Software as a service is the right default for email, documents, accounting, payroll, support desks and most line-of-business tools. You are not going to run a mail server better than Microsoft or Google, and pretending otherwise costs money. What SaaS does not do is remove your responsibilities. It moves them from uptime to three less obvious jobs: controlling who has access, keeping your own copy of your data, and noticing when the price changes. Two of those three are where small businesses lose money in 2026, and the third is where they occasionally lose the business.
What SaaS changes about your responsibilities
The usual explanation of SaaS is a layer diagram: the provider runs the hardware, the operating system, the database and the application, and you just log in. True, and not very useful. The useful version is a list of what moves off your plate and what lands on it.
Off your plate: patching, capacity, hardware refresh, backup of the platform, and most availability engineering. Genuinely gone, and worth paying for. A provider running a globally distributed mail service will beat your on-premises Exchange box on every metric that matters, including the one where you are on holiday.
Onto your plate, in rough order of how often it goes wrong:
- Identity and offboarding. Every application is now reachable from any internet connection with a password. When someone leaves, the question is not whether you collected their laptop, it is whether their access to nineteen services ended the same afternoon.
- Your data, in your possession. The provider backs up its platform so it can recover from its own failures. That is not the same as restoring the folder your colleague deleted eight weeks ago, and retention windows are shorter than people assume.
- Commercial drift. Prices rise, tiers get repackaged, consumption-based AI features appear on the invoice. Somebody has to read the notice emails.
- Configuration. Sharing defaults, external guest access, retention policy, audit logging. The provider secures the platform; you configure your tenancy, and most SaaS incidents begin with a setting rather than a breach.
- Vendor risk. A supplier with access to your customer data is part of your attack surface and part of your compliance story.
Notice that none of those is technical in the hard sense. They are administrative habits. That is why small businesses struggle with SaaS governance: the work is dull, nobody owns it, and the consequences arrive eighteen months later.
The July 2026 price reset nobody budgeted for
On 4 December Microsoft announced a global price and packaging update for selected Microsoft 365 commercial suites, with pricing taking effect on 1 July 2026 and packaging changes rolling out from June 2026. Existing customers stay on current pricing until renewal, and Microsoft committed to at least 30 days notice in the Message Center before packaging changes appear in a tenant. Here are the published figures for the suites most small businesses buy.
| Microsoft 365 SKU (with Teams) | Old list price | New list price | Change | Who it suits |
|---|---|---|---|---|
| Microsoft 365 Business Basic | $6.00 | $7.00 | +16% | Web and mobile apps only, up to 300 users |
| Microsoft 365 Business Standard | $12.50 | $14.00 | +12% | Desktop apps, up to 300 users |
| Microsoft 365 Business Premium | $22.00 | $22.00 | no change | Desktop apps plus device management and security |
| Office 365 E3 | $23.00 | $26.00 | +13% | Enterprise productivity without the security stack |
| Microsoft 365 E3 | $36.00 | $39.00 | +8% | Enterprise productivity with security and device management |
| Microsoft 365 E5 | $57.00 | $60.00 | +5% | Everything, including advanced security and analytics |
| Microsoft 365 F3 (frontline) | $8.00 | $10.00 | +25% | Shift and frontline staff |
Two conclusions worth acting on. First, Business Premium held at USD 22.00 while the tiers below it rose, which narrows the gap considerably. If you were running Business Standard at USD 12.50 and buying device management or conditional access separately, the Premium maths has quietly improved. Second, the frontline tiers took the biggest proportional increases — F1 up 33% from USD 2.25 to USD 3.00 — so organisations with a lot of shift workers should recount before renewal.
For comparison on the other side of the market, Google publishes its Workspace pricing per user per month and its own support documentation works through a Flexible Plan example at USD 8.40 per user for Business Starter, which for seven users bills at USD 58.80 a month. Flexible billing costs more than an annual commitment, which is the trade you are making for being able to reduce seats any month.
- Count actual active users, not the seats on the invoice. Leavers and duplicates are the easiest money you will find all year.
- Check whether the tier above yours now bundles something you buy separately. The 2026 repackaging moved several of these lines.
- Decide annual versus flexible deliberately. Annual is cheaper; flexible lets you shrink. Pick per team, not for the whole company.
- Ask for the switching and exit assistance terms in writing while you still have negotiating leverage.
Where the licence money actually leaks
Zylo’s 2026 SaaS Management Index, published on 29 January 2026 and built on analysis of more than 40 million SaaS licences and USD 75 billion of spend under management, is the most useful public benchmark for where SaaS money goes missing. The findings are uncomfortable in a familiar way.
The licence waste figure gets the headlines, and it is real money: a third of every SaaS line item, in an estate costing roughly USD 9,455 per employee per year. For a forty-person company that is a meaningful number sitting in plain sight. But the governance findings matter more over time. When business units control 81% of spend and IT directly manages 15%, nobody holds a complete inventory, which means nobody can answer a security questionnaire honestly or spot the duplicate tool two departments bought.
The newest leak is consumption pricing. Zylo found expense-based SaaS spend up 267% year on year, with ChatGPT now the most expensed application, and AI-native application spend up 108% overall. These purchases arrive on personal cards and expense reports, which means they bypass procurement, security review and the renewal calendar simultaneously. The fix is not a ban. It is a lightweight intake process and an owner for every application.
