates its content weekly. Run the relevant scheduled jobs manually to fetch the latest content, and then re-run the subscription import job.  Enable Content Services (if still unrecognized):  If the subscription identifiers remain unrecognized, enable content services to automatically send this data to ServiceNow. Their team will research the identifier and provide a mapping in a future content update.  Manually Map the Identifier (Optional):  If you need a quicker resolution, you can manually map the subscription identifier to an existing software model in your instance. When ServiceNow identifies a mapping for an unrecognized subscription identifier, it will suggest a software model. You can then choose to accept or reject the suggestion. You can read about this here
1.3	Review unresolved users	The subscription information pulled from the SaaS Portal includes details of the subscription assigned to user, subscription assignment date, user principal name and many other details. These details are important to determine license compliance and provide recommendations to optimize.        One key aspect of the process includes resolving or matching the user on the SaaS Portal to the user on ServiceNow (sys_user). This process is important and helps in many downstream processes such as determining the right license compliance and providing correct optimization recommendations.    ServiceNow automatically performs this resolution as per a standard OOB process listed below   To understand the process of matching check here  However, in certain cases the auto resolution might not work due to reasons such as customers having a different column for user look up and might want to use it for look up instead of the out-of-the-box look up. There could be some valid reasons too wherein the license is not assigned to a human but rather to a non-human entity such as mailbox and for those there is no user resolution required.   Recommended Actions for SAM Managers/Analysts:  1. Check if the user is a human or non-human user: This can be achieved by going to Subscription without user list view and click on the discovered user field and thereby check the Nonperson account (if the user is a non-human user)  2. If the user is a human user, then check if the user details exist in the ServiceNow sys user table. If details don’t exist- there could be several reasons such as  a. User data not synced from active directory: Check with admin and confirm  b. Or the user may have left the organization: Check if the user has left the organization from HR and if yes ask your SaaS admin to remove the user from the portal  3. If user details exist in the sys user table and are still not getting matched, it is because the OOB matching was not successful. Herein you can configure some user resolution rules for the same. Read more about it here. Video for the same here
1.4	Review subscription conditions	Subscription conditions allow SAM Managers/analyst to include or exclude certain software subscriptions in reconciliation. They must be used with caution and if used incorrectly can lead to incorrect license compliance calculation  More details here  Recommended Actions for SAM Managers/Analysts:  Review your subscription conditions and make sure they are rightfully set.  Check your software model and apply the condition where the subscription condition is not empty
1.5	Review subscription with missing last activity	ServiceNow supports the last activity determination for most SaaS integration. The last activity helps ServiceNow provide recommendations to optimize usage such as recommendations to remove a subscription based on low usage or downgrade to a lower subscription.  Last activity does not have any bearing on determining license compliance but is important for license optimization  Recommended Actions for SAM Managers/Analysts:  Check the list here to confirm which integration supports last activity. There are some additional details to be aware of:  M365 integration: Supports last activity determination for products automatically without any external discovery tool  ServiceNow SAM Pro automatically determines the last activity of Products such as Exchange Online, Teams, One Drive, Power BI, Share Point Online, Viva Engage (formerly Yammer)   ServiceNow SAM Pro automatically determines the last activity across all Microsoft 365 Apps for Enterprise products comprising Microsoft Word, Excel, Power Point etc. (The last activity is gathered across Desktop, Web and Mobile without use of Discovery solutions)   Read about it here  However, there could be other M365 plans that you have for which last activity is not supported such as EMS, Power automate, Microsoft fabric etc. Please be aware that this is expected and the primary reason is due to non-availability of API from the SaaS vendor.   For Visio, project and Copilot last activity is not determined automatically however there exists a semi-automated way- follow this procedure here  Adobe Cloud Integration: Supports last activity determination but requires discovery solutions like SCCM  Note: All SaaS Solutions integrations support last activity determination (except CrowdStrike and Docu Sign)
1.6	Review reclamation rule threshold	The reclamation rules are auto created for SaaS integration with default for days before reclamation (3 days) and the last activity threshold (30 days). Review if this meets your expectations.  Recommended Actions for SAM Managers/Analysts:  Review the reclamation rules created automatically and adjust the days before auto reclamation, last activity threshold, subscription conditions, assignment group, or notify user. Read more about it here

Common FAQs on subscriptions:

Q1. How do i know if i have integrated with the SaaS portal and got all the required data fields?

Ans. We have a curated list of fields per SaaS integration that SAM Pro supports. Please find it here

Q2. What is the impact of not performing user matching or user resolution?

Ans. The impact will be on optimization recommendation as that SAM pro support. However, there will be no impact on user license compliance determination

Q3.  Do I need to create reclamation rules for SaaS subscriptions?

Ans. No reclamation rules are auto shipped for SaaS subscriptions. As a SAM analyst or manager you may want to edit them. For example change the days before auto reclamation, last activity threshold or other fields

Q4. In SaaS Integration do i need to create software models?

Ans. No. Once SaaS integrations  are setup they will auto create all required software models and thereafter you can add entitlements.

Q5. Can I manage license compliance for SaaS products like M365, Zoom without doing any integrations?

Ans. No. The details about user subscription and license assignment are available in the SaaS portal only. Hence, you are required to integrate to get these details for SAM Pro to determine correct license compliance and optimization recommendations

Q6. Do i need to create entitltement for SaaS Subscriptions?

Ans. Yes you have to create entitlements for SaaS Software products like M365, Adobe, Zoom etc. Sometime the purchase information is available on the SaaS portals, however due to inavailability of API Integrations SAM pro cannot get the purchasing information for all SaaS Portals. The exception here is M365 integration wherein SAM Pro is able to get the purchased information from the M365 portal into SAM Pro