Salesforce does not run software scans — it runs licence true-ups and usage reviews from telemetry it already holds about your org. The MSA reserves the right to compare provisioned user licences and feature entitlements against actual usage, then bill excess active users, over-limit API and storage consumption, and unlicensed feature or integration use. The claim almost always arrives at renewal, where Salesforce has the most leverage. In our 340+ engagements, buyer-side defence cuts the initial claim by 68% on average — and the biggest lever is the shelfware you are already paying for.
Yes — but not the way Oracle or SAP do. Salesforce is a multi-tenant SaaS platform, so there is no estate to scan; it already sees every active user, API call, data record and feature flag in your org. The Master Subscription Agreement reserves audit and usage-verification rights, and Salesforce exercises them as a licence true-up: it reconciles what you provisioned (the user licences and add-ons you bought) and what you are consuming (active users, API volume, storage, sandbox and feature usage) against your contract, then bills the difference. Because the data is already in Salesforce's hands, the defence is not about hiding usage — it is about controlling the interpretation and timing before the number is locked into a renewal.
The crucial point: a Salesforce true-up is a commercial event dressed as a compliance one. It almost always surfaces at or just before renewal, because that is when Salesforce holds maximum leverage and you hold minimum time. Treating the true-up as part of the renewal negotiation — not as a separate compliance fire-drill — is what changes the outcome.
Do not accept the provisioned-vs-active number at face value. We reconcile it first. Talk to us before you respond.
Salesforce licences are provisioned per named user and billed whether or not the person logs in. Over a multi-year term, leavers, role changes and over-optimistic seat purchases accumulate into shelfware — and at true-up Salesforce counts active users above your entitlement while you keep paying for inactive seats you forgot about. The defence works both directions: harvest the inactive and duplicate licences to free entitlement, and right-size the edition mix so people on Enterprise who only need read or platform access are not licensed at full Sales Cloud rates. Our Salesforce shelfware audit guide walks the harvesting process in detail.
| Exposure area | Salesforce's opening position | Defensible position | Driver of the reduction |
|---|---|---|---|
| Excess active users | Billed above provisioned count | Offset against harvested inactive seats | Login-activity analysis |
| Edition / licence mix | Full Sales Cloud assumed for all | Platform / read-only for eligible roles | Role-to-licence mapping |
| API call limits | Overage billed at add-on rates | Spikes scoped; integration patterns fixed | API consumption review |
| Data / file storage | Over-limit storage charged | Archived / right-sized before true-up | Storage audit & cleanup |
| Feature & add-on use | Unlicensed feature flagged as breach | Disabled or licensed at negotiated rate | Feature-entitlement reconciliation |
Salesforce's equivalent of SAP indirect access is the integration user and API limit question. Every org has a daily API call allocation tied to its licences; middleware, data syncs, and external apps writing to Salesforce can blow past it, triggering overage charges or a push toward more expensive integration licences. Two patterns drive most exposure: a single integration making per-record calls instead of bulk calls, and external users or community/Experience Cloud access provisioned without the right licence type. The defence is to map every integration to its call pattern and licence basis, fix the inefficient ones, and only then size what genuinely needs licensing — rather than accepting Salesforce's headline overage figure.
Add-ons compound it. Data Cloud consumption, Agentforce usage, CPQ, and Marketing Cloud all carry their own metrics, and usage that crept above entitlement during the term becomes a true-up line. Each needs validating against the contract before it is accepted, the same way an SAP engine metric does.
The shelfware-harvesting model, the licence-mix framework, and the true-up response checklist we use in live Salesforce renewals.
Salesforce times the true-up to renewal because the two are the same negotiation. If you settle the compliance number first and negotiate price second, you have already conceded the baseline Salesforce wanted. The defensible play is to reconcile the true-up and the renewal together: bring the harvested shelfware, the corrected edition mix and the contested integration overage to the table as offsets, and use the credible alternative of reducing seats or co-terming add-ons as leverage. Our Salesforce renewal negotiation guide and the Salesforce audit defence service cover how the two motions combine.
We defend the claim and negotiate the renewal as one motion — Salesforce uses both as leverage, so we do too.
We run a controlled process well before the renewal clock runs down. In practice: pull login and activity data to identify inactive, duplicate and over-licensed users; map roles to the cheapest entitlement that meets the need; audit API call patterns, storage and add-on consumption against the contract; reconcile Salesforce's provisioned-vs-active figure line by line; and bring the harvested entitlement and contested overage to the renewal as offsets, never as a separate concession. Throughout, the principle is the one that defines our firm — we represent the customer against the vendor, never both. We hold no Salesforce reseller agreement and take no vendor fees, which is what lets us contest the true-up rather than rationalise it.
For the licensing foundation, start with the Salesforce licensing guide pillar and the Salesforce license types breakdown; for the wider methodology, see our audit defence service and the cross-vendor vendor audit defence guide. A Salesforce true-up is rarely just a compliance exercise — it is the baseline for your next three-year contract. Treated as both, with independent buyer-side defence, the 68% average reduction becomes a renewal that protects the budget, not just the claim.
From shelfware harvesting to integration overage and add-on disputes, we defend the buyer side only.
Most teams learn a metric changed when the audit letter lands. Subscribers learn the month it happens, with the buyer-side response already mapped.