Overview
This quick start takes you from a new Tenant Manager account to your first license change. You connect a Microsoft 365 tenant, find a license you pay for but don't use, and approve its removal.
The walkthrough uses a disabled account as the example, because it is the simplest recommendation to act on.
Business value
In one session, you go from no data to a priced recommendation and an approved change. Every change waits for an approval, so nothing in Microsoft 365 changes until you decide.
Prerequisites
Before you start, make sure you have:
- Tenant Manager switched on for your account. If it isn't, see Request access to Tenant Manager.
- An app registration in your tenant's Microsoft Entra ID with a client secret, and the Directory.Read.All permission granted as an Application permission with admin consent.
- One of the User.ReadWrite.All, LicenseAssignment.ReadWrite.All, or Directory.ReadWrite.All permissions on the same app registration, if you want Tenant Manager to apply an approved license removal. Any one of them is enough. Without one, you can still raise and decide tasks, but Approve is disabled.
Tenant Manager also uses other optional permissions for features such as sign-in activity, usage reports, and swap recommendations. You don't need them for this quick start. Without AuditLog.Read.All and RoleManagement.Read.Directory, each sync shows a warning next to Last synced and the tenant is marked as failing. Reports on it are abandoned, and automations remove nothing. Grant them before you go beyond this quick start. For the full list, see the Dependencies section of Connect a Microsoft 365 tenant.
Required permissions
The Owner and Contributor roles include everything this quick start needs: Manage tenants, Manage on Optimization, and Approve license tasks. The Reader role can view recommendations but can't add tasks or approve them. For details, see Roles and permissions in Tenant Manager.
The Get started button is on the Tenant Manager card on the Home page, and it shows only until your top-level tenant group exists. It depends on that tenant group, not on how many tenants you have. If you later delete every tenant, it doesn't come back. The Home card shows zeros instead, and you add a tenant from the empty tenant group. The Owner and Contributor roles can use it. With a custom product-wide role, the button is disabled with the tooltip "You are not authorized to perform this operation". Users whose access is limited to specific tenant groups or tenants can't use it.
How it works
Tenant Manager reads your tenant's users, Microsoft Entra ID groups, and licenses, and works out which licenses you pay for but don't use. A recommendation changes nothing by itself. You add it to Tasks, an approver decides, and only an approval makes the change in Microsoft 365.
This quick start follows that flow in three parts: connect, find a saving, and act on it. For the rules behind each recommendation, see Recommendