SEP Manager should be able to refuse to allow a client (Mac, PC, Linux, whatever) to connect, thereby invalidating the client software without removing it from the client machine. There are situations where SEP clients are installed on BYOD's and the owner leaves the company, taking their personal device with them and not permitting the company to withdraw/uninstall the SEP client that belongs to the company.
As it is now, that machine can continue to check in with the SEP Manager and get signature updates for as long as the client software is installed. This uses one of the licenses the company purchased for someone who is no longer employed by the company. That license cannot be redeployed on another company machine until that non-company-owned machine stop checking in.
SEP Manager should be able to refuse a connection or disable the client software so that the license can be used again internally. This is not currently possible. The ONLY way that an existing license can be reused, is to remove the client software so that it cannot check in with the SEP Manager. There are times when this cannot be done, BYOD being a clear example.