Software asset management fails at the asset layer before it fails anywhere else: an inventory that's incomplete, records that fragment across systems, applications nobody owns, and assets that never officially retire. These six practices fix that layer, in the order the dependencies actually run, because each one is only as good as the one before it.
Most SAM best-practice lists read like ten disconnected rituals: audit regularly, track licenses, review contracts. The rituals aren't wrong; they're unordered. Auditing a fragmented inventory verifies fragments. Tracking licenses against an incomplete app list optimizes the software you know about while the rest leaks. Sequence is the difference between a software asset management program and a set of well-intentioned habits.
So this list is ordered by dependency. Each practice makes the next one possible, and skipping one quietly caps the value of everything after it. One scope note: these are the asset-level practices, inventory, records, ownership, classification, lifecycle, retirement. The license-level discipline (seat reconciliation, tiering, renewals, reclamation) has its own dedicated treatment in our software license management best practices, and this article deliberately doesn't duplicate it.
1. Make the Inventory Complete Before Making It Accurate
Every SAM practice inherits the blind spots of the inventory it runs on, and the standard inventory has a big one: it covers what procurement bought and what a network scan can see, and misses everything that entered through the side door: apps expensed on corporate cards, free tiers that quietly converted to paid, tools connected by OAuth grant with no invoice anywhere.
Completeness therefore comes from signal breadth, not diligence. An asset should enter the inventory if any signal shows it in use:
- SSO and identity provider sign-in data
- Finance and expense transactions matching software patterns
- Direct application integrations
- MDM-reported installations, CASB traffic, directory and HRMS data
- Browser-level activity for apps that touch none of the above
The practical test of this practice: diff your procurement list against your SSO active-app list against twelve months of card transactions. The disagreements between the three are your unmanaged estate, and for most organizations running the exercise the first time, that estate is not small.
2. Keep One Record Per Asset, Not Five Fragments
The recurring failure mode after incompleteness is fragmentation: the ticketing system knows who requested the app, finance knows the cost, the security tool scores the risk, a spreadsheet holds the contract, and no single place connects them to the same entity. Every question ("should we renew this?") becomes a manual cross-referencing project, so the questions stop being asked.
The practice: one profile per application carrying users, licenses, contracts, spend, and risk together, plus whatever organization-specific fields you actually track (cost centers, compliance flags, internal tags). Two data-hygiene mechanics matter more than they sound:
- Deduplication discipline. The same app detected under two names ("Okta SSO login" and "Okta") splits its usage and spend across two records, understating both. Naming variants should fold into one record; genuinely duplicate records should merge, carefully and irreversibly-aware.
- Source-of-truth rules. When multiple discovery sources report the same asset, a defined precedence (direct integration over passive signals, manual entry over automation) keeps the record stable instead of flapping.
3. Give Every Asset a Named Owner, and Split the Role
An unowned asset is where problems age: nobody reviews its risk when the vendor has an incident, nobody questions its renewal, nobody notices its usage falling to zero. "The IT team owns it" is not ownership; it's diffusion.
The stronger version of this practice splits ownership by dimension, because one asset genuinely has different stakeholders:
- An administrative owner for classification and general stewardship
- A financial owner for budget, spend, and the renewal decision
- A security owner for risk posture and access review
Collapsing all three into one person either overloads them with questions outside their competence or, more commonly, leaves one dimension with no real accountable party. The test: pick any application and ask who decides its renewal and who answers for its risk. If both answers arrive without a meeting, this practice is working.
4. Classify Everything Into a Governance State
An inventory that lists assets without classifying them can't drive decisions. Every application should carry an explicit governance status, on the pattern of:
- Managed: approved, owned, and governed
- Unmanaged: in active use, never approved, decision pending
- Restricted: blocked, with attempts logged
- Needs review: newly discovered, awaiting evaluation
The classification is what turns discovery into governance: a newly found AI tool lands as needs review and gets a decision, instead of sitting in an undifferentiated list until it becomes a problem. And classification should be automatable at scale: rules that restrict a defined category on discovery, archive apps with zero active users, or flag pattern-matches for review, so the classifications stay current without a human re-reviewing the full list monthly.
