Understanding subscriptions and licenses in Microsoft 365 for business | Microsoft Learn can be a challenge for any organization, particularly for large enterprises. This is particularly important when it comes to finding ways of saving money by ensuring:
- staff have the necessary licenses (SKUs) to perform their role(s);
- staff are not assigned more licenses than they need;
- the organization understands where the biggest license demands are across departments (or other demographics); and perhaps most importantly;
- licenses are only ever assigned to active staff at any point in time.
While Access Panel is a great way to address #1 and #2 by managing the assignment of licensed roles within an organization, scenarios #3 and #4 above can be easily met for customers who have deployed the Entra ID Graph Provider with standard Identity Panel reporting.
License Base Report
Install the following (system base) report to return the set of all assigned licenses across both your Entra ID (Azure) and/or Active Directory (AD) user base. This is a prerequisite for the two Azure reports that are included inline below.
Note: The base report presumes the name of the configured Entra ID provider/silo is simply "Azure". Be sure to change this in all 3 occurrences to match your target configuration as required.
{
"Data": [
{
"$type": "SoftwareIDM.ReportingModule.Models.Report, SoftwareIDM.ReportingModule",
"Id": "42e60d8a-5694-4349-b252-90cbe23fdaf8",
"Name": "Z-System Azure Licenses Base",
"UserId": null,
"UserProfile": false,
"Tags": null,
"Roles": null,
"CacheExpiration": "12:00:00",
"Description": "This is a base report that caches data required by a range of other filtered AD reports. It is more efficient to retrieve data once and use it in different reports.",
"Parameters": [],
"Data": [
{
"$type": "SoftwareIDM.ReportingModule.Models.QueryData, SoftwareIDM.ReportingModule",
"Clauses": [
{
"$type": "SoftwareIDM.PanelModel.Models.FilterClause, SoftwareIDM.PanelModel",
"Field": "Silo",
"Operation": "Eq",
"Value": "special.Identity Silo.Azure",
"ObjectValue": null
},
{
"$type": "SoftwareIDM.PanelModel.Models.FilterClause, SoftwareIDM.PanelModel",
"Field": "ObjectType",
"Operation": "Eq",
"Value": "\"user\"",
"ObjectValue": null
}
],
"SubQueries": [],
"MapRule": "",
"MemoRules": [],
"Aliases": null,
"Name": "AzUsers",
"Type": "SoftwareIDM.AzureModel.GraphRecord, SoftwareIDM.ProviderModel",
"Include": null,
"Limit": null
},
{
"$type": "SoftwareIDM.ReportingModule.Models.QueryData, SoftwareIDM.ReportingModule",
"Clauses": [
{
"$type": "SoftwareIDM.PanelModel.Models.FilterClause, SoftwareIDM.PanelModel",
"Field": "Silo",
"Operation": "Eq",
"Value": "special.Identity Silo.Azure",
"ObjectValue": null
},
{
"$type": "SoftwareIDM.PanelModel.Models.FilterClause, SoftwareIDM.PanelModel",
"Field": "ObjectType",
"Operation": "Eq",
"Value": "\"subscribedSku\"",
"ObjectValue": null
}
],
"SubQueries": [],
"MapRule": "",
"MemoRules": [],
"Aliases": null,
"Name": "Licenses",
"Type": "SoftwareIDM.AzureModel.GraphRecord, SoftwareIDM.ProviderModel",
"Include": null,
"Limit": null
},
{
"$type": "SoftwareIDM.ReportingModule.Models.QueryData, SoftwareIDM.ReportingModule",
"Clauses": [
{
"$type": "SoftwareIDM.PanelModel.Models.FilterClause, SoftwareIDM.PanelModel",
"Field": "Silo",
"Operation": "Eq",
"Value": "special.Identity Silo.Azure",
"ObjectValue": null
},
{
"$type": "SoftwareIDM.PanelModel.Models.FilterClause, SoftwareIDM.PanelModel",
"Field": "Attribute",
"Operation": "Eq",
"Value": "\"assignedLicenses\"",
"ObjectValue": null
},
{
"$type": "SoftwareIDM.PanelModel.Models.FilterClause, SoftwareIDM.PanelModel",
"Field": "Deleted",
"Operation": "Null",
"Value": "",
"ObjectValue": null
}
],
"SubQueries": [],
"MapRule": "",
"MemoRules": [],
"Aliases": null,
"Name": "User - License",
"Type": "SoftwareIDM.PanelModel.Models.MultiAttr, SoftwareIDM.PanelModel",
"Include": null,
"Limit": null
},
{
"$type": "SoftwareIDM.ReportingModule.Models.ReportData, SoftwareIDM.ReportingModule",