The responsibilities you cannot hand over
Four responsibilities stay yours no matter how good the provider is. Treat them as a short checklist rather than a programme.
- Single sign-on and a leaver process. Federate every application you can to one identity provider, so disabling one account closes every door. Keep a written list of the applications that cannot be federated, because those are the ones that will still be open in a year.
- Your own copy of your data. Export mailboxes, files and the records in your core business systems on a schedule you control, to storage you control. Then restore one of them. An untested export is a hope, not a backup.
- Configuration review. Once a quarter, check external sharing defaults, guest access, retention policy and audit log retention. These drift as providers add features, and the defaults are chosen for convenience rather than for you.
- An inventory with owners. One sheet: application, business owner, what data it holds, renewal date, annual cost, whether it is federated. Dull, and it answers nine out of ten questions a customer’s security review will ask.
The provider guarantees the platform will be up. Nobody but you guarantees you can get your data back out of it.
On availability, be realistic about what a service level agreement buys. A 99.9% monthly target permits roughly 43 minutes of downtime a month, and the compensation for missing it is typically a service credit worth a fraction of a month’s fee — not your lost revenue. SLAs are a statement of intent and a refund policy. They are not insurance, and they are certainly not a substitute for knowing how your business operates for an afternoon without the tool.
Getting out: portability, contracts and the Data Act
Exit planning for SaaS is less about technology than about two paragraphs in a contract and one regulation. The regulation is the EU Data Act, Regulation (EU) 2023/2854, which has applied since 12 September 2025 and gives customers of data processing services a right to switch, with provider assistance. Under Article 29, all switching charges are prohibited outright from 12 January 2027.
If you are in or selling into the EU, that changes your negotiating position now rather than in 2027. Ask three questions before you sign anything: what formats can we export our data in, how long do we retain access after termination, and what assistance do you provide if we move? Get the answers in the contract rather than in a sales email.
The technical side is simpler than people fear for commodity tools and harder than they hope for the ones that matter. Email and files move well. Accounting ledgers, support desk history and anything with workflow automation built around it move badly, because the data exports but the behaviour does not. The practical rule: the more configuration you have built inside a SaaS tool, the more expensive leaving it becomes, regardless of what the export button offers.
A quarterly review that takes two hours
Put two hours in the calendar once a quarter. One person, one spreadsheet. This is the whole governance process a business under two hundred people needs.
- Pull the last three months of card and bank statements and search for software charges. Add anything that is not already on the inventory, including whatever arrived on an expense report.
- For each application, compare licence count to active users. Cancel or downgrade the gap. This is where the 36% lives.
- Check the next two quarters of renewal dates and diary a reminder 60 days before each one. Renewal negotiation happens before auto-renewal, not after.
- Confirm every leaver since last quarter is gone from every system, not just the identity provider.
- Restore one export. A single mailbox, a single folder, one month of records. Rotate which one each quarter.
- Note any new consumption-based or AI line items and set a spend alert if the vendor supports one.
That is it. Nothing in that list requires a platform, a consultant or a project. If you would rather it happened reliably without you remembering, that is part of what our cloud solutions work covers, delivered remotely. For the layer underneath, our deep dive into platform as a service explains where SaaS ends and your own applications begin, getting started in cloud technology is the practical on-ramp, and the cloud career guide covers who ends up owning this work.
Frequently asked questions
Is SaaS cheaper than running software ourselves?
Per user per month, usually yes, once you count the staff time, hardware and patching you no longer do. Over five years with a large user count it can flip, which is why some organisations repatriate specific workloads. The honest answer for a business under two hundred people is that SaaS is cheaper and better for commodity software, and you should spend the saved effort on governance rather than on hosting your own mail.
Do we still need backups if the provider has redundancy?
Yes. Provider redundancy protects against their infrastructure failing. It does not reliably protect against a user deleting a folder, a ransomware event inside your tenancy, a malicious insider, or a billing dispute that suspends access. Retention windows are also shorter than most people assume. Keep your own exports and test a restore quarterly.
Our Microsoft 365 price went up. Can we do anything?
Existing customers stay on current pricing until renewal, so you have until then. Before renewing, recount active users, check whether the tier above now bundles something you buy separately — Business Premium held at USD 22.00 while the tiers below it rose — and compare annual against flexible billing per team rather than for the whole company.
How do we control software bought on expense reports?
Make the approved route faster than the unapproved one. A simple intake form with a 48-hour answer beats a policy nobody reads. Then reconcile card statements quarterly and assign every application a named business owner. Zylo found expense-based SaaS spend up 267% year on year, so this is now the main channel rather than an edge case.
What does the EU Data Act mean for our SaaS contracts?
Regulation (EU) 2023/2854 has applied since 12 September 2025 and gives you a right to switch data processing services with provider assistance, with all switching charges prohibited from 12 January 2027. Practically: ask for export formats, post-termination data access periods and switching assistance in writing, and keep those clauses with your inventory.
Want an inventory of what you are actually paying for, and a quarterly review that happens without you chasing it? Get in touch with Eudora Technology to talk about your project.
Sources
- Microsoft 365 commercial pricing and packaging updates, effective 1 July 2026
- Zylo’s 2026 SaaS Management Index
- Google Workspace billing and subscriptions: Flexible Plan pricing example
- Data Act policy page
- Flexera finds cloud value is rising while AI waste grows
- Flexera 2026 State of the Cloud Report: the convergence of cloud and value