5. Wire the Lifecycle Events, Because That's Where Assets Change
Assets don't drift on a schedule; they change at events. An employee joins, moves, or leaves. A contract renews. A tool's usage drops to zero. SAM programs built on periodic review are structurally late to every one of these, paying for the gap between the event and the next review.
The practice: attach the SAM actions to the events themselves.
- Onboarding assigns the role-appropriate stack at the role-appropriate tier, not a maximal default template.
- Role changes diff old-role against new-role entitlements and remove what no longer applies, which is the leak nobody watches: two role changes later, one person holds three departments' worth of software.
- Offboarding reclaims every application and license the person held, not just their SSO session. Accounts created outside the identity provider survive SSO-only offboarding, and they're the ones that show up in the next audit.
- Renewals trigger staged review sequences with enough runway to decide something, owned by the asset's financial owner.
6. Retire Deliberately, and Measure the Whole Thing
Every asset needs a managed exit. The signature SAM failure is the application that left the organization's needs but not its invoices: usage at zero, contract auto-renewing, accounts still active. Retirement discipline means: usage hits the archive threshold → the owner confirms → the contract terminates on schedule → the accounts close → the record archives with its history intact. An asset that exits the environment without exiting the inventory, or worse, exits the inventory while still billing, is this practice failing.
And close the loop with measurement. A handful of numbers tell you whether the five practices above are actually running: inventory completeness (discovered apps vs. procurement-known apps), percentage of assets with named owners, percentage classified, time-to-reclaim at offboarding, and assets retired versus assets gone stale. The fuller measurement layer lives in our guide to ITAM KPIs.
Where Tooling Fits
Each practice above survives manual execution at ten applications and dies at three hundred. This is what we built Zluri to run continuously: discovery across eight methods against a 240,000+ app catalog (practice 1), one complete record per application with matching, normalization, and dedup logic built in (practice 2), three distinct owner roles per asset (practice 3), four authorization statuses with scheduled rules automating classification (practice 4), license and access automation wired to joiner-mover-leaver events (practice 5), and archive-and-retire workflows with the full register exportable for audit evidence (practice 6). The comparison of SAM tools covers where we fit against the enterprise and ITSM-attached alternatives, honestly.
Frequently Asked Questions
How are SAM best practices different from software license management best practices?
They're two layers of the same discipline. Asset-level practices (this article) make the estate knowable and governable: complete inventory, unified records, ownership, classification, lifecycle, retirement. License-level practices optimize the money flowing through that estate: seat reconciliation, tiering, renewals, reclamation. The asset layer comes first because license optimization on an incomplete inventory only optimizes the fraction you can see.
What's the single highest-leverage practice to start with?
The inventory diff in practice 1: procurement records versus SSO active apps versus twelve months of expense transactions. It takes days, requires no new tooling, and produces the number (the size of your unmanaged estate) that justifies everything else to leadership. Every other practice is easier to fund once that number exists.
How do you keep asset ownership from going stale when people leave or change roles?
Treat owner assignments as lifecycle-managed data like everything else: an offboarding or role-change event should trigger reassignment of every asset the person owned, the same way it triggers license reclamation. Orphaned ownership is just another form of the undeprovisioned-asset problem, and it responds to the same event-driven fix.
Do these practices apply to on-premises software or just SaaS?
The practices apply to both; the mechanics differ. On-prem estates discover through scans and agents, and their retirement stage centers on uninstallation and entitlement re-harvesting. SaaS estates discover through identity and financial signals, and their retirement stage centers on contract termination and account closure. The sequencing logic (inventory, then records, then ownership, then lifecycle) holds either way.
.svg)