"Name": "AD",
"Report": "cb5036bf-5ee6-43b0-b6ee-9fba04c3ea3b",
"Aliases": null,
"MapRule": "",
"MemoRules": []
}
],
"Relations": [
{
"$type": "SoftwareIDM.ReportingModule.Models.Relation, SoftwareIDM.ReportingModule",
"Name": "Users - AD",
"LeftSet": "AzUsers",
"RightSet": "AD",
"LeftRule": "LowerCase(DN)",
"RightRule": "LowerCase(mail)",
"AllowLeftOuter": false,
"AllowRightOuter": true
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Relation, SoftwareIDM.ReportingModule",
"Name": "User - License Ref",
"LeftSet": "AzUsers",
"RightSet": "User - License",
"LeftRule": "Id",
"RightRule": "ObjectId",
"AllowLeftOuter": false,
"AllowRightOuter": false
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Relation, SoftwareIDM.ReportingModule",
"Name": "License Ref - License",
"LeftSet": "User - License",
"RightSet": "Licenses",
"LeftRule": "Value",
"RightRule": "Id",
"AllowLeftOuter": false,
"AllowRightOuter": false
}
],
"FieldProjections": [
{
"$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
"Name": "Id",
"RelationName": "Users - AD",
"RelationSide": "Left",
"ValueRule": "$\"{TimeTraveler(Id)}|{Id}\""
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
"Name": "AD DN",
"RelationName": "Users - AD",
"RelationSide": "Right",
"ValueRule": "$\"{TimeTraveler(Id)}|{DN}\""
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
"Name": "employeeId",
"RelationName": "Users - AD",
"RelationSide": "Right",
"ValueRule": "employeeId"
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
"Name": "employeeType",
"RelationName": "Users - AD",
"RelationSide": "Right",
"ValueRule": "employeeType"
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
"Name": "DisplayName",
"RelationName": "Users - AD",
"RelationSide": "Left",
"ValueRule": "Attributes.displayName"
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
"Name": "givenName",
"RelationName": "Users - AD",
"RelationSide": "Left",
"ValueRule": "Attributes.givenName"
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
"Name": "sAMAccountName",
"RelationName": "Users - AD",
"RelationSide": "Right",
"ValueRule": "sAMAccountName"
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
"Name": "userAccountControl",
"RelationName": "Users - AD",
"RelationSide": "Right",
"ValueRule": "userAccountControl"
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
"Name": "mail",
"RelationName": "Users - AD",
"RelationSide": "Left",
"ValueRule": "Attributes.mail"
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
"Name": "License",
"RelationName": "License Ref - License",
"RelationSide": "Right",
"ValueRule": "$\"{TimeTraveler(Id)}|{DN}\""
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
"Name": "Department",
"RelationName": "Users - AD",
"RelationSide": "Right",
"ValueRule": "department"
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
"Name": "Title",
"RelationName": "Users - AD",
"RelationSide": "Right",
"ValueRule": "title"
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
"Name": "accountExpires",
"RelationName": "Users - AD",
"RelationSide": "Right",
"ValueRule": "accountExpires"
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
"Name": "pwdLastSet",
"RelationName": "Users - AD",
"RelationSide": "Right",
"ValueRule": "pwdLastSet"
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
"Name": "lastLogonTimestamp",
"RelationName": "Users - AD",
"RelationSide": "Right",
"ValueRule": "lastLogonTimestamp"
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
"Name": "Manager",
"RelationName": "Users - AD",
"RelationSide": "Right",
"ValueRule": "$\"{TimeTraveler(manager)}|{managerDN}\""
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
"Name": "managerMail",
"RelationName": "Users - AD",
"RelationSide": "Right",
"ValueRule": "managerMail"
}
],
"Transformations": [],
"Styles": [],
"Sort": {
"Field": "employeeID",
"Direction": "Ascending"
}
}
],
"Count": 1
}
Licensing Counts (Azure) Report
Install the following report to understand the distribution of licenses across departments and SKUs.
