Skip to content
LicenseMeter
Start

Connect Microsoft 365 to LicenseMeter.

Connect via API

Microsoft 365 is the core directory LicenseMeter reads to find license waste. Most teams use the managed one-click path: a Global Administrator grants read-only application permissions once. If you prefer to own the app registration, the BYO path takes your own Entra app's credentials, stored encrypted and used only for the nightly read-only sync.

Setup, step by step.

  1. Managed (recommended): one-click admin consent

    On the Microsoft connector page, choose Grant admin consent. A Global Administrator approves LicenseMeter's read-only application permissions for your tenant in the Microsoft dialog. Nothing is stored on your side and nothing is ever written to your tenant. This is the default and needs no app registration.

  2. BYO (advanced): create your own app registration

    Prefer to own the credential? Run the setup-byo-connector.ps1 script (Microsoft.Graph PowerShell module required) as a Global Administrator of your tenant. It creates a single-tenant, read-only app registration with exactly the application permissions LicenseMeter requires, grants admin consent, and prints your Directory (tenant) ID, Application (client) ID and a client secret to paste. Add -UseCertificate to register a certificate instead.

    Register an application in Microsoft Entra ID (official documentation)

  3. BYO manual route (portal)

    If you cannot run the script: in Entra ID > App registrations, create an app (single tenant). Under API permissions add the exact application permissions LicenseMeter lists on the connector page (all read-only), then Grant admin consent. Under Certificates & secrets create a client secret (or upload a certificate). Paste the tenant ID, client ID and the secret (or the certificate private key and certificate, both PEM) into the connector's Advanced section. The least-privilege rationale: every permission is *.Read.All and scoped to directory, license and usage-report reads only - no write scopes, no mail or file content.

    Grant admin consent to an application (official documentation)

  4. Verify

    On save, LicenseMeter acquires an app-only token and checks the token's roles claim contains every required permission, showing a green/red row per permission and blocking the save if any are missing. It also runs one live call against the usage Reports API. Switching between managed and BYO re-points the sync with no data loss.

What it finds.

  • Licenses assigned to accounts that are disabled in Entra ID.
  • Licenses nobody has signed into for your inactivity threshold.
  • Overlapping plans and shelfware across your subscribed SKUs.

What LicenseMeter reads

  • Directory users: name, UPN, enabled state and assigned licenses
  • Subscribed SKUs: purchased vs assigned seat counts
  • Sign-in activity (with Entra ID P1) and usage / Copilot activity reports
  • Whether report display names are concealed (a tenant setting)

What it never reads

  • Mailbox, calendar, Teams, OneDrive or SharePoint content: no content scopes are requested
  • Anything writable: every permission is read-only (*.Read.All)

Credentials are validated against the vendor before anything is stored, encrypted at rest (AES-256-GCM), used read-only and deleted the moment you disconnect. Data lives in the EU (Postgres, Frankfurt). The security overview covers the full picture.

Ready in a few minutes.

Open the connector page in your workspace, or walk through the live demo first to see the findings this connector produces.

Open the Microsoft 365 connector

Opening the connector signs you in with Microsoft first.