---
title: "Explore users"
slug: "explore-users-in-tenant-manager"
updated: 2026-11-02T06:53:54Z
published: 2026-11-02T06:53:54Z
canonical: "docs.turbo360.com/explore-users-in-tenant-manager"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.turbo360.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Explore users

## Overview

The **Users** tab in Explore lists every user that the last sync read from a tenant. For each user you see the licenses held, the last sign-in, and whether multi-factor authentication (MFA) is registered. You can filter the list, download it to Excel, open a record for one person, request changes to their licenses and Microsoft Entra ID groups, and exclude them from removals.

Explore is read-only until you act on a record. A change you request becomes a task in Optimization and needs approval before anything changes in Microsoft 365.

### Business value

You can answer questions such as who is disabled but still licensed, who never signed in, and who has no MFA, without leaving Turbo360. When you find a problem, you raise the fix from the same record.

## Prerequisites

Before you use the tab, connect the tenant and let it finish its first sync. See [Connect a Microsoft 365 tenant](https://docs.turbo360.com/docs/connect-a-microsoft-365-tenant).

### Required permissions

You need **Read** on Explore to view users and open records. You need **Manage** on Explore to request changes and to exclude users from removals. The **Owner** and **Contributor** roles have both. The **Reader** role has **Read** only. For details, see [Roles and permissions in Tenant Manager](https://docs.turbo360.com/docs/tenant-manager-roles-and-permissions).

### Dependencies

- **Last sync:** the list shows what the last sync read from Microsoft. It isn't live.
- **AuditLog.Read.All:** this Microsoft Graph permission lets Tenant Manager read each user's last sign-in and MFA registration. Without it, **MFA** shows "Not known", and so does **Last activity** for a person who has no activity date. The filters that depend on them are turned off.
- **Microsoft Entra ID P1:** Microsoft provides sign-in data only for a tenant that has P1 or P2. Without it, **Last activity** comes from Microsoft 365 usage reports instead, and those need the Reports.Read.All permission. See the sign-in card under User record.
- **Profile photo:** the photo on a user record is read from Microsoft when you open the record, so it isn't from the last sync. It needs the ProfilePhoto.Read.All or User.Read.All permission. Without one, the record shows the person's initials.

## How it works

Explore has four tabs: **Users**, **Groups**, **Licenses**, and **Change tracking**. Select the tenant in the tree view, expand **License management**, and select **Explore**. The **Users** tab opens first. Explore is available for a tenant only, not for a tenant group. Changing the tenant in the tree view resets your filters.

Four tiles sit above the grid. Selecting a tile picks the matching filter.

| Tile | What it shows |
| --- | --- |
| Users in scope | The number of users, split into enabled and disabled. |
| Reclaimable seats | The paid seats still assigned to disabled accounts, and how many accounts hold them. Selecting it lists exactly those accounts and shows a note with a **Show all** button that returns you to the full list. |
| Guests | The number of users who are guests. |
| No MFA | The users who haven't registered for MFA. Shows NA when the tenant has no sign-in data. |

### Filters

The filter pills above the grid cut the list. Picking a filter clears any column filters. Some filters are in the **More filters** list.

| Filter | Users it lists |
| --- | --- |
| All users | Every user. |
| Licensed | Users who hold at least one license, paid or trial. |
| Unlicensed | Users who hold no license. |
| Inactive > n days | Enabled users whose last activity is older than the Inactive line. The default line is 30 days. |
| Never signed in | Enabled users with no sign-in of either kind (interactive or background) on record who were created more than 7 days ago. |
| Disabled | Users whose account is disabled. |
| Guests | Users who are guests. |
| No MFA | Users whose MFA registration is known and not registered. |
| Excluded | Users you excluded from removals. |

**Inactive**, **Never signed in**, and **No MFA** are turned off when no user has sign-in data. Hover over the help icon to see why. Activity means an interactive sign-in, or use of email, Teams, SharePoint, or OneDrive. A background sign-in counts as activity only when Microsoft's usage reports have nothing for that person.

