Unassigned licenses
Per subscription: purchased units minus assigned units, leaving suspended and warning units aside. Trials are shown separately with their end date.
Priced
Microsoft 365 License and Seat Audit
Every license, every seat, and what the unused ones cost. Priced, listed, exportable.
GlacierPoint Ledger reads the licenses, seats, guests and shared mailboxes of your Microsoft 365 tenant through read-only Graph, runs eleven checks, and puts a dollar figure on the licenses nobody uses. The first page after a run is the savings card: potential savings a month and a year, with the users and subscriptions behind every number.
You need a Windows computer and a Microsoft 365 administrator account. Details below.
Read-only: the product has no write permission
Mail, files and chats are never read
Names never appear in a log
Potential savings
Example$1,842 a month$22,104 a year, at Microsoft's list prices
contoso.onmicrosoft.com · run of Oct 9 · 412 licensed users, 9 subscriptions
- 23unassigned licenses
- 11licensed users disabled or stale
- 4overlapping licenses
Read-only. Nothing in the tenant was changed.
Check 3 · Disabled users still licensed
4 users, $130 a month
Account disabled, paid license still assignedcontoso.onmicrosoft.com
| User | License | Disabled | A month |
|---|---|---|---|
| Priya Natarajan | Microsoft 365 E3 | Aug 12 | $36.00 |
| Tom Albrecht | Microsoft 365 E3 | Sep 2 | $36.00 |
| Lena Fischer | Business Premium | Sep 19 | $22.00 |
| Marcus Oyelaran | Microsoft 365 E3 | Oct 1 | $36.00 |
What to do: release the license, or convert the mailbox to a shared mailbox before you do.
The dashboard · monthly waste per run
Down $568 since August
- Since last run: 3 fixed
- 1 new
- 7 unchanged
What you need
- A Windows computerWindows 10 or Windows 11, 64-bit, for the app. The app is a single program; nothing is installed in your tenant.About the download
- A Microsoft 365 administrator accountA run asks for read permissions only, on Microsoft's own sign-in page. The product has no write permission.Every permission, by name
- Entra ID P1 or P2, for sign-in datesStale and never-activated users come from sign-in activity, which Microsoft provides with Entra ID P1. Without it the check says so and falls back to the creation date.What the checks need
- A computer that is on, for scheduled runsWith Watch and MSP, runs can be scheduled as a Windows task with an app registration you own; the certificate's private key stays on that computer.Scheduled runs
11
checks, from unassigned licenses to add-ons without a base license, each with its count and its monthly cost
0
write permissions: every check is a read, through Graph and the Exchange Online administrator read
$0
for the Preview: one tenant, up to 3 runs, the savings card and every count and cost, no card needed
60 days
ahead: subscriptions and trials near their end are listed on the same page, so renewals are planned, not discovered
The problem
Licenses outlive the people.
A license is assigned the day someone starts and forgotten the day they leave. The admin center shows the total; it does not show which seats are paid for and unused, or what that costs each month.
- Leavers keep their licenseThe account is disabled, the mailbox kept "for a while", and the E3 bills on. Every month, for every one of them.
- Two licenses for one personBusiness Premium and E3 on the same user. E3 plus an Exchange plan it already includes. The admin center never says so.
- Seats bought and never assignedPurchased units minus assigned units, per subscription, is a number nobody looks at until the renewal.
- Add-ons with nothing to add toTeams Phone or Copilot on a user without the base license it needs: paid for, and unusable.
How it works
Sign in, run, read the figure.
A Windows app reads the tenant with your own sign-in. The portal prices the waste, builds the report and keeps every run. The whole flow.
Sign in and run
Start the app, sign in on Microsoft's own page with your administrator account, and grant the read permissions it names. The app reads licenses, users, guests, sign-in activity and mailboxes, seals the run and uploads it. Sign-ins stay in memory on your computer.
The portal prices the waste
Every check runs against the run document. Each finding is priced at Microsoft's list price for the SKU, or at the price you typed in for your tenant. The list price table is signed and checked by the portal; the app never sees a price.
Read, export, fix
The savings card first, then one section per check with the users and subscriptions behind it and a "what to do" line. CSV per check, PDF of the whole report. Fixing is yours to do in the admin center: the product writes nothing.
The eleven checks
Every seat that costs money and does no work.
