Skip to content
AscendCore
Back to Runbook Library
Provisioning Live in production

Unused License Reclamation

Find licensed Microsoft 365 accounts that are disabled or inactive beyond your threshold and reclaim the reviewed seats in one approval, fully audited.

Integrates with

M365

The problem

License spend drifts upward as seats stay assigned to people who left or stopped using the product. Without a regular sweep, the waste only surfaces at renewal, long after the budget is spent.

What AscendCore does

On demand from Slack or Teams, AscendCore scans every licensed Microsoft 365 account and posts a single review card of reclaimable seats, capped per review. Disabled accounts still holding licenses are always proposed (the highest-confidence reclaim); accounts inactive beyond your threshold are proposed when sign-in data is available, and the card says so when it is not. One approval removes all licenses from the reviewed set. Every account is re-verified at execution: an account that signed in after the card was posted is refused rather than stripped, and an account someone already reclaimed is skipped, not failed. Accounts with no recorded sign-in are counted on the card but never proposed, because missing sign-in data is not evidence of inactivity. The freed seats and per-account outcomes are recorded in the audit chain.

Status

Live in production. Runs against a real Microsoft 365 tenant today from Slack and Teams. The disabled-account tier (still-licensed accounts that are disabled, the highest-confidence reclaim) works on base directory permissions; the dormancy tier (accounts inactive beyond your threshold) requires sign-in telemetry, which needs AuditLog.Read.All and Entra ID P1, and the card says so when that data is not available. One approval removes the licenses from the reviewed set, re-verifying each account at execution so a recently-active account is refused rather than stripped and an already-reclaimed account is skipped, not failed. Freed seats and per-account outcomes are recorded in the audit chain. The inactivity threshold is configurable per review (30 to 365 days, default 90).

Runbook source preview

Versioned, deterministic, auditable

Every runbook is defined as a versioned YAML manifest with explicit triggers, steps, and approval policies. The runbook itself is the audit-ready record of what AscendCore can and will do. Chat is just the interface that triggers it.

name: unused-license-reclamation
trigger:
  channels: [slack, teams]
  commands: [license-reclaim]
steps:
  - scan_licensed_accounts     # disabled or inactive beyond threshold, capped
  - build_reclaim_card
  - admin_approval             # destructive styling
  - reverify_each_account      # drift gate, recently-active refuses
  - revoke_licenses            # per-account, freed seats reported
approval:
  required: true
  approvers: [it-admins]
Ready to deploy

Run unused license reclamation from Teams or Slack today

AscendCore deploys in days, not months for Slack + Okta or Teams + Entra stacks. See your first automated resolution the same day.