### Columns

The grid shows these columns by default. You can add the others in **Column options**.

| Column | What it shows |
| --- | --- |
| Display name | The user's name. Hover to see the email. This column is always shown. |
| Email | The user's email address. |
| User type | Member, an account from your organization, or Guest, an outside account that was invited. |
| Job title and Department | The values from Microsoft Entra ID. |
| Account | Enabled or Disabled. It comes from the account-enabled setting in Microsoft Entra ID. |
| Last activity | The last time the person signed in, or "Never signed in" or "Not known". "Not known" shows when the person has no activity date. |
| MFA | Registered, Not registered, or Not known. "Not known" shows when no user in the tenant has sign-in data, because the tenant has no Microsoft Entra ID P1 or the AuditLog.Read.All permission isn't granted. Hover over it to see the reason. |

The columns that are hidden by default are **Tenant**, **Licenses**, **Sign-in name**, **Office**, **Usage location**, **Manager**, **Source** (cloud-native or on-premises sync), **Disabled since**, and **Created**. **Disabled since** is the time the sync first found the account disabled. Microsoft doesn't record when an account was disabled, so it may have happened earlier.

### User record

Selecting a row opens the record of that person. Use **‹** and **›** to step through the users in the same order as the grid, including its sort, filters, and page. Inside a record, the names of related groups, users, and licenses are links. Selecting one opens that record on top of the current one, and closing it returns you to the record underneath.

| Tab | What it shows |
| --- | --- |
| Summary | Tiles for licenses, monthly cost, user type, and Microsoft Entra ID groups. The person's details, the **Removals** badge (Excluded or Allowed), the MFA status, the **Last interactive sign-in** card, and a **Needs attention** list. |
| Licenses | Each license with its type (Paid or Trial), source (Direct, a Microsoft Entra ID group name, or Unknown), and unit price. |
| Groups | The Microsoft Entra ID groups the person owns or belongs to, with their role. You can filter by group role. |
| Reporting line | The person's manager chain and direct reports. |
| Change history | The person's latest 500 changes. The rest are in **Change tracking**. |
| AI agents | **Explain this user** describes who the person is, what their licenses allow, and anything worth a second look. It needs the AI agents switch to be on for the account and the **Use AI agents** permission in your role. On private hosting, it also needs an OpenAI connection. |

The **Last interactive sign-in** card shows the date of the person's last interactive sign-in. When the person has no sign-in date and none of the users in the tenant has one, which is the case for a tenant with no Microsoft Entra ID P1 on record, the card reads "Not available". A note under it says that the tenant doesn't have Microsoft Entra ID P1, so Microsoft doesn't provide its sign-in or MFA data, and that last activity comes from Microsoft 365 usage reports instead: email read or sent, and Teams, SharePoint, or OneDrive use. When the tenant does have sign-in data but nothing is on record for this person, the card says that Microsoft Entra ID has no sign-in on record for the account.

## Steps

The steps below cover the common tasks on the **Users** tab. You start in Explore for the tenant, with the **Users** tab open.

### Find users with a filter

This procedure narrows the list to the users you want to review.

1. Select a tile or a filter pill, for example **Disabled** or **Inactive**.
2. To narrow further, use the filter menu of a column. The same menu lets you sort by that column.
3. Select a row to open the record of a person.

The grid shows 100 users on a page. Sorting works on one column at a time.

### Explain a user

This procedure shows an explanation in plain words of who a person is, what their licenses let them do, the groups and roles they hold, and anything worth a second look.

1. Select the row of the user to open the record.
2. Select the **AI agents** tab.
3. On the **Explain this user** card, select **Generate**.

The explanation appears section by section. It is based on the last sync, so it isn't live, and running it again gives the same result. A note under the explanation says that it is AI-generated and that you should review it before acting. If an explanation takes longer than five minutes, it stops and a message says so.

Turbo360 does not store the explanation. If you open the same record again in the same browser session, the explanation you already generated is shown without a new request. If you do not see the **AI agents** tab, see [Access and permission issues](https://docs.turbo360.com/docs/access-and-permission-issues-in-tenant-manager).

### Change the Inactive line

This procedure sets how long a user has to be inactive before they appear under **Inactive**.

