Find the Microsoft 365 licenses you pay for and nobody uses
Free, read-only scan. 20+ checks. Results in minutes. One admin approval.
Free: your total annual savings, the number of security gaps and your price. The itemized report, user by user, is $2 per licensed user for 12 months ($99 minimum).
Needs a one-time approval of read-only access from an administrator who can approve apps. Not an admin? Email this to yours.
The checks
What the scan checks
Our engine runs 20+ automated checks across Microsoft 365, Dynamics 365, and Power Platform. Every finding is tied to a specific user, license, or role.
Licenses you bought that nobody is assigned to
Paid licenses still assigned to disabled accounts
Long-idle accounts that still bill monthly
Power BI Pro billed alongside Premium Per User
Dynamics 365 Base + Attach discounts not applied
Users with no MFA method registered
Licensed guest accounts long past their last sign-in
More Global Administrators than operations need
After the click
What happens when you click
You sign in with Microsoft.
Sentsai asks for four read-only Microsoft Graph permissions: User.Read.All, Directory.Read.All, Reports.Read.All and AuditLog.Read.All. Offline access is never requested, so Sentsai never holds a refresh token: its access ends when the Microsoft sign-in token expires, 60 to 90 minutes after you sign in.
One administrator approves it once.
Cloud Application Administrator is the least privileged role that can approve it, and approving once covers everyone at your organization. Not an administrator? The note under the button gives you a ready-written email to send to yours.
Nothing in your tenant is written.
Delegated permissions only. We have no write access; nothing in your tenant can ever be modified by Sentsai.
You can revoke it at any time.
Delete Sentsai from Entra Enterprise Applications whenever you choose. Access is revoked instantly, with no action required from us.
The summary is free. The itemized report is paid.
The free summary shows the total annual savings identified, the number of security gaps and your price. Unlock the report for $2 per licensed user ($99 minimum). That activates 12 months of scanning, subject to a daily fair-use limit, and nothing renews unless you turn it on.
What Microsoft’s approval screen will say, and why
| Microsoft shows | What Sentsai reads | Used for |
|---|---|---|
| Read all users' full profiles User.Read.All | Each user’s name, sign-in address, which licenses they hold, whether the account is enabled, account type (member or guest) and creation date. | Unassigned and idle licenses, disabled accounts still licensed, duplicate add-ons, guests. |
| Read directory data Directory.Read.All | The licenses your organization has bought and how many are in use, the status, license count, trial flag and next renewal date of each subscription, who holds administrator roles, the names of license-assigning groups, and your organization’s name. | Unassigned seats, renewal dates, administrator-role review, group license errors, the report header. |
| Read audit log data AuditLog.Read.All | Each user’s last sign-in date, and whether they have registered a multi-factor method. | Inactivity and never-signed-in checks, the MFA check. |
| Read all usage reports Reports.Read.All | The Microsoft 365 active-user report (last activity per app), the Microsoft 365 Apps report (which Office apps each person used, and on which kinds of device), mailbox sizes and, only if you have Copilot licenses assigned, the Copilot usage report (when each Copilot user last used it). | Exchange-only users, idle add-ons and unused Copilot seats, cheaper plans for people who never use the desktop apps, mailbox plan sizing. |
Microsoft also shows “Sign in and read your profile” for the person signing in. It does not show “Maintain access to data you have given it access to”, because Sentsai never asks for offline access: with these permissions it can only read while your scan runs. All four are read-only; none lets Sentsai change anything.
A Microsoft verified publisher. Sentsai connects through read-only OAuth 2.0 and has no write access, ever. Findings are encrypted at rest, raw directory data is never retained, and a GDPR Article 28 DPA applies from sign-up.
Sample report
See exactly what you’d get
A real report, generated by the engine, with every finding tied to a named user or license.
An actual Sentsai report, generated from sample data. View the full sample report · Watch the demo (2:11)
No. We connect with read-only OAuth 2.0 delegated permissions. We have no write access. Nothing in your tenant can be modified, created, or deleted by Sentsai. Ever. This is a deliberate security choice, not a missing feature: even if Sentsai were ever compromised, nobody could change anything in your tenant through us, because we simply do not have that capability. You review every recommendation and make each change yourself, on your own terms.
One administrator, once. Every Microsoft Graph permission Sentsai requests is read-only, and Microsoft classifies all four as requiring administrator approval, so nobody at your organization can use Sentsai until an administrator approves it for the tenant. The roles Microsoft permits to do this are Global Administrator, Privileged Role Administrator, Cloud Application Administrator, Application Administrator, and AI Administrator. Cloud Application Administrator is the least privileged of those and is sufficient for Sentsai. User Administrator and Helpdesk Administrator cannot approve applications, so those roles will still see "Need admin approval" from Microsoft. The ordinary sign-in screen makes organization-wide approval an easily missed checkbox, and missing it approves Sentsai for that one administrator while leaving the rest of your team blocked. To avoid that, sign in and use Approve Sentsai for the whole organization in Settings, under Organization access, which approves for everyone in one step. Anyone blocked by Microsoft also gets the same action on the error they see, so they can send it to an administrator.
Go to Microsoft Entra admin center, open Enterprise Applications, find Sentsai, and delete it. Microsoft then stops giving Sentsai any new access to your tenant. A sign-in token Microsoft has already issued cannot be recalled and stays valid until it expires, normally within 60 to 90 minutes; signing out of Sentsai first discards it at once. Your report remains available in your dashboard until your retention period expires.
The scan is completely free, and it shows your price before you pay anything. The full remediation report costs $2 per licensed user for 12 months, with a minimum of $99. A licensed user is an enabled account in your directory with at least one paid Microsoft license assigned; disabled and unlicensed accounts are not counted, and guests are counted only if they hold a paid license. That one payment activates a 12-month subscription: every scan you run for the next year is unlocked automatically, with no per-report fee, so you can re-scan any time to confirm the savings you capture after making changes. Next year costs the same formula, counted again from a recent scan. If the savings a scan identifies are less than the price, we tell you before you pay. Automatic renewal is optional and off by default - unless you turn it on, the subscription simply expires unless you choose to renew, and if you do turn it on we email you the exact amount about 30 days before charging.
Free to scan. One price, up front.
Two dollars per licensed user for twelve months, $99 minimum. You see your savings figure and your price before you pay. Nothing renews unless you turn it on.
Read-only access. Free to scan. No card required.
Needs a one-time approval of read-only access from an administrator who can approve apps. Not an admin? Email this to yours.