Find the M365 licenses nobody's using.

No. The free scan and the paid Auditor both use read-only, least-privilege Microsoft Graph permissions. Nothing is created, removed or modified — you act on the findings yourself in the admin center.

No, but it sharpens the results. With P1 the Auditor reads each user's last sign-in directly. Without it, it falls back to Microsoft 365's usage reports, which are less precise — and if your tenant conceals user names in those reports, it can only flag disabled accounts that still hold a license. Turning that setting off for a single run gives you the full picture.

Not for a normal run — you sign in with a device code using your own admin account. Scheduled unattended re-audits and multi-tenant roll-ups do use an app registration that you create in your own tenant.

Nowhere. The PDF and CSV are written to your own machine, and the tool contains no telemetry or analytics. The only outbound call is the license check on paid tiers. The details are in the privacy policy.

Your recoverable spend as a headline figure, the dormant and disabled seats behind it priced by SKU, costed recommended actions, and a review of licensed guests and shared mailboxes. On Team and Enterprise it also shows what changed since the last audit, and an offboarding list of what each leaver still holds. See a sample report.

It's a command-line tool for Windows (x64), Linux (x64) and macOS on Apple Silicon. The Windows build is code-signed and the macOS build is signed and notarized.

The free PowerShell module gives you two commands and raw CSV: the headline wasted-spend number, and a basic offboarding check. The Auditor adds the PDF report, costed recommendations, scheduled re-audits with drift tracking, a review of licensed guest accounts and shared mailboxes, and the offboarding list in the report itself — per person, with what each one still holds. The table above compares them line by line.

Sometimes — and it tells you when it can't. Mailbox types come from Microsoft's usage report, which only lists mailboxes that have had activity, so a shared mailbox sitting completely untouched doesn't appear in it at all. Its type is reported as unknown rather than guessed. The free PowerShell module can read types straight from Exchange Online instead, which sees every mailbox whether it's been used or not — that's Invoke-OffboardingCheck -UseExchangeOnline, and it needs a second sign-in. The same option is planned for the Auditor.

Run the free scan first — you see your number before paying anything. The downloadable licenses are a flat annual price with no auto-renew; the refund policy covers the rest.