Documentation › Using Steward IT Census
Microsoft 365 licenses
Steward IT Census reads the Microsoft 365 licenses of your Entra ID tenant: which products you bought, how many of each, who holds them, and where licenses are paid for but not used. Open Software › Microsoft 365 licenses.
The data comes from the Entra ID sync and is read again at every sync of the tenant. It stays on your Census server.
Turning it on#
- In the Entra admin center, open the app registration Census uses › API permissions › Add a permission › Microsoft Graph › Application permissions and add
Organization.Read.All(orDirectory.Read.All, if you prefer one broader permission). Click Grant admin consent. - For the inactive users finding, the app also needs
AuditLog.Read.All, and the tenant an Entra ID P1 or P2 license (Microsoft only gives sign-in times with those). Without them the other findings still work. - Scanning › Active Directory & Entra ID: edit the tenant, tick Microsoft 365 licenses, save and click Sync now.
If the permission is missing, the sync still reads users, groups and devices; its status says which permission the licenses need, and license data from an earlier sync is kept.
Users synced from on-premises Active Directory are included in the license data even when the Entra ID sync leaves them out of the user list.
What you see#
| Licenses bought | Active licenses of all products (what Microsoft lists as available to assign). |
| Assigned | Licenses given to users, directly or through a group. |
| Unused | Bought but not assigned to anyone. |
| Monthly spend | Licenses bought × the price you entered, for products with a price. |
| Possible savings | Unused licenses plus licenses on disabled accounts, inactive users and duplicates, for products with a price. A license appearing in several findings counts once. |
The Products table lists each product with its friendly name (for example Microsoft 365 E3 instead of SPE_E3), its status at Microsoft (Enabled, Warning = the subscription expired and is in its grace period, Suspended, LockedOut), bought, assigned and unused licenses. Products a tenant holds for the whole organization rather than per user don't count toward the totals.
On a user's page (Users), logins with Software management see that user's Microsoft 365 licenses and whether each was assigned directly or through a group.
Findings#
- Licenses on disabled accounts: accounts disabled in Entra ID that still hold licenses. Remove the licenses (or the group membership that assigns them) to free them.
- Licenses on inactive users: enabled users without a sign-in for 90 days or more (change the number of days at the bottom of the page). Accounts younger than that are left out. Needs sign-in times (see above); without them Census says so instead of guessing.
- Duplicate licenses: a user holding a product that another product they hold already includes, for example Office 365 E3 next to Microsoft 365 E3, Microsoft 365 Business Standard next to Business Premium, or Exchange Online (Plan 1) next to Microsoft 365 E3. Add-ons that the suites don't include (Visio, Project, Copilot…) are never listed as duplicates. Check the license before removing it: in a few cases a separate product is kept on purpose (for example during a migration).
Each finding has a report in Reports › Microsoft 365, which you can export, put on the dashboard or send by email.
Prices#
Enter the monthly price per license of each product in the Price per month column (your agreement's price, in the currency set under Configuration › General settings). Prices are kept per product and used for every tenant; leave a field empty to remove its price. Spend and savings are only shown for products with a price.
Who can see it#
Logins with the Software management permission (and administrators) see the page, set prices and see the reports. Turning license collection on and the number of days for inactive users are for administrators. Logins limited to some assets don't see Microsoft 365 licenses, because they belong to the whole tenant.