Explore users

Overview

The Users tab in Explore lists every user that the last sync read from a tenant. For each user you see the licenses held, the last sign-in, and whether multi-factor authentication (MFA) is registered. You can filter the list, download it to Excel, open a record for one person, request changes to their licenses and Microsoft Entra ID groups, and exclude them from removals.

Explore is read-only until you act on a record. A change you request becomes a task in Optimization and needs approval before anything changes in Microsoft 365.

Business value

You can answer questions such as who is disabled but still licensed, who never signed in, and who has no MFA, without leaving Turbo360. When you find a problem, you raise the fix from the same record.

Prerequisites

Before you use the tab, connect the tenant and let it finish its first sync. See Connect a Microsoft 365 tenant.

Required permissions

You need Read on Explore to view users and open records. You need Manage on Explore to request changes and to exclude users from removals. The Owner and Contributor roles have both. The Reader role has Read only. For details, see Roles and permissions in Tenant Manager.

Dependencies

• Last sync: the list shows what the last sync read from Microsoft. It isn't live.
• AuditLog.Read.All: this Microsoft Graph permission lets Tenant Manager read each user's last sign-in and MFA registration. Without it, MFA shows "Not known", and so does Last activity for a person who has no activity date. The filters that depend on them are turned off.
• Microsoft Entra ID P1: Microsoft provides sign-in data only for a tenant that has P1 or P2. Without it, Last activity comes from Microsoft 365 usage reports instead, and those need the Reports.Read.All permission. See the sign-in card under User record.
• Profile photo: the photo on a user record is read from Microsoft when you open the record, so it isn't from the last sync. It needs the ProfilePhoto.Read.All or User.Read.All permission. Without one, the record shows the person's initials.

How it works

Explore has four tabs: Users, Groups, Licenses, and Change tracking. Select the tenant in the tree view, expand License management, and select Explore. The Users tab opens first. Explore is available for a tenant only, not for a tenant group. Changing the tenant in the tree view resets your filters.

Four tiles sit above the grid. Selecting a tile picks the matching filter.

Filters

The filter pills above the grid cut the list. Picking a filter clears any column filters. Some filters are in the More filters list.

Inactive, Never signed in, and No MFA are turned off when no user has sign-in data. Hover over the help icon to see why. Activity means an interactive sign-in, or use of email, Teams, SharePoint, or OneDrive. A background sign-in counts as activity only when Microsoft's usage reports have nothing for that person.

Columns

The grid shows these columns by default. You can add the others in Column options.

The columns that are hidden by default are Tenant, Licenses, Sign-in name, Office, Usage location, Manager, Source (cloud-native or on-premises sync), Disabled since, and Created. Disabled since is the time the sync first found the account disabled. Microsoft doesn't record when an account was disabled, so it may have happened earlier.

User record

Selecting a row opens the record of that person. Use ‹ and › to step through the users in the same order as the grid, including its sort, filters, and page. Inside a record, the names of related groups, users, and licenses are links. Selecting one opens that record on top of the current one, and closing it returns you to the record underneath.

The Last interactive sign-in card shows the date of the person's last interactive sign-in. When the person has no sign-in date and none of the users in the tenant has one, which is the case for a tenant with no Microsoft Entra ID P1 on record, the card reads "Not available". A note under it says that the tenant doesn't have Microsoft Entra ID P1, so Microsoft doesn't provide its sign-in or MFA data, and that last activity comes from Microsoft 365 usage reports instead: email read or sent, and Teams, SharePoint, or OneDrive use. When the tenant does have sign-in data but nothing is on record for this person, the card says that Microsoft Entra ID has no sign-in on record for the account.

Steps

The steps below cover the common tasks on the Users tab. You start in Explore for the tenant, with the Users tab open.

Find users with a filter

This procedure narrows the list to the users you want to review.

1. Select a tile or a filter pill, for example Disabled or Inactive.
2. To narrow further, use the filter menu of a column. The same menu lets you sort by that column.
3. Select a row to open the record of a person.

The grid shows 100 users on a page. Sorting works on one column at a time.

Explain a user

This procedure shows an explanation in plain words of who a person is, what their licenses let them do, the groups and roles they hold, and anything worth a second look.

1. Select the row of the user to open the record.
2. Select the AI agents tab.
3. On the Explain this user card, select Generate.

The explanation appears section by section. It is based on the last sync, so it isn't live, and running it again gives the same result. A note under the explanation says that it is AI-generated and that you should review it before acting. If an explanation takes longer than five minutes, it stops and a message says so.

Turbo360 does not store the explanation. If you open the same record again in the same browser session, the explanation you already generated is shown without a new request. If you do not see the AI agents tab, see Access and permission issues.

Change the Inactive line

This procedure sets how long a user has to be inactive before they appear under Inactive.

1. On All users or Inactive, select Filter settings.
2. In Inactive for more than, pick 7, 30, 60, or 90 days, or choose Custom and enter a number of days.
3. Select Apply. Select Clear to go back to the default.

The setting is stored in your browser and is shared with Optimization. Other people can have a different line.

Download the list to Excel

This procedure saves the users that match your filters to a file named "Tenant Manager - Users.xlsx".

1. Set the filter and column filters that you want.
2. Select Download as Excel.

The file has every row that matches your filters, not only the rows on the current page, and only the columns that are visible.

Choose the columns

This procedure shows, hides, and reorders columns.

1. Select Column options.
2. Tick or clear the columns. A column with a grayed-out box is always shown.
3. To change the order, drag a row.

Your choice is remembered in your browser.

Request a change for a user

This procedure creates a task in Optimization for an approver to decide. Nothing changes in Microsoft 365 until the task is approved.