{
"Data": [
{
"$type": "SoftwareIDM.ReportingModule.Models.Report, SoftwareIDM.ReportingModule",
"Id": "e5263979-0337-4273-8e12-1fb4897249a4",
"Name": "Licensing Counts (Azure)",
"UserId": null,
"UserProfile": false,
"Tags": null,
"Roles": null,
"CacheExpiration": "12:00:00",
"Description": "Report filtering users by account expiration range. Supports optional filtering on userAccountControl flags and employeeType, as well as before and after time ranges relative to the present.",
"Parameters": [
{
"$type": "SoftwareIDM.ReportingModule.Models.BoolReportParameter, SoftwareIDM.ReportingModule",
"DefaultValue": "",
"Name": "Department",
"Description": "Group by Department",
"Required": false,
"Validation": ""
},
{
"$type": "SoftwareIDM.ReportingModule.Models.BoolReportParameter, SoftwareIDM.ReportingModule",
"DefaultValue": "",
"Name": "Employee Type",
"Description": "Group by Employee Type",
"Required": false,
"Validation": ""
},
{
"$type": "SoftwareIDM.ReportingModule.Models.BoolReportParameter, SoftwareIDM.ReportingModule",
"DefaultValue": "",
"Name": "License Sku",
"Description": "Group by License Sku",
"Required": false,
"Validation": ""
}
],
"Data": [
{
"$type": "SoftwareIDM.ReportingModule.Models.ReportData, SoftwareIDM.ReportingModule",
"Name": "Licenses",
"Report": "42e60d8a-5694-4349-b252-90cbe23fdaf8",
"Aliases": null,
"MapRule": null,
"MemoRules": []
}
],
"Relations": [],
"FieldProjections": [
{
"$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
"Name": "License",
"RelationName": "",
"RelationSide": null,
"ValueRule": "License"
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
"Name": "EmployeeType",
"RelationName": "",
"RelationSide": null,
"ValueRule": "employeeType"
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
"Name": "Department",
"RelationName": "",
"RelationSide": null,
"ValueRule": "Department"
}
],
"Transformations": [
{
"$type": "SoftwareIDM.ReportingModule.Models.Transform, SoftwareIDM.ReportingModule",
"FilterRule": "",
"GroupingRule": "If(Memo(\"License Sku\") ==\"true\", License, \"\") +If(Memo(\"Department\") == \"true\", Department, \"\") +If(Memo(\"Employee Type\") == \"true\", EmployeeType, \"\")",
"TransformRules": [
{
"$type": "SoftwareIDM.ReportingModule.Models.TransformField, SoftwareIDM.ReportingModule",
"Field": "License",
"Name": "License Count",
"Operator": "Count",
"TransformRule": ""
},
{
"$type": "SoftwareIDM.ReportingModule.Models.TransformField, SoftwareIDM.ReportingModule",
"Field": "License",
"Name": "",
"Operator": "Map",
"TransformRule": "Distinct(Rows, License)"
},
{
"$type": "SoftwareIDM.ReportingModule.Models.TransformField, SoftwareIDM.ReportingModule",
"Field": "EmployeeType",
"Name": "",
"Operator": "Map",
"TransformRule": "Distinct(Filter(Rows, context.EmployeeType), EmployeeType)"
},
{
"$type": "SoftwareIDM.ReportingModule.Models.TransformField, SoftwareIDM.ReportingModule",
"Field": "Department",
"Name": "",
"Operator": "Map",
"TransformRule": "Distinct(Filter(Rows, context.Department), Department)"
}
]
}
],
"Styles": [],
"Sort": {
"Field": "License",
"Direction": "Ascending"
}
}
],
"Count": 1
}
Licensing Last Logon (Azure)
This report shows Azure license skus assigned to users. It is optionally filterable by last logon timestamp, and to identify users that may have unrequired licenses. This report uses join rules to display information about a user’s manager to provide contacts for further inquiry.
