Microsoft 365
VerifiedGive an agent bounded Microsoft 365 subscription and activity evidence while keeping licence changes, identity privacy, and final renewal decisions under human control.
What you can do
- Inventory purchased, consumed, available, suspended, and warning units by Microsoft SKU.
- Join directory assignments to supported active-user reports only when identity privacy allows it.
- Build caller-priced renewal evidence without granting licence-write permission.
Tools powered by Microsoft 365
Getting started
Use a single-tenant Entra app with LicenseAssignment.Read.All, User.Read.All, and Reports.Read.All application permissions plus tenant-admin consent.
Cost
Microsoft Graph does not publish a separate per-request charge for these reads; ToolRouter charges the displayed skill price and failed paid calls do not charge.
Coverage and things to know
- One run is capped at one tenant, 10,000 users, 11 pages, and one D7, D30, D90, or D180 active-user report.
- Concealed Microsoft report identities remain concealed and disable per-user inactivity joins.
- The integration never requests LicenseAssignment.ReadWrite.All or calls a licence, user, or privacy-setting mutation.
Source documentation: Microsoft Graph subscribed SKUs, Microsoft 365 active-user report, Microsoft Graph client credentials
Frequently Asked Questions
Can an AI agent find unused Microsoft 365 licences?
It can find reason-coded review candidates from disabled-account and joinable activity evidence, but inactivity never proves a licence is unnecessary and every change requires human approval.
What Microsoft Graph permissions are required?
The tool uses LicenseAssignment.Read.All, User.Read.All, and Reports.Read.All application permissions and does not request licence-write access.
How are Microsoft 365 savings calculated?
Only caller-supplied contracted monthly SKU prices are used; public list prices are never substituted for the customer invoice.