Licence Reclamation Candidates

The question it answers: Which licensed accounts are disabled, past their leave date, never signed in or inactive, so their licences can be reclaimed?

Licensed accounts that look like they are being paid for and not used: disabled accounts, accounts whose employee leave date has passed, accounts that never signed in, and accounts with no sign-in for longer than the inactivity threshold (Settings > Report thresholds). Built from cached users, subscribed SKUs and sign-in activity - no extra Graph call is made when you open this page. Before you remove anything: shared and resource accounts legitimately never sign in - check the account type first; removing an Exchange licence starts a 30-day grace period, after which the mailbox is deleted; group-based licence assignments must be removed from the group, not the user.

Note

No Graph call is made when you open this page - it is a join over data already in the cache.

At a glance

Where in the app	Licensing › Licence Reclamation
Workload	Licensing
Kind	Table · dashboard tile
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	Microsoft Entra ID P1 - required for sign-in activity. Without it the report still finds disabled and past-leave-date accounts, but not inactive ones.
Report id (API and MCP)	entra.licensing.licence-reclamation

Columns

Column	Key	Type
Display Name	DisplayName	Link
User Principal Name	UserPrincipalName	Text
Severity	Severity	Status
Why	Reason	Text
Licences	LicenseCount	Text
Assigned products	AssignedLicensesString	Text
Last sign-in	LastActivityDateTime	Date
Enabled	AccountEnabled	Text

What it needs

Licence: Microsoft Entra ID P1 - required for sign-in activity. Without it the report still finds disabled and past-leave-date accounts, but not inactive ones.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
AuditLog.Read.All	Microsoft Graph	Read all audit log data
Directory.Read.All	Microsoft Graph	Read directory data
User.Read.All	Microsoft Graph	Read all users’ full profiles
User-LifeCycleInfo.Read.All	Microsoft Graph	Read all users’ lifecycle information
Organization.Read.All	Microsoft Graph	Read organization information

Data sources it reads

• GET /v1.0/users?$select=signInActivity
• GET /v1.0/subscribedSkus

Through the API and MCP

GET /ir-api/v1/reports/entra.licensing.licence-reclamation?size=100

An AI assistant reads it with the MCP tool get_report and the id entra.licensing.licence-reclamation. The client needs the Read grant for Licensing. See Using the API.