{
"Data": [
{
"$type": "SoftwareIDM.ReportingModule.Models.Report, SoftwareIDM.ReportingModule",
"Id": "5d33c241-667d-40eb-a9e3-8f1ecc068666",
"Name": "Licensing Last Logon (Azure)",
"UserId": null,
"UserProfile": false,
"Tags": null,
"Roles": null,
"CacheExpiration": "12:00:00",
"Description": "Report filtering users by account expiration range. Supports optional filtering on userAccountControl flags, Department and EmployeeType, as well as before and after time ranges relative to the present.",
"Parameters": [
{
"$type": "SoftwareIDM.ReportingModule.Models.SelectReportParameter, SoftwareIDM.ReportingModule",
"ValueChoices": [
"PASSWD_NOTREQD",
"PASSWD_CANT_CHANGE",
"ACCOUNTDISABLE",
"NORMAL_ACCOUNT",
"INTERDOMAIN_TRUST_ACCOUNT",
"DONT_EXPIRE_PASSWORD",
"SMARTCARD_REQUIRED",
"TRUSTED_FOR_DELEGATION",
"PASSWORD_EXPIRED",
"*"
],
"Name": "Flag",
"Description": "Enter a value (e.g. ACCOUNTDISABLE, NORMAL_ACCOUNT) or '*' for all",
"Required": false,
"Validation": "",
"DefaultValue": "*"
},
{
"$type": "SoftwareIDM.ReportingModule.Models.TextReportParameter, SoftwareIDM.ReportingModule",
"Name": "Employee Type",
"Description": "Enter a value the employee type should contain or '*' for all",
"Required": true,
"Validation": "",
"DefaultValue": "*"
},
{
"$type": "SoftwareIDM.ReportingModule.Models.SelectReportParameter, SoftwareIDM.ReportingModule",
"ValueChoices": [
"*",
"AAD_PREMIUM",
"NBSUPPORT_PRODIRECT",
"RIGHTSMANAGEMENT",
"SHAREPOINTDESKLESS",
"EMS",
"ENTERPRISEPACK",
"EOP_ENTERPRISE_PREMIUM",
"ENTERPRISEWITHSCAL",
"WACONEDRIVESTANDARD",
"POWER_BI_INDIVIDUAL_USER",
"NBPOSTS",
"ECAL_SERVICES",
"POWER_BI_STANDARD",
"POWER_BI_PRO",
"DYN365_ENTERPRISE_TEAM_MEMBERS",
"WACONEDRIVEENTERPRISE",
"NBPROFESSIONAL",
"ENTERPRISECLOUDSUITE",
"STANDARDPACK",
"ATP_ENTERPRISE",
"FLOW_FREE",
"POWERAPPS_VIRAL",
"SPE_E3",
"SPE_E5"
],
"Name": "License",
"Description": "Filter on name of license assigned to user or '*' for all",
"Required": true,
"Validation": "",
"DefaultValue": "*"
},
{
"$type": "SoftwareIDM.ReportingModule.Models.TextReportParameter, SoftwareIDM.ReportingModule",
"Name": "Logon Before",
"Description": "Enter a timespan to subtract from present e.g. '365.00:00:00', or leave blank (Never)",
"Required": false,
"Validation": "",
"DefaultValue": ""
},
{
"$type": "SoftwareIDM.ReportingModule.Models.TextReportParameter, SoftwareIDM.ReportingModule",
"Name": "Logon After",
"Description": "Enter a timespan to subtract from present e.g. '365.00:00:00', or leave blank",
"Required": false,
"Validation": "",
"DefaultValue": ""
},
{
"$type": "SoftwareIDM.ReportingModule.Models.TextReportParameter, SoftwareIDM.ReportingModule",
"Name": "Department",
"Description": "Enter a value the department should contain or '*' for all",
"Required": false,
"Validation": "",
"DefaultValue": "*"
}
],
"Data": [
{
"$type": "SoftwareIDM.ReportingModule.Models.ReportData, SoftwareIDM.ReportingModule",
"Name": "Licenses",
"Report": "42e60d8a-5694-4349-b252-90cbe23fdaf8",
"Aliases": null,
"MapRule": null,
"MemoRules": []
}
],
"Relations": [],
"FieldProjections": [
{
"$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
"Name": "License",
"RelationName": "",
"RelationSide": null,
"ValueRule": "License"
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
"Name": "LastLogon",
"RelationName": "",
"RelationSide": null,
"ValueRule": "// Can also do something like FirstNotNull(lastLogonTimestamp, lastLogon)\nIf(\n Not(lastLogonTimestamp),\n \"Never\",\n DateTimeFormat(FromFileTime(lastLogonTimestamp), \"yyyy-MM-dd\")\n)"
