EN DE
Home
Solutions Optimization Service FinOps Zation Platform CSP
Portal CSP Portal CHF CSP Portal EUR Zation Platform
Insights Blog Success Stories
About us Contact
Guide

Microsoft 365 license management tools compared

Five categories of tools for finding unused licenses, compared on the criteria that decide whether a saving happens.

Which tools find unused Microsoft 365 licenses?

Five categories do: the built-in admin center reports, scripts on the Graph API and PowerShell, Microsoft 365 SaaS management tools, multi-cloud FinOps platforms and Microsoft-specialized FinOps platforms. They differ in depth, in Azure coverage and in how much work stays with you.

The question is usually phrased as a product search. It is better answered as a category choice, because the categories differ in what they can see and who does the remaining work. This article compares categories and names no competitor. Verify each product against your own requirements and its current documentation.

CategoryWhere it fitsWhere it stops
1. Admin center reportsFree, immediate, per-user last activity per serviceLimited history, no recommendations, no Azure
2. Graph and PowerShell scriptsFull control, any report you can define, your own storageYou build and maintain it. No workflow around the findings.
3. Microsoft 365 SaaS management toolsLicense and application inventory with workflows around assignmentAzure and commitments are usually outside scope. Verify per product.
4. Multi-cloud FinOps platformsCloud spend across providers, allocation and anomaly workMicrosoft 365 license depth varies. Verify per product.
5. Microsoft-specialized FinOps platformsMicrosoft 365 and Azure in one model, including contract logicNot built for other clouds or non-Microsoft SaaS

The rest of the article takes the categories in order, then sets out the criteria we use to compare them. If you are still deciding what counts as waste, start with our guide to finding and reclaiming unused Microsoft 365 licenses.

What do the free admin center reports show, and where do they stop?

They show per-user last activity for Exchange, OneDrive, SharePoint, Viva Engage and Teams (Active users report) and for the Microsoft 365 desktop and web apps (separate Microsoft 365 Apps usage report), over 7, 30, 90 or 180 days. They do not recommend anything, do not keep history beyond the window, and hide user names by default.

Microsoft's usage reports overview and the Active users report describe what you get. Office app activity sits in a separate Microsoft 365 Apps usage report. The per-user table lists the last active date per service and whether a license is assigned for it, and you can export it to a CSV file. Microsoft states that data usually covers the last 24 to 48 hours, and that the last activity date is the most recent date on which the user performed an intentional activity, regardless of the selected period.

Four limits matter for license work.

  • Window. Trends cover 7, 30, 90 or 180 days. A seat that is quiet for nine months looks the same as one quiet for six, unless you stored last year's exports.
  • Privacy default. User names, groups and sites are concealed by default. An admin must switch that setting to see who is who.
  • Deleted users. Microsoft deletes a removed user's usage data within 30 days, so the history of leavers goes with them.
  • No judgment. The report says what happened. It does not say which plan the user needs, or what a change is worth in CHF.

For a first look, the reports are the right tool. In our experience, the first idle seats usually show up here. Beyond that, the need for history, plan fit and cost per user pushes you to another category.

When do Graph and PowerShell scripts make sense?

They make sense when you have an engineer with time, a specific question the reports do not answer, and a need to keep data under your own control. They give you the same data as the reports through an API, plus sign-in data if you hold Entra ID P1 or P2.

Microsoft's Graph reports API overview lists the same data sets as the admin center, including Microsoft 365 active users, app usage, Teams, OneDrive, Outlook and SharePoint. The active user detail report returns a CSV with, per user, license flags and last activity dates per service, plus assigned products. With a scheduled script you can snapshot it monthly and build the history the portal does not keep.

Sign-in data comes from a different source. The guidance on inactive accounts states that accessing the last successful sign-in through Microsoft Graph requires an Entra ID P1 or P2 license, and the least privileged role to read the activity logs is Reports Reader. The sign-in timestamp can take up to 24 hours to update. Do not treat it as proof that a seat is needed: a user who signs in but never opens the app a plan pays for still holds a surplus license.

The costs of this route are not in the license. Someone writes the script, handles throttling, stores the data, defines what idle means and rebuilds the logic when Microsoft changes a report. And the output is a table, not a decision workflow. Scripts are a good fit for a one-off analysis or for teams with strong engineering capacity. They are a poor fit when the owner of the licenses is finance or procurement.

What criteria should you use to compare tools?

Use six: how the tool reads your data (read-only or not), how deep its activity evidence goes per app, whether it covers Copilot, whether it covers Azure, where it is hosted and how it handles data residency, and how it is priced.

