AuditLog.Read.All
Directory.Read.All
User.Read.All
Organization.Read.All
— application permissions, granted to the app registration with admin consent.
Licence: Microsoft Entra ID P1 - required for sign-in activity. Without it the report still finds disabled and past-leave-date accounts, but not inactive ones.
Endpoints:
GET /v1.0/users?$select=signInActivity · GET /v1.0/subscribedSkus
No Graph call is made when you open this page - it is a join over data already in the cache.
If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.
Licence Reclamation Candidates
Licensed accounts that look like they are being paid for and not used: disabled accounts, accounts whose employee leave date has passed, accounts that never signed in, and accounts with no sign-in for more than 90 days. Built from cached users, subscribed SKUs and sign-in activity - no extra Graph call is made when you open this page.
No reclamation candidates were found. Please contact support if this is not the expected result.