sentavo works ← ./tools
tools/license-waste-finder

How many licences are you paying for that nobody uses?

Read-only look at your Microsoft 365 licensing against reality: licensed accounts that haven't signed in, disabled accounts still holding licences, and purchased seats never assigned to anyone — with an indicative annual dollar figure on the waste. Every centavo spent should work. Rendered in your browser; nothing sent to us.

license-waste-finder --sign-in
Delegated read-only permissions: User.Read.All · AuditLog.Read.All · Organization.Read.All Only hosts contacted: login.microsoftonline.com · graph.microsoft.com Verify it: DevTools → Network while this runs

Sign in with a work account holding a reader role (Global Reader covers all three reads). Sign-in activity via Graph requires the tenant to have at least one Entra ID P1 licence.

unassigned purchased seats

skupurchasedassignedunassignedest. waste /yr

licensed but inactive or disabled top offenders

accountstatelast sign-inlicencesest. /yr

Reclaiming licences is the easy half — the fixed-price assessment also finds the features you're paying for but never turned on → ./view pricing

questions before you sign in

▸What exactly am I consenting to?
Three delegated, read-only Microsoft Graph permissions: User.Read.All (user list, assigned licences, sign-in activity), AuditLog.Read.All (required by Graph for the sign-in activity field), and Organization.Read.All (your subscribed SKUs — names, purchased vs assigned counts). None of them can change anything in your tenant.
▸Are the dollar figures real?
They're indicative — approximate AUD list prices for common SKUs, annual commitment, ex GST. Your CSP pricing will differ. SKUs we don't have a price for count in seat totals but show "—" in dollars, so the true waste figure is usually higher than shown. Verify against your actual invoice before acting.
▸How do I verify nothing leaves my browser?
Open DevTools (F12) → Network, then run the tool. You'll see login.microsoftonline.com and graph.microsoft.com — nothing else. No calls to us, no analytics. User lists and licence data render locally and vanish when you close the tab.
▸What are the caveats on "inactive"?
"Inactive" means no interactive (human) sign-in in the window. "Bg auth only" means the account had token or background authentication but no human sign-in — sometimes a real user on a cached mobile session, often a provisioned-but-unused account; verify before reclaiming. Blank last sign-in can mean never signed in or before the log horizon. Treat the list as a review queue, not a deletion script.
▸How do I revoke access afterwards?
Entra admin centre → Enterprise applications → Sentavo Tools → Delete. The session token dies with this tab.

Reads /users (with signInActivity), /subscribedSkus via Microsoft Graph, delegated read-only. Caps at 5,000 users and notes truncation. Pricing indicative — see FAQ. Nothing is transmitted or stored by this site.