Microsoft verified publisherFind the Microsoft 365 licenses you pay for and nobody uses
Free, read-only scan. 20+ checks. Results in minutes. One admin approval.
Free: your total annual savings and the number of compliance gaps. The itemized report, user by user, is 5% of identified savings ($99 minimum).
Needs a one-time approval of read-only access from an administrator who can approve apps. Not an admin? Email this to yours.
What the scan checks
Our engine runs 20+ automated checks across Microsoft 365, Dynamics 365, and Power Platform. Every finding is tied to a specific user, license, or role.
Savings findings show the dollar amount, and the user where one applies. All tied to specific named users with clear remediation steps.
What happens when you click
- 01
You sign in with Microsoft.
Sentsai asks for four read-only Microsoft Graph permissions: User.Read.All, Directory.Read.All, Reports.Read.All and AuditLog.Read.All. Offline access is never requested, so Sentsai cannot reach your tenant outside an active scan.
- 02
One administrator approves it once.
Cloud Application Administrator is the least privileged role that can approve it, and approving once covers everyone at your organization. Not an administrator? The note under the button gives you a ready-written email to send to yours.
- 03
Nothing in your tenant is written.
Delegated permissions only. We have no write access; nothing in your tenant can ever be modified by Sentsai.
- 04
You can revoke it at any time.
Delete Sentsai from Entra Enterprise Applications whenever you choose. Access is revoked instantly, with no action required from us.
- 05
The summary is free. The itemized report is paid.
The free summary shows the total annual savings identified and the number of compliance gaps. Unlock the report for 5% of identified savings ($99 minimum). That activates 12 months of scanning, subject to a daily fair-use limit, then renews annually at a flat rate by size.
What Microsoft’s approval screen will say, and why
| Microsoft shows | What Sentsai reads | Used for |
|---|---|---|
| Read all users' full profiles User.Read.All | Each user’s name, sign-in address, which licenses they hold, whether the account is enabled, account type (member or guest) and creation date. | Unassigned and idle licenses, disabled accounts still licensed, duplicate add-ons, guests. |
| Read directory data Directory.Read.All | The licenses your organization has bought and how many are in use, who holds administrator roles, the names of license-assigning groups, and your organization’s name. | Unassigned seats, administrator-role review, group license errors, the report header. |
| Read audit log data AuditLog.Read.All | Each user’s last sign-in date, and whether they have registered a multi-factor method. | Inactivity and never-signed-in checks, the MFA check. |
| Read all usage reports Reports.Read.All | The Microsoft 365 active-user report (last activity per app) and mailbox sizes. | Exchange-only users, idle add-ons, mailbox plan sizing. |
Microsoft also shows “Sign in and read your profile” for the person signing in. It does not show “Maintain access to data you have given it access to”, because Sentsai never asks for offline access: it can only read while your scan runs. All four are read-only; none lets Sentsai change anything.
A Microsoft verified publisher. Sentsai connects through read-only OAuth 2.0 and has no write access, ever. Findings are encrypted at rest, raw directory data is never retained, and a GDPR Article 28 DPA applies from sign-up.
See exactly what you’d get
A real report, generated by the engine, with every finding tied to a named user or license.
An actual Sentsai report, generated from sample data. View the full sample report · Watch the demo (3:35)
Common questions
No. We connect with read-only OAuth 2.0 delegated permissions. We have no write access. Nothing in your tenant can be modified, created, or deleted by Sentsai. Ever. This is a deliberate security choice, not a missing feature: even if Sentsai were ever compromised, there is nothing an attacker could do to your tenant through us, because we simply do not have that capability. You review every recommendation and make each change yourself, on your own terms.
One administrator, once. Every permission Sentsai requests is read-only, and Microsoft classifies all of them as requiring administrator approval, so nobody at your organization can use Sentsai until an administrator approves it for the tenant. The roles Microsoft permits to do this are Global Administrator, Privileged Role Administrator, Cloud Application Administrator, Application Administrator, and AI Administrator. Cloud Application Administrator is the least privileged of those and is sufficient for Sentsai. User Administrator and Helpdesk Administrator cannot approve applications, so those roles will still see "Need admin approval" from Microsoft. The ordinary sign-in screen makes organization-wide approval an easily missed checkbox, and missing it approves Sentsai for that one administrator while leaving the rest of your team blocked. To avoid that, sign in and use Approve Sentsai for the whole organization in Settings, under Organization access, which approves for everyone in one step. Anyone blocked by Microsoft also gets the same action on the error they see, so they can send it to an administrator.
Go to Microsoft Entra admin center, open Enterprise Applications, find Sentsai, and delete it. This immediately revokes all access. Your report remains available in your dashboard until your retention period expires.
The scan is completely free. If we identify savings, unlocking the full remediation report costs 5% of the annual savings figure we found, with a minimum of $99. That one payment activates a 12-month subscription: every scan you run for the next year is unlocked automatically, with no per-report fee, so you can re-scan any time to confirm the savings you capture after making changes. After 12 months, the subscription renews at a flat annual rate based on the number of user accounts in your directory: the same figure your report shows as "Users analyzed", which includes guests and unlicensed accounts and is not the same as your count of paid Microsoft licenses. It starts at $99/year and every band is published on our pricing page. Automatic renewal is optional and off by default - unless you turn it on, the subscription simply expires unless you choose to renew, and if you do turn it on we email you the exact amount about 30 days before charging.
More questions? support@sentsai.com or read our Security page.