Build the application register: name, purpose, owner, users, licence count, monthly cost, renewal date, payment method, sign-in method, data sensitivity. Most 20-person businesses discover two or three subscriptions nobody uses and one they cannot cancel because it is on a former employee's personal card.
Tie licences to the joiner-mover-leaver process. Every offboarding should walk the register, not just Microsoft 365. The ex-employee still logged into the CRM on their phone is the finding that makes an owner take you seriously.
Watch for shadow information technology: a department signs up for a file-sharing or artificial-intelligence tool with company data and a personal login. The answer is rarely a ban — it is providing a sanctioned equivalent and making the register a normal, blameless conversation.
Review the register quarterly with the owner. Cancel what is unused, consolidate what overlaps, and note the renewal dates in a shared calendar. This is the work that pays for your seat at the table.