Extending SAM
About 15% of the CIS-SAM exam — see all 5 domains.
SAM for SaaS / SaaS License Management
SAM extends beyond on-prem installs to SaaS subscriptions. SaaS License Management integrates with cloud providers, most notably Microsoft 365 (Office 365) and Adobe Creative Cloud, to pull subscription entitlements and actual usage (active vs. inactive accounts, last-activity). The value is identifying unused or under-used SaaS subscriptions for reclamation/downgrade and right-sizing renewals, mirroring on-prem reconciliation but for subscription seats. Dashboards (e.g., the Office 365 & Adobe Cloud dashboard) and the license usage view / workbench surface optimization candidates. Compliance compares the rights you own with assigned subscriptions (true-up cost); activity thresholds in reclamation rules flag stale subscriptions for reclamation.
Publisher packs
Publisher packs are add-on plugins (for example Adobe, Citrix, IBM, Microsoft, Oracle, SAP, VMware, and Engineering Applications) that add publisher-specific license metrics, reconciliation logic, and Software Publisher Analytics dashboards for complex licensing (for example Oracle options or IBM PVU). They do not supply normalization content; normalization comes from the normalization library and Content Service updates.
Software model lifecycle and retirement
SAM keeps lifecycle data for products and versions as phases such as General Availability, End of Support (EOS), End of Extended Support, and End of Life (EOL), often supplied by the Content Service. This drives risk reporting (unsupported software), refresh planning, and model retirement.
CMDB / CSDM alignment
SAM data must align to the Common Service Data Model (CSDM): software installs reference host CIs, and software models map cleanly. Good CSDM/CMDB alignment is what makes per-core, virtualization, and reclamation calculations trustworthy.
Exam traps (Domain 5)
- SaaS management uses actual usage / activity to find waste, not just seat counts.
- Publisher packs improve accuracy for specific vendors; they are not generic.
- Lifecycle (EOL/EOS) is largely content-driven and is recorded as product and version lifecycle phases.
Sample questions from this domain
Three of the 45 in this domain, with the reasoning. The full set is in the question bank.
What does SAM for SaaS extend SAM to manage?
- A. Cloud-based subscription software and its usage, spend, and license optimization ✓
- B. Software running on public cloud VMs that is licensed under bring-your-own-license rules
- C. Installed desktop applications found on endpoints, with their install counts
- D. Hardware lifecycle of the laptops that employees use to reach cloud apps
Why: SAM for SaaS (SaaS License Management) extends SAM to cloud subscription applications: who holds a subscription, whether they use it, what it costs, and where seats can be reclaimed or right-sized. Software running on public cloud VMs under bring-your-own-license rules is on-premises style licensing handled by core SAM and publisher packs, not SaaS subscription management. Installed desktop applications and their install counts are what base SAM already manages through discovery and reconciliation. Laptop lifecycle is Hardware Asset Management.
How can SAM identify unused SaaS subscriptions to reduce cost?
- A. By integrating with SaaS providers/SSO to collect usage and flagging licenses with little or no activity ✓
- B. By running endpoint Discovery and flagging SaaS apps that have no local installation record on any device
- C. By importing financial transactions and flagging subscriptions that had no invoice in the last 90 days
- D. By reading SCCM software metering for browser executables and counting SaaS sessions for each user
Why: Unused SaaS seats are found from activity: direct integrations with the SaaS vendor and SSO integrations supply per-user sign-in and usage data, and reclamation rules flag subscriptions whose activity falls below the threshold. Endpoint Discovery cannot see browser-based SaaS, so a missing install record says nothing about whether a seat is used. Financial transactions (Software Spend Detection) reveal what was purchased and spent, not whether anyone uses the seat. SCCM metering records usage of installed executables; browser process time does not identify which SaaS app or subscription was used.
What is the purpose of integrating SAM with single sign-on (SSO) providers for SaaS management?
- A. To import purchased subscription quantities so SaaS compliance positions can be calculated
- B. To calculate true-up cost by comparing owned rights with active login sessions per app
- C. To capture application access and usage signals across SaaS apps for optimization ✓
- D. To replace endpoint Discovery as the source of installed software records for SaaS
Why: An SSO (identity provider) integration tells SAM which SaaS applications users sign in to and when, giving access and activity signals that drive stale-seat reclamation and expose unmanaged apps. Purchased quantities are owned rights recorded on entitlements, not something an identity provider reports. True-up cost compares owned rights with assigned subscriptions, not with login sessions. SSO data does not create installed software records and does not replace endpoint Discovery.