Written for the person who has to say yes.

A Global Administrator of your tenant grants consent once, through Microsoft’s standard admin-consent dialog. That authorizes the “LicenseMeter Connector” application for application permissions that are read-only without exception. LicenseMeter then syncs nightly using its own credential: no service account in your tenant, no agent, no mailbox plugin. You can revoke the application in Entra ID at any time, independently of us.

• User.Read.Alldirectory users, enabled state, assigned licenses
• AuditLog.Read.Alllast sign-in timestamps (needs Entra ID P1)
• Reports.Read.Allusage and Copilot activity reports
• LicenseAssignment.Read.Allpurchased vs assigned seat counts
• ReportSettings.Read.Allwhether report names are concealed

The consent is recorded in your tenant’s audit log. Sign-in to the dashboard itself uses a separate app registration with only openid, profile and email.

Tenant-wide admin consent for Microsoft Graph application permissions (the kind listed above) can be granted by a Global Administrator or a Privileged Role Administrator; an Application Administrator is not sufficient for Graph application permissions, a boundary Microsoft sets, not us. Entra ID does let an organization delegate this consent narrowly: an app consent policy pinned to exactly these 5 read-only permissions and to the LicenseMeter connector app, attached to a custom directory role. The one-time setup itself requires a Privileged Role Administrator or Global Administrator and Microsoft Graph PowerShell (the role permission cannot be added in the Entra portal yet) and belongs in your identity team’s review.

# One-time setup - requires Privileged Role Administrator or Global Administrator.
Connect-MgGraph -Scopes "Policy.ReadWrite.PermissionGrant","RoleManagement.ReadWrite.Directory"

# Microsoft Graph service principal; app-role IDs looked up by permission
# name, so the grant covers exactly what the consent screen shows.
$graphSp = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"
$permissionNames = @(
  "User.Read.All",
  "AuditLog.Read.All",
  "Reports.Read.All",
  "LicenseAssignment.Read.All",
  "ReportSettings.Read.All"
)
$permissionIds = $graphSp.AppRoles |
  Where-Object { $_.Value -in $permissionNames } |
  ForEach-Object { $_.Id }

# Abort rather than create a policy with an empty permission list - an empty
# list would mean "all permissions of this resource", far broader than intended.
if ($permissionIds.Count -ne $permissionNames.Count) {
  throw "Resolved $($permissionIds.Count) of $($permissionNames.Count) permission IDs - aborting. Update the Microsoft.Graph module and retry."
}

# App consent policy: exactly these application permissions, only for the
# LicenseMeter connector as the client app.
New-MgPolicyPermissionGrantPolicy `
  -Id "licensemeter-read-only" `
  -DisplayName "LicenseMeter read-only consent" `
  -Description "Admin consent for the LicenseMeter connector's read-only Graph permissions only."

New-MgPolicyPermissionGrantPolicyInclude `
  -PermissionGrantPolicyId "licensemeter-read-only" `
  -PermissionType "application" `
  -ResourceApplication $graphSp.AppId `
  -Permissions $permissionIds `
  -ClientApplicationIds @("1a1a346a-05d5-4f54-87a5-5b5e63f9c610")

# Custom directory role whose only permission is consenting under that policy.
New-MgRoleManagementDirectoryRoleDefinition -BodyParameter @{
  displayName     = "LicenseMeter Consent Approver"
  description     = "Grants tenant-wide admin consent for the LicenseMeter connector's read-only permissions, nothing else."
  isEnabled       = $true
  rolePermissions = @(
    @{ allowedResourceActions = @(
      "microsoft.directory/servicePrincipals/managePermissionGrantsForAll.licensemeter-read-only"
    ) }
  )
}

# Assign the role in the portal: Entra ID > Roles and administrators >
# "LicenseMeter Consent Approver" > Add assignment.

No role with consent rights at hand today? The CSV trial computes your waste number from two Microsoft 365 admin center exports, with no consent at all. The link signs you in with Microsoft first.

• ×Mailbox content, attachments or calendars
• ×Files in OneDrive, SharePoint or Teams
• ×Teams messages or meeting content
• ×Passwords, credentials or security tokens of your users
• ×Any write access: LicenseMeter cannot change anything in your tenant

Usage reports are consumed as counts and last-activity dates only: metadata, never content.

• ·License SKUs with purchased and assigned seat counts
• ·Directory users: display name, UPN, enabled state, user type, creation date, assigned licenses
• ·Last sign-in timestamps (when your tenant has Entra ID P1) and per-workload last-activity dates
• ·The prices you enter in the price book and the findings derived from the above
• ·If you connect Adobe, Zoom, Atlassian, Salesforce, OpenAI or Anthropic (all optional): seat or console-member emails, status, product assignments and last-login dates where the provider exposes them, plus daily API cost totals for OpenAI and Anthropic; the credentials themselves are stored encrypted (AES-256-GCM) and used read-only
• ·If you import ChatGPT or Claude member lists (optional CSV paste): the member emails, names, seat types and last-active dates contained in the data you paste
• ·A per-workspace activity log of exports and administrative actions, deleted with the workspace

Access to a workspace is invite-based. Signing in with an account from your tenant grants nothing by itself; the admin who completed consent decides who sees the data and in which role.

Customer application data is stored in the EU in a Supabase Postgres database hosted on AWS eu-central-1 (Frankfurt), matching the current Privacy Policy wording. Data is retained only while your tenant is connected. Disconnecting the workspace (Settings → Danger zone) deletes all synced data immediately and irreversibly: users, findings, prices, history. Revoking the enterprise application in your Entra ID additionally cuts our access at the source.

• Vercel Inc.Application hosting and content delivery. EU (Frankfurt function region).
• Supabase Inc.Managed PostgreSQL database (primary data store). EU (AWS eu-central-1, Frankfurt).
• Microsoft (Microsoft Ireland Operations Ltd. / Microsoft Corporation)Identity platform (sign-in, admin consent) and Microsoft Graph API. EU Data Boundary; US fallback.
• WorkOS, Inc.Authentication and user identity management (AuthKit sign-in), where enabled. US.
• Stripe (Stripe Payments Europe Ltd. / Stripe, Inc.)Billing and subscription management (for paid plans). EU and US.
• Resend Inc.Transactional and notification email delivery. EU (Ireland region).

The definitive subprocessor list is part of the DPA.

LicenseMeter processes directory data on your behalf, so a data processing agreement under Art. 28 GDPR (AVV) is part of every subscription. The full text is published on our Data Processing Agreement page, where you can download the pre-signed PDF in English or German, add your details and counter-sign it. No need to email and wait.

Microsoft publisher verification for the LicenseMeter app registrations is in progress. Until it completes, the consent dialog shows the apps as unverified, and tenants with strict consent policies may block them. Microsoft displays the verification status directly in the consent dialog, so your admin can always confirm the current state independently of this page.

LicenseMeter is built and maintained by Ugur Koc, Microsoft MVP for Intune and Security Copilot. The operating company is UgurLabs UG (haftungsbeschränkt) in Düsseldorf, Germany, the same legal entity named in the Imprint and in every DPA, and the read-only design principles documented on this page apply to the entire product.

Security review, pentest coordination or vendor questionnaires: customer-care@ugurlabs.odoo.com. See also the FAQ and Privacy Policy.