1. Select the row of the user to open the record.
2. Select Actions. On the Licenses or Groups tab, use the Actions menu of that tab.
3. Choose a request: Request to disable account, Request to enable account, Request to add license, Request to remove licenses, Request to add to group, or Request to remove from groups. You can also remove one item from its row.
4. For an add request, choose the licenses or Microsoft Entra ID groups in the dialog. They are sent as one request.
5. Read the confirmation, and select Send request.

To remove several licenses or groups in one request, tick the rows on the Licenses or Groups tab, and then choose Request to remove licenses or Request to remove from groups from the Actions menu of that tab.

The request appears in Optimization > Tasks with the status Awaiting approval. For what happens next, see Recommendations and savings.

Exclude a user from removals

This procedure protects a person from every removal that Tenant Manager can make.

1. Open the record of the user, and select Actions > Exclude from removals.
2. Enter a Reason if you want to record one. For example, a break-glass admin account or a service account.
3. Select Exclude.

No task or automation removes a license from this person, takes them out of a Microsoft Entra ID group, or removes them as a group owner. Exclusion blocks removals only. You can still request to disable the account, and adding licenses or group access is still allowed. The change takes effect at once, nothing is sent to Microsoft, and it is recorded in the activity log. The user appears under the Excluded filter, and the Removals badge on the Summary tab shows Excluded. Hover over the badge to see the reason, who excluded the user, and when.

If you select several users in one removal request and only some are excluded, Tenant Manager skips the excluded users and sends the request for the rest. A task that was approved before you excluded the user is still refused. Optimization doesn't list an excluded user in recommendations that remove licenses, and license removal automations skip the user.

Include a user in removals again

This procedure lets tasks and automations remove licenses and Microsoft Entra ID group access from the person again.

1. Open the record of the user, and select Actions > Include in removals.
2. Read the confirmation, and select Continue.

Configuration

The Filter settings panel has one option.

Permission behavior

What you can do in Explore depends on your role.

• Without Read on Explore, the page shows "You do not have access to this page".
• Without Manage on Explore, the request and exclusion actions are disabled. Hover over one to see "You are not authorized to perform this operation".
• A request is blocked when the same change is already waiting for approval. Decide that task in Optimization > Tasks first.
• You can't remove anything from an excluded user. Include the user first if the removal is intended.
• A license that comes through a Microsoft Entra ID group can't be removed from the person directly. Remove the person from the group, or change the group's licenses.
• Tenant Manager can't change the members of dynamic Microsoft Entra ID groups, groups synced from on-premises, or distribution and mail-enabled security groups. A request to add a person to or remove a person from one of these groups is refused with a message that explains why.
• The AI agents tab needs the Use AI agents permission and the account's AI agents switch. Without them, the tab is hidden.

Example scenario

After a round of departures at Trey Research, Tobias Brandt, a module owner, opens Explore for the tenant Trey Research Berlin and selects Reclaimable seats. The grid lists the disabled accounts that still hold paid licenses.

He opens the record of one user, selects the Licenses tab, and chooses Request to remove licenses. A task appears in Optimization for approval. He then opens the record of an account used by a payroll automation, selects Exclude from removals, and enters "Payroll automation" as the reason, so no task or automation ever removes its licenses.

Limitations

• Explore is available for a tenant, not for a tenant group.
• You can't edit user data in the grid. A row opens the record, and nothing in a cell acts.
• The list shows the last sync. It isn't live.
• Last activity and MFA need the AuditLog.Read.All permission.
• Exclusion protects against removals only. Adding is still allowed, and so is Request to disable account.
• An explanation reflects the last sync, and you can't regenerate, save, or share it.

Troubleshooting

1. Last activity and MFA show "Not known", and some filters are turned off.
   Cause: the connection doesn't have the AuditLog.Read.All permission, or the tenant has no Microsoft Entra ID P1, so no user has a sign-in date. A warning icon next to Last synced shows the issue when you hover over it. Hovering over the MFA value also shows the reason.
   Fix: grant the permission with admin consent on the app registration, and then select Sync. Sign-in data also needs Microsoft Entra ID P1 or P2.

2. A message says that some data could not be loaded, or excluding a user fails.
   Cause: one of the reads for the page failed, so the list may be incomplete. Or a later sync removed the user from the tenant ("That user is no longer in this tenant."), or the user is outside the access of your role ("You can only change users you can see.").
   Fix: reload the page. If the message returns, check that your Tenant Manager access covers this tenant. A message that reads "This tenant is outside your Tenant Manager access" means your role isn't granted on it. If the user is outside your access, ask an administrator who can manage Tenant Manager access.

3. A removal request is blocked and says that the user is excluded.
   Cause: the user is excluded from removals in Tenant Manager.
   Fix: include the user in removals first, if the removal is intended.

4. A request says that the change is already requested and waiting for approval.
   Cause: an open task already covers that person and change.
   Fix: approve or decline the task in Optimization > Tasks, and then raise the request again.

5. The page shows "No users synced yet".
   Cause: the tenant hasn't completed a sync.
   Fix: sync the tenant. Syncing needs the Manage tenants permission.

FAQs

1. Does a request change anything in Microsoft 365?
   No. A request creates a task. Nothing changes until an approver approves the task.

2. What is the difference between Inactive here and idle seats on Overview?
   Inactive uses the line you set in Filter settings, and the default is 30 days. Overview counts a seat as idle when the user is disabled or has had no activity for 90 days, based on last activity, and that line is fixed.

3. Does excluding a user change anything in Microsoft 365?
   No. The exclusion is saved in Tenant Manager only. It stops tasks and automations from removing things from that person.

Related articles

• Tenant overview
• Explore groups
• Explore licenses
• Change tracking
• Recommendations and savings
• How data sync works
• Roles and permissions in Tenant Manager
• License tasks
• License removal automation
• Optimization overview