title: How Certification Center finds unused licenses category: License Management tags: license reconciliation, sign-in activity, license monitoring priority: Normal
How Certification Center finds unused licenses
License-waste monitoring works by reconciling the licenses you have assigned in Microsoft 365 / Entra against real sign-in activity. This article explains the data it uses, how it decides a seat is idle, and how often the numbers refresh.
The short version
For every account, Certification Center answers two questions and compares the answers:
- What licenses are assigned to this account?
- When did this account last actually sign in?
If an account holds a paid license but has not signed in during your lookback window, the seat is flagged as reclaimable. That is the whole idea — you should not pay for a seat nobody uses.
The data it reconciles
| Data point | Source | Why it matters |
|---|---|---|
| Assigned licenses / SKUs | Entra ID connector | Tells you what you are paying for, per account |
| Last interactive sign-in | Entra sign-in activity | Tells you whether the account is actually in use |
| Account status | Entra directory | A disabled account with a license is pure waste |
| Person mapping | Certification Center identity model | Rolls accounts up to the real person so duplicates are visible |
| Unit cost | Entered by you under SKU costs | Turns idle-seat counts into currency |
All of this comes through the Entra ID connector you already use for directory sync — there is no separate agent or install.
How a seat is judged idle
Reconciliation compares the last-sign-in date against the lookback window you set (for example 30, 60, or 90 days).
| Condition | Result |
|---|---|
| Last sign-in is inside the window | Active — not flagged |
| Last sign-in is outside the window | Idle — flagged as reclaimable |
| No sign-in on record at all | Idle — flagged (never used) |
| Account disabled, license still assigned | Idle and high priority — flagged |
Interactive sign-ins are what count. An occasional automated or non-interactive token is not the same as a person using the seat, and the goal is to find seats no person is using.
Choosing a lookback window
The window is the single biggest lever on your results.
| Window | Behaviour | Good for |
|---|---|---|
| 30 days | Aggressive — surfaces the most waste | Fast cleanup where you can tolerate reviewing a few seasonal users |
| 60 days | Balanced | Most organisations' default |
| 90 days | Conservative — fewest false positives | Environments with quarterly or occasional users |
Because every flagged seat can be routed through a reviewer before anything changes, a shorter window is safe to experiment with — the reviewer is the backstop against a false positive.
How often the numbers refresh
Recoverable-spend figures are only as current as the last directory sync. When a sync completes:
- Newly idle accounts appear
- Accounts that have signed in since the last run drop off the list
- Reclaimed seats disappear from the idle count
Run your Entra sync on a regular cadence (daily or weekly is typical) so the license view stays trustworthy. See How Certification Center finds unused licenses alongside your connector's sync schedule.
What it does not do
- It does not guess your Microsoft pricing — you enter unit costs so spend figures are accurate to your contract.
- It does not silently strip licenses — reclaiming is an explicit action, and the certification path keeps a human in the loop.
- It covers Microsoft 365 / Entra license reconciliation. It is not a general-purpose SaaS-spend tool for unrelated third-party apps.
Turning findings into savings
Reconciliation only surfaces the waste. To actually recover it, you either reclaim seats directly or route them through an access review so a manager confirms first. Both paths write back through the connector and are recorded in the audit trail.