CriterionWhy it mattersWhat to ask
Data accessA tool that only needs read permissions cannot change your environment by mistake or by attack.Which Graph permissions are requested, and are they all read-only?
Activity depth per appSign-in is a weak signal. Per-app activity shows whether the plan's apps are used.Is activity per service and per user, and over what history?
Copilot coverageA Copilot seat is a per-user add-on cost, so idle seats add up quickly.Does it show assigned seats against use, per user?
Azure coverageLicenses and cloud commitments are one budget for many finance teams.Does it cover reservations, savings plans and rightsizing, or only Microsoft 365?
Hosting and data residencyThe analysis reads names, plans and activity. For Swiss organizations the revDSG applies.Where is the data stored, who are the sub-processors, how long is it kept?
Pricing modelA fee that rises with your spend rewards the wrong behavior.Per user, per spend, flat or success based? What happens when you reduce seats?

On the Copilot row, Microsoft's own Copilot Chat usage report currently supports only users without a Microsoft Copilot license, so it does not answer the question of whether a paid seat is used. Check where your chosen tool gets that evidence. Our Copilot licensing guide goes into what a seat costs and how to measure it.

How do SaaS management, multi-cloud FinOps and Microsoft-specialized platforms differ?

They differ in scope. SaaS management tools center on applications and assignments, multi-cloud FinOps platforms on cloud spend across providers, and Microsoft-specialized platforms on Microsoft 365 and Azure together with the contract logic behind both.

We keep this section deliberately general, because products change and we do not make claims about named competitors.

Microsoft 365 SaaS management tools usually start from an inventory of applications and the assignment of licenses to people, with workflows for requests and offboarding. They are strong where Microsoft 365 is one SaaS among many. Ask how deep the Microsoft 365 plan analysis goes, and whether Azure is in scope.

Multi-cloud FinOps platforms start from cloud billing data across providers: allocation, anomalies, commitment coverage. They are strong where Azure is one cloud among several. Ask how they treat Microsoft 365 licenses, agreement types and commitments such as an Azure consumption commitment.

Microsoft-specialized FinOps platforms trade breadth for depth: one vendor's licensing, one vendor's cloud, one vendor's contract mechanics. They suit organizations whose spend is mostly Microsoft. They are not the right choice if the main goal is to govern AWS or Google Cloud.

Whatever the category, three questions separate a dashboard from a tool that saves money: does it work per user, does it know your agreement, and does it support the decision to act? The reclaim itself runs against Microsoft's rules. In CSP, for example, licenses can be reduced only within seven days of purchase or renewal, so a finding is only worth the time left to act on it.

Where does the Zation Platform fit?

The Zation Platform is a Swiss-hosted, strictly read-only FinOps platform for Microsoft 365 and Azure, in the Microsoft-specialized category. It surfaces inactive licenses, double licensing and downgrade candidates per user, and routes each action through Skip, Plan, Approve and Realized.

We state the facts that our own platform page documents, and nothing about other vendors. Access is strictly read-only: the platform never changes your environment. You set up the Enterprise App with read-only access, and the daily sync then runs by itself, which in our experience takes you from invitation to usable data in under a day. The platform covers Microsoft 365, Azure and GreenOps, and it is hosted in Switzerland.

On licenses, it shows assigned SKUs, real usage, role profiles and cost per user, department and location, including Copilot seats. It flags inactive and orphaned licenses, downgrade candidates and double licensing, such as a standalone Entra license on an E5 user. Each recommendation runs the closed loop Skip, Plan, Approve and Realized, so governance stays with you and every realized saving has an audit trail. For Azure, it follows the three phases of visibility, usage and rate, which our Azure cost optimization tooling guide explains.

The platform is offered through the Microsoft Marketplace and in service tiers, Foundation and Professional, depending on how closely you want our experts involved. For current pricing, check the Marketplace listing or contact us. We do not list prices here, so no number on this page can go stale.

Do you need a tool, a consultant or both?

A tool gives you evidence and continuity. A consultant gives you decisions, negotiation and execution. Organizations with a small estate and an engineer can start with the free reports. Larger estates, or those facing an agreement change, benefit from both.

A tool cannot choose between an EA and CSP, negotiate a renewal or tell you that a user who looks idle is a seasonal worker you need in March. A consultant without data is guessing. Our own practice combines the two: the platform provides the evidence, and the Optimization Service turns it into decisions and contract outcomes. Across more than 200 projects, we have reduced Microsoft software spend by around 30% on average.

If you want to try the free route first, it is a sound starting point: export the Active users report, switch on user details, and sort by last activity. You will find the first candidates in an hour. When you need history, per-user cost or a repeatable process, move up a category.

Related reading

See what a read-only analysis finds in your tenant

Per-user evidence for inactive licenses, double licensing and downgrade candidates.