Created by Claude - please verify

SaaS usage - distinct users per third-party app from the cached 7-day interactive sign-ins, compared with app assignments.

Required Microsoft Graph permissions

AuditLog.Read.All Application.Read.All — application permissions, granted to the app registration with admin consent.

Licence: Microsoft Entra ID P1 (sign-in logs).

Endpoints: GET /beta/auditLogs/signIns (cached, 7 days) · GET /v1.0/servicePrincipals/{id}/appRoleAssignedTo ($batch)

Assignments through groups are counted as groups, not expanded into users. A week is short - run it at different times before a renewal.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

SaaS App Usage & Seat True-up (7 days)

How many people actually use Salesforce, Zoom, Adobe or any other SSO app compared with how many seats are assigned? Bring this to the contract renewal. Inactive Enterprise Apps only shows each app's last sign-in.