License Reconciliation

License Reconciliation simplifies how businesses track and manage their software licenses across multiple applications with the single IT Hub login. Instead of relying on costly third-party audit tools or manual audits, the administrator users of IT Hub (“admins”) can now leverage their existing app integrations in IT Hub for onboarding or offboarding to gain real-time visibility into employee access.

To start using License Reconciliation, ensure all possible SaaS applications are connected via the available integration. The feature will automatically populate employee data in the app’s detail page once the connection is made.

Note: Electric IT Hub cannot avoid integration restrictions set by third party applications. Electric is dependent on factors such as additional payment, specific plans, security access, or the “sso tax” to successfully make the connect between IT Hub and the application.

How to Add License Reconciliation to an Application

From the left side menu, click on Applications in order to land in the Applications Table
Click on the application itself by clicking the name from the first column in the Applications Table
Navigate to the second tab in the application details page, called “Access”:
1. If not already connected, the prompt to connect the application from clicking the button will be present.
2. If already connected, the employees will appear without any additional action in the table.
The table can be filtered as desired or exported with the full data in the table.

How to View More Employee Metadata After Connecting Application

Navigate to the second tab in the application details page, called “Access”
1. If not already connected, the prompt to connect the application from clicking the button will be present.
2. If already connected, the employees will appear without any additional action in the table.
Click the button on the top right of the table called “Configure Columns”:
Select desired metadata columns to display. Columns available are unique to each application, it is expected each application will have data unique to that product.
The table can be filtered as desired or exported with the full data in the table.

Reading Employee Statuses in the Reconciliation Table

Employees can exist in a state of three statuses controlled by a filter on the table: Active, Inactive, Unknown.

Status	Defintion	Recommended Actions
Active	Employee is active in IT Hub and the employee email is matched one-to-one to an email in the SaaS app.	None required. This is the expected state. Export as needed to support with any compliance audits.
Inactive	Employee is inactive in IT Hub and the employee email is matched one-to-one to an email in the SaaS app.	Review as soon as possible. It is possible a former employee or contractor could be using a license/seat that may be repurposed or recouped. Remove the employee email from the SaaS app directly via the “final” removal action so that it is no longer active in any form in the app. This could be a `delete, disable, or remove` action, which will be unique to the app itself.
Unknown	An employee email is found in the SaaS app that is unknown to the IT Hub.	Review as needed. Confirm employees in this state should not be active employees with managed IT via IT Hub. If needed, add them as an existing employee and mark them as active. It may be expected that the email does not match to an IT Hub employee if the email is a group alias or a conference room. These cases can be ignored, or removed, as desired.

Please note, employees with a warning triangle (⚠️ ) indicate the employee was marked as offboarded in the IT Hub.

These are employees which should be reviewed in the SaaS application as soon as possible for the purpose of “final removal” – removing former employees can result in saving money on seats/licenses, and improving application security.

Granted by Group in the Reconciliation Table

Today, Groups in IT Hub should be used to support application management and setting expectations of who “should” have access to certain applications.

Groups streamline all IT operations – especially onboarding and offboarding processes – by organizing employees into customized groups which tailor the applications appropriate to the role, department, or level of those employees included in that group(s).

Because of this expected configuration, the last column in the reconciliation table is “Granted by Group.” This is the group which was pre-configured by an admin in IT Hub to have access to the application. Please use this column as additional decision making information to determine where application access can be optimized across the business.

Application Specific Troubleshooting

Review the below list of common errors with common applications to self serve troubleshooting.

Slack:

Slack has specific plans which are required to make an API connection for any purpose. The plans are “Business+” or “Enterprise”.
It is expected that the table of users will not appear unless the Slack account at the company is of those two plans.
To figure out what plan you are on, please see this article from Slack: https://slack.com/help/articles/218915087-Manage-your-Slack-plan-and-billing-details

Microsoft:

Depending on the configurations of your Microsoft workspace, there could be a high number of unknowns as the business email domain is different than the one used within the Microsoft tenant.
- For example:
  - The business email address is pablo@acme.co which is what is seen on the employee profile in IT Hub and utilized by the employee in day to day operations.
  - But the Microsoft portal is reporting pablo@acmeco.onmicrosoft.comas the email.
On creation of a Microsoft 365 workspace, Microsoft provides an onmicrosoft domain as a fallback domain in case the business does not own a specific domain, or does not want to connect the business domain to Microsoft.
To map the domains to a business domain or to learn more about this, please see this article from Microsoft: https://learn.microsoft.com/en-us/microsoft-365/admin/setup/add-or-replace-your-onmicrosoftcom-domain?view=o365-worldwide