Microsoft 365 licence waste analyzer
Import a CSV made by the read-only PowerShell exporter to find disabled accounts that remain licensed and enabled accounts with no recorded successful sign-in in a chosen period. Map each SKU yourself to the matching dated Microsoft list price.
Browser-only: the file is read from your device and is not uploaded or saved. The CSV contains user principal names and sign-in dates, so handle it as sensitive data and clear it after review. A sign-in gap is a review candidate, not proof that a licence is unused or can be removed.
Match imported SKU part numbers to the paid product that appears on your Microsoft agreement. Unknown SKUs stay unpriced.
How it works
Run the PowerShell script on an administrator-managed computer, protect the CSV, import it here, map SKUs to a matching plan, then review the candidate accounts with your billing and workload owners. The annual figure multiplies mapped Microsoft list prices by 12; the shared Microsoft list-price file was checked 1 November 2026. Prices shown are list prices, not an invoice or guaranteed saving.
Frequently asked questions
Does a sign-in gap prove the licence is unused? No. Sign-in activity can lag and does not represent every product workload; confirm use before changing a subscription.
Why must I map each SKU? The tenant SKU part number is not automatically assumed to be a paid plan or a matching list price. Unknown or unmapped products are excluded from the estimate.
Which permissions does the exporter use? Delegated read-only Graph scopes: User.Read.All reads user identity, enabled state and assigned SKU IDs; AuditLog.Read.All reads sign-in activity; LicenseAssignment.Read.All reads subscribed SKU names. Microsoft documents sign-in activity as requiring Entra ID P1 or P2 and warns it can take up to 24 hours to update. The export makes no licence changes. Source pages read 7 November 2026: List users, List subscribed SKUs, signInActivity, sign-in log latency, and permissions reference.
Download the read-only exporter from export-m365-licence-inventory.ps1. It uses Microsoft Graph PowerShell read commands only, reads user principal name, enabled state, last successful sign-in date, assigned licence SKU IDs and SKU part numbers, and writes a local CSV. Do not share the file; delete it when no longer needed.