How it works
Everything a scan reads, and the rule behind every finding
Sentsai signs in with Microsoft, reads your directory, licenses and usage reports with four read-only permissions, and applies fixed rules to them. There is no AI and no guesswork: the same data always produces the same findings.
1. What Microsoft will ask you to approve
A Microsoft 365 administrator approves these once for the organization (Cloud Application Administrator is the least privileged role that can). This is the wording Microsoft’s consent screen uses, and what each one is for:
| Microsoft shows | What Sentsai reads | Used for |
|---|---|---|
| Read all users' full profiles User.Read.All | Each user’s name, sign-in address, which licenses they hold, whether the account is enabled, account type (member or guest) and creation date. | Unassigned and idle licenses, disabled accounts still licensed, duplicate add-ons, guests. |
| Read directory data Directory.Read.All | The licenses your organization has bought and how many are in use, who holds administrator roles, the names of license-assigning groups, and your organization’s name. | Unassigned seats, administrator-role review, group license errors, the report header. |
| Read audit log data AuditLog.Read.All | Each user’s last sign-in date, and whether they have registered a multi-factor method. | Inactivity and never-signed-in checks, the MFA check. |
| Read all usage reports Reports.Read.All | The Microsoft 365 active-user report (last activity per app) and mailbox sizes. | Exchange-only users, idle add-ons, mailbox plan sizing. |
Microsoft also shows “Sign in and read your profile” for the person signing in. It does not show “Maintain access to data you have given it access to”, because Sentsai never asks for offline access: it can only read while your scan runs. All four are read-only; none lets Sentsai change anything.
You can remove Sentsai at any time from Entra ID, Enterprise applications. Access ends immediately.
2. The checks
Grouped by what they find. Each group names the engine functions it describes.
Licenses nobody is using
Seats you pay for that no active person uses.
- Unassigned seats: a subscription has more seats than assigned users. Seats in a warning (expiring) state are reported too, with how many assigned users rely on them.
- Disabled accounts that still hold paid licenses, for members and for guests.
- No sign-in for 180 days or more on an account holding paid licenses.
- Never signed in since the account was created, once the account is more than 30 days old (a grace period for onboarding).
- No sign-in for 30 to 179 days on an E3 or E5-tier plan. Flagged for review, not removal: someone on leave looks the same.
Paying twice for the same thing
Licenses whose features are already included in something else the same user holds.
- Add-ons already inside the user’s suite, found by comparing Microsoft’s own service-plan lists for each pair of licenses the user holds, so new license names are covered automatically.
- Power BI Pro held alongside Power BI Premium Per User, where the cheaper Premium Per User add-on would do.
- Teams Enterprise bought for a Business plan that excludes Teams, where the Business-tier Teams add-on costs less. A swap, never a removal.
- Frontline (F1/F3) users paying the standard rate for an add-on that has a Frontline variant.
- Dynamics 365 Customer Service Enterprise users with a standalone Contact Center license instead of the add-on variant, and Enterprise and Professional editions of the same app on one user.
Paying for more than is used
A plan larger than the activity behind it, or a discount not applied.
- E3 or E5-tier users whose only app activity in the last 180 days is Exchange: candidates for a standalone Exchange Online plan.
- Exchange Online Plan 2 mailboxes under 50 GB that do not need Plan 2’s larger mailbox.
- Microsoft 365 E3 or Office 365 E3 users at organizations under 300 users, where Business Premium is cheaper and comparable.
- Users on a Business plan holding the enterprise Microsoft 365 Copilot license, when Microsoft 365 Copilot Business gives the same capability for less.
- Dynamics 365, Power Platform and Customer Insights capacity and attach pricing that is not applied: attach discounts, volume tiers and tier switches.
Risk and housekeeping (no savings figure)
Findings that cost nothing to fix but matter at a renewal or an audit.
- Users with no multi-factor authentication method registered.
- Guest accounts more than 90 days old with no sign-in in the last 90 days (or none ever).
- More Global Administrators than Microsoft recommends (fewer than five). Other administrator roles are listed for visibility, not scored as problems.
- License assignments that Microsoft itself reports as failed for a group, for example when the group ran out of seats.
- Licenses Microsoft has announced for retirement that are still assigned.
- Mailboxes over 85 GB, close to the 100 GB limit, where archiving should be turned on.
3. How savings are worked out
Each savings finding multiplies the license’s monthly price by twelve, using Microsoft list prices from a catalog we maintain. Your own price may be lower if your agreement carries a discount, so treat the figures as an upper bound and check them against your invoice.
Removing a license from a user does not by itself lower your bill. The saving arrives when the seat count on the subscription goes down, at renewal or when your agreement allows it.
4. What Sentsai never does
- Change anything in your tenant. Every permission is read-only.
- Keep access between scans. Offline access is never requested.
- Send your directory to an AI or language model. The findings are computed by fixed rules.
- Sell or share your data, or let an advertising or analytics tag run inside the app.
Scan results are deleted after your retention period (90 days by default). The detail is in our security overview and Privacy Policy.
5. What it costs
The scan is free and shows the total annual savings identified and the number of compliance gaps. The itemized report, with every finding and the user or license it applies to, is 5% of the identified annual savings with a $99 minimum, and comes with 12 months of scanning. After that, renewal is a flat yearly price by directory size. Details are on the pricing page.