1. On **All users** or **Inactive**, select **Filter settings**.
2. In **Inactive for more than**, pick 7, 30, 60, or 90 days, or choose **Custom** and enter a number of days.
3. Select **Apply**. Select **Clear** to go back to the default.

The setting is stored in your browser and is shared with Optimization. Other people can have a different line.

### Download the list to Excel

This procedure saves the users that match your filters to a file named "Tenant Manager - Users.xlsx".

1. Set the filter and column filters that you want.
2. Select **Download as Excel**.

The file has every row that matches your filters, not only the rows on the current page, and only the columns that are visible.

### Choose the columns

This procedure shows, hides, and reorders columns.

1. Select **Column options**.
2. Tick or clear the columns. A column with a grayed-out box is always shown.
3. To change the order, drag a row.

Your choice is remembered in your browser.

### Request a change for a user

This procedure creates a task in Optimization for an approver to decide. Nothing changes in Microsoft 365 until the task is approved.

1. Select the row of the user to open the record.
2. Select **Actions**. On the **Licenses** or **Groups** tab, use the **Actions** menu of that tab.
3. Choose a request: **Request to disable account**, **Request to enable account**, **Request to add license**, **Request to remove licenses**, **Request to add to group**, or **Request to remove from groups**. You can also remove one item from its row.
4. For an add request, choose the licenses or Microsoft Entra ID groups in the dialog. They are sent as one request.
5. Read the confirmation, and select **Send request**.

To remove several licenses or groups in one request, tick the rows on the **Licenses** or **Groups** tab, and then choose **Request to remove licenses** or **Request to remove from groups** from the **Actions** menu of that tab.

The request appears in **Optimization** > **Tasks** with the status **Awaiting approval**. For what happens next, see [Recommendations and savings](https://docs.turbo360.com/docs/recommendations-and-savings).

### Exclude a user from removals

This procedure protects a person from every removal that Tenant Manager can make.

1. Open the record of the user, and select **Actions** > **Exclude from removals**.
2. Enter a **Reason** if you want to record one. For example, a break-glass admin account or a service account.
3. Select **Exclude**.

No task or automation removes a license from this person, takes them out of a Microsoft Entra ID group, or removes them as a group owner. Exclusion blocks removals only. You can still request to disable the account, and adding licenses or group access is still allowed. The change takes effect at once, nothing is sent to Microsoft, and it is recorded in the activity log. The user appears under the **Excluded** filter, and the **Removals** badge on the **Summary** tab shows **Excluded**. Hover over the badge to see the reason, who excluded the user, and when.

If you select several users in one removal request and only some are excluded, Tenant Manager skips the excluded users and sends the request for the rest. A task that was approved before you excluded the user is still refused. Optimization doesn't list an excluded user in recommendations that remove licenses, and license removal automations skip the user.

### Include a user in removals again

This procedure lets tasks and automations remove licenses and Microsoft Entra ID group access from the person again.

1. Open the record of the user, and select **Actions** > **Include in removals**.
2. Read the confirmation, and select **Continue**.

## Configuration

The **Filter settings** panel has one option.

| Option | Default | Description |
| --- | --- | --- |
| Inactive for more than | 30 days | The line for the **Inactive** filter. Choose 7, 30, 60, or 90 days, or a custom number of days. Stored per browser and shared with Optimization. |

## Permission behavior

What you can do in Explore depends on your role.

- Without **Read** on Explore, the page shows "You do not have access to this page".
- Without **Manage** on Explore, the request and exclusion actions are disabled. Hover over one to see "You are not authorized to perform this operation".
- A request is blocked when the same change is already waiting for approval. Decide that task in **Optimization** > **Tasks** first.
- You can't remove anything from an excluded user. Include the user first if the removal is intended.
- A license that comes through a Microsoft Entra ID group can't be removed from the person directly. Remove the person from the group, or change the group's licenses.
- Tenant Manager can't change the members of dynamic Microsoft Entra ID groups, groups synced from on-premises, or distribution and mail-enabled security groups. A request to add a person to or remove a person from one of these groups is refused with a message that explains why.
- The **AI agents** tab needs the **Use AI agents** permission and the account's AI agents switch. Without them, the tab is hidden.

