SaaS App Usage & Seat True-up (7 days)
The question it answers: How many users actually signed in to each SSO app in the last 7 days compared with the users assigned to it?
How many people actually use Salesforce, Zoom, Adobe or any other SSO app compared with how many seats are assigned? Bring this to the contract renewal. Inactive Enterprise Apps only shows each app’s last sign-in.
At a glance
Section titled “At a glance”| Where in the app | Entra ID › Sign-in & Audit Investigations › SaaS Usage & Seat True-up |
| Workload | Licensing |
| Kind | Findings list · dashboard tile |
| Data | Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). |
| Licence | Microsoft Entra ID P1 (sign-in logs). |
| Report id (API and MCP) | entra.investigations.saas-usage |
Columns
Section titled “Columns”| Column | Key | Type |
|---|---|---|
| Severity | Severity | Status |
| Assignment | Category | Text |
| App | Subject | Link |
| Check | Setting | Text |
| Users signing in / assigned users / groups | Value | Text |
| Finding | Finding | Text |
| App id | Detail | Text |
| Last sign-in | When | Date |
| Active users (7 days) | Number | Number |
A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).
What it needs
Section titled “What it needs”Licence: Microsoft Entra ID P1 (sign-in logs).
Application permissions on the IntensiveReports app registration (all permissions):
| Permission | API | What it allows | Note |
|---|---|---|---|
AuditLog.Read.All | Microsoft Graph | Read all audit log data | |
Application.Read.All | Microsoft Graph | Read all applications |
Data sources it reads
GET /beta/auditLogs/signIns (cached, 7 days)GET /v1.0/servicePrincipals/{id}/appRoleAssignedTo ($batch)
Through the API and MCP
Section titled “Through the API and MCP”GET /ir-api/v1/reports/entra.investigations.saas-usage?size=100An AI assistant reads it with the MCP tool get_report and the id entra.investigations.saas-usage. The client needs the Read grant for Licensing. See Using the API.