The app signs in to your tenant as you and reads licenses, users, guests, sign-in activity and mailboxes; it never writes. The portal runs the eleven checks, prices every finding, builds the report and keeps every run, so the figure can be watched over time.
Start the app on a Windows computer and press Run. It opens Microsoft's own sign-in page for your administrator account and shows a consent card that names each permission it asks for: read permissions only. When consent is granted, the app reads the tenant, seals the run on your computer and uploads it to your workspace.
Consent card
Granted: 5 of 5
| Permission | What it reads |
|---|---|
| Organization.Read.All | subscriptions, purchased and assigned units |
| Directory.Read.All | licenses, service plans, assignment states |
| User.Read.All | users, guests, account state, creation date |
| AuditLog.Read.All | sign-in activity |
| Reports.Read.All | usage, optional |
Plus the Exchange Online administrator read for shared, room and equipment mailboxes. No write permission.
Every check is decided from the run document: unassigned units per subscription; overlaps from the service plans of your own subscriptions, not a hand list; disabled, stale and never-activated users from the account state and the sign-in activity; guests; mailboxes holding a license; assignments in error; add-ons without their base. Each finding is priced at Microsoft's list price for its SKU, or at the price you typed in for the tenant.
Check 2 · Overlapping licenses
2 users, $44 a month
| User | Holds | Drop | A month |
|---|---|---|---|
| Ana Ruiz | Business Premium + E3 | Business Premium | $22.00 |
| Daniel Kim | E3 + Exchange Online Plan 1 | Exchange Online Plan 1 | $4.00 |
| Sofia Berg | E3 + E5 (E5 covers E3) | E3 | $36.00 |
What to do: remove the covered SKU from the user, or from the group that assigns it.
The first page is the savings card: potential savings a month and a year, with three headline counts beside it. Under it, one section per check with its monthly cost, its count, and the users or subscriptions with the facts that put them there: the SKU, how it was assigned, the last sign-in, the state. Each section ends with a "what to do" line: release the license, remove from the group, convert to a shared mailbox.
Potential savings
Example$1,842 a month$22,104 a year, at Microsoft's list prices
contoso.onmicrosoft.com · run of Oct 9 · list price table 2026.10, as of Oct 1
Read-only. Nothing in the tenant was changed.
Every run is kept as a record. The dashboard is the same page kept over time: the newest run, a trend line of monthly waste per run, and "since last run": what was fixed, what is new, what is unchanged. With Watch and MSP, runs are scheduled, weekly by default and daily at most, as a Windows task on a computer you choose, with an app registration your organization owns and a certificate whose private key stays on that computer.
The dashboard · monthly waste per run
Down $568 since August
One Windows app, one sign-in per tenant by your administrator account on Microsoft's own page, or the tenant's own app registration for scheduled runs. Each tenant is registered by the app and confirmed by a member on the pairing page. The workspace dashboard is a table of tenants with their waste figure and last run: the page you sell from.
The split is deliberate: whatever signs in to your tenant runs on a computer you control, and nothing anywhere writes to it.
Signs in to Microsoft as you, reads licenses, users, guests, sign-in activity and mailboxes, seals the run and uploads it. Runs scheduled runs as a Windows task. Sign-ins stay in memory and are never written to disk. It never receives a price and never runs anything the portal tells it to.
Holds your workspace, your team and every run of every tenant, encrypted at rest. Runs the checks, prices the findings, builds the report, the CSV and the PDF, keeps the history and the trend, and sends the alerts. It holds no credential for your tenant and cannot sign in to it.
GlacierPoint Scan finds configuration weaknesses and sets priorities; GlacierPoint Snapshot preserves configuration history and recovers supported settings; GlacierPoint Ledger reads the licenses and seats and prices what is unused.
The free Preview runs every check on one tenant, up to 3 times, with the savings card and every count and cost. You need a Windows computer and an administrator account for the tenant.