## Example scenario

After a round of departures at Trey Research, Tobias Brandt, a module owner, opens Explore for the tenant Trey Research Berlin and selects **Reclaimable seats**. The grid lists the disabled accounts that still hold paid licenses.

He opens the record of one user, selects the **Licenses** tab, and chooses **Request to remove licenses**. A task appears in Optimization for approval. He then opens the record of an account used by a payroll automation, selects **Exclude from removals**, and enters "Payroll automation" as the reason, so no task or automation ever removes its licenses.

## Limitations

- Explore is available for a tenant, not for a tenant group.
- You can't edit user data in the grid. A row opens the record, and nothing in a cell acts.
- The list shows the last sync. It isn't live.
- Last activity and MFA need the AuditLog.Read.All permission.
- Exclusion protects against removals only. Adding is still allowed, and so is **Request to disable account**.
- An explanation reflects the last sync, and you can't regenerate, save, or share it.

## Troubleshooting

1. **Last activity and MFA show "Not known", and some filters are turned off.** Cause: the connection doesn't have the AuditLog.Read.All permission, or the tenant has no Microsoft Entra ID P1, so no user has a sign-in date. A warning icon next to **Last synced** shows the issue when you hover over it. Hovering over the **MFA** value also shows the reason. Fix: grant the permission with admin consent on the app registration, and then select **Sync**. Sign-in data also needs Microsoft Entra ID P1 or P2.
2. **A message says that some data could not be loaded, or excluding a user fails.** Cause: one of the reads for the page failed, so the list may be incomplete. Or a later sync removed the user from the tenant ("That user is no longer in this tenant."), or the user is outside the access of your role ("You can only change users you can see."). Fix: reload the page. If the message returns, check that your Tenant Manager access covers this tenant. A message that reads "This tenant is outside your Tenant Manager access" means your role isn't granted on it. If the user is outside your access, ask an administrator who can manage Tenant Manager access.
3. **A removal request is blocked and says that the user is excluded.** Cause: the user is excluded from removals in Tenant Manager. Fix: include the user in removals first, if the removal is intended.
4. **A request says that the change is already requested and waiting for approval.** Cause: an open task already covers that person and change. Fix: approve or decline the task in **Optimization** > **Tasks**, and then raise the request again.
5. **The page shows "No users synced yet".** Cause: the tenant hasn't completed a sync. Fix: sync the tenant. Syncing needs the **Manage tenants** permission.

## FAQs

1. **Does a request change anything in Microsoft 365?** No. A request creates a task. Nothing changes until an approver approves the task.
2. **What is the difference between Inactive here and idle seats on Overview?** Inactive uses the line you set in **Filter settings**, and the default is 30 days. Overview counts a seat as idle when the user is disabled or has had no activity for 90 days, based on last activity, and that line is fixed.
3. **Does excluding a user change anything in Microsoft 365?** No. The exclusion is saved in Tenant Manager only. It stops tasks and automations from removing things from that person.

## Related articles

- [Tenant overview](https://docs.turbo360.com/docs/tenant-overview-in-tenant-manager)
- [Explore groups](https://docs.turbo360.com/docs/explore-groups-in-tenant-manager)
- [Explore licenses](https://docs.turbo360.com/docs/explore-licenses-in-tenant-manager)
- [Change tracking](https://docs.turbo360.com/docs/change-tracking-in-tenant-manager)
- [Recommendations and savings](https://docs.turbo360.com/docs/recommendations-and-savings)
- [How data sync works](https://docs.turbo360.com/docs/how-data-sync-works)
- [Roles and permissions in Tenant Manager](https://docs.turbo360.com/docs/tenant-manager-roles-and-permissions)
- [License tasks](https://docs.turbo360.com/docs/license-tasks-in-tenant-manager)
- [License removal automation](https://docs.turbo360.com/docs/license-removal-automation-in-tenant-manager)
- [Optimization overview](https://docs.turbo360.com/docs/optimization-overview-in-tenant-manager)