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
"Name": "EmployeeID",
"RelationName": "",
"RelationSide": null,
"ValueRule": "employeeId"
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
"Name": "EmployeeType",
"RelationName": "",
"RelationSide": null,
"ValueRule": "employeeType"
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
"Name": "Department",
"RelationName": "",
"RelationSide": null,
"ValueRule": "Department"
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
"Name": "Title",
"RelationName": "",
"RelationSide": null,
"ValueRule": "Title"
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
"Name": "DisplayName",
"RelationName": "",
"RelationSide": null,
"ValueRule": "DisplayName"
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
"Name": "AccountName",
"RelationName": "",
"RelationSide": null,
"ValueRule": "sAMAccountName"
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
"Name": "Mail",
"RelationName": "",
"RelationSide": null,
"ValueRule": "mail"
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
"Name": "UserAccountControl",
"RelationName": "",
"RelationSide": null,
"ValueRule": "userAccountControl"
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
"Name": "employeeNumber",
"RelationName": "",
"RelationSide": null,
"ValueRule": "employeeNumber"
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
"Name": "Manager",
"RelationName": "",
"RelationSide": null,
"ValueRule": "Manager"
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
"Name": "DN",
"RelationName": "",
"RelationSide": null,
"ValueRule": "AD DN"
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
"Name": "Id",
"RelationName": "",
"RelationSide": null,
"ValueRule": "Id"
}
],
"Transformations": [
{
"$type": "SoftwareIDM.ReportingModule.Models.Transform, SoftwareIDM.ReportingModule",
"FilterRule": "If(Memo(\"Flag\") == \"*\", true, Contains(UserAccountControl, Memo(\"Flag\")))",
"GroupingRule": "",
"TransformRules": []
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Transform, SoftwareIDM.ReportingModule",
"FilterRule": "If(Memo(\"License\") == \"*\", true, Contains(License, Memo(\"License\")))",
"GroupingRule": "",
"TransformRules": []
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Transform, SoftwareIDM.ReportingModule",
"FilterRule": "If(Memo(\"Employee Type\") == \"*\", true, Contains(EmployeeType, Memo(\"Employee Type\")))",
"GroupingRule": "",
"TransformRules": []
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Transform, SoftwareIDM.ReportingModule",
"FilterRule": "If(Memo(\"Department\") == \"*\", true, Contains(Department, Memo(\"Department\")))",
"GroupingRule": "",
"TransformRules": []
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Transform, SoftwareIDM.ReportingModule",
"FilterRule": "Or(Not(Memo(\"Logon Before\")), And(LowerCase(Memo(\"Logon Before\")) == \"never\", LastLogon == \"Never\"), AddTime(Today(), \"-\" + Memo(\"Logon Before\")) < LastLogon)",
"GroupingRule": "",
"TransformRules": []
},
{
"$type": "SoftwareIDM.ReportingModule.Models.Transform, SoftwareIDM.ReportingModule",
"FilterRule": "Or(Not(Memo(\"Logon After\")), And(LowerCase(Memo(\"Logon After\")) == \"never\", LastLogon == \"Never\"), AddTime(Today(), \"-\" + Memo(\"Logon After\")) > LastLogon)",
"GroupingRule": "",
"TransformRules": []
}
],
"Styles": [],
"Sort": {
"Field": "EmployeeID",
"Direction": "Ascending"
}
}
],
"Count": 1
}
Comments
0 comments
Please sign in to leave a comment.