Nine checks are priced and add up to the savings figure. Two are listed on the same page without a price, because they are planning, not waste.
Overlapping licenses
A user with two SKUs where one's service plans cover the other's (Business Premium plus E3; E3 plus Exchange Online Plan 1), or the same service plan enabled twice. The report names which SKU to drop.
PricedDisabled users still licensed
The account is disabled and a paid license is still assigned. Counted at the full monthly price.
PricedStale users
No sign-in for 90 days; 30, 60, 90 or 180 per tenant. Sign-in dates need Entra ID P1 or P2; without them the check says so and falls back to the creation date and "never signed in".
PricedNever-activated users
Licensed, created more than 30 days ago, never signed in. Apart from stale: these are starters who never started.
PricedGuests
How many guests, which guests hold a paid license, and which are stale by the same rule. A guest rarely needs a license.
PricedShared and resource mailboxes with licenses
A shared, room or equipment mailbox that holds a license. Under 50 GB, without an archive or a litigation hold, it needs none. Read with the Exchange Online administrator sign-in.
PricedLicense assignment errors
Users whose group-based license assignment is in an error state: paid for, and not working.
PricedAdd-ons without a base
An add-on (Teams Phone, Copilot, Visio) on a user without the base license it requires. Microsoft allows the assignment; the add-on does nothing.
PricedService plans disabled inside a SKU
Per user, which plans of an assigned SKU are turned off. Not waste: it explains why a user cannot use a feature, and finds users who pay for E5 with Defender off.
ListedSubscriptions ending
Subscriptions and trials within 60 days of their end, with the date. A planning line on the same page.
ListedPriced: counted in the savings figureListed: shown with its count, not counted as wasteHow each one is decided
Security
Your tenant. Your sign-in. No write permission.
A license audit needs to read, and nothing else. So the product asks for read permissions only, and there is no code in it that writes to a tenant.
- Read-only Graph. Five read permissions, asked by name on Microsoft's own sign-in page, plus the Exchange Online administrator read for mailboxes. No write permission exists in the product.
- No vendor access. We hold no password, token, secret or certificate for any tenant. The app on your computer does the reading, signed in as you.
- Sealed uploads, encrypted at rest. A run is encrypted on your computer before it is uploaded, and the findings are stored encrypted in the portal.
- Names never in logs. The portal's logs and activity record hold counts and codes; a user's name or address is in the report only, for the members of your workspace.
See your own figure first.
Every workspace starts as the free Preview: one tenant, up to 3 runs, the savings card with every headline figure, and every check with its count and its cost, with the first 5 rows of each list. No card, no call. The full lists, the exports and your own prices come with a plan.
Pricing
Priced per tenant. The Preview is free.
Plans differ by how long you keep the full lists, whether runs are scheduled and watched, and how many tenants you manage. Never by which checks run.
One-time: $79 per tenant, once, for 30 days. Watch: $15 a month, or $180 a year billed in advance. MSP: $99 a month plus $9 a month per tenant. See the plans
Compare the plans in full, with the MSP plan's worked monthly totals and answers about billing. Prices in US dollars.
With GlacierPoint Snapshot and Scan
Know the tenant, keep it, pay for what it uses.
GlacierPoint Scan finds configuration weaknesses and sets priorities; GlacierPoint Snapshot preserves configuration history and recovers supported settings; GlacierPoint Ledger reads the licenses and seats and prices what is unused. Three read-only tools, one workspace model, one sign-in each.
About GlacierPoint
GlacierPoint Technologies builds tools that keep Microsoft 365 and Windows environments known, safe and recoverable.
We started from a simple observation: most organizations don't know where their directory and tenant stand until something goes wrong, and the tools that could tell them are written for specialists. Our products put a clear answer in front of the people who have to act on it — a brief a leadership team can read, evidence an administrator can verify, and changes you approve one at a time.
Clarity
Plain-language reports and prices on the page. The same evidence sits behind every number.
Control
You authorize every collection and every change. Nothing runs in your environment without your sign-in, and every change our tools make records a way back.
Security first
Evidence is encrypted on your computer before it leaves. We never train AI on customer data, and support sees your data only when you grant it, for as long as you choose.
See what your tenant wastes today.
The free Preview runs every check on one tenant, up to 3 times, and shows the savings card with every count and cost. Decide with your own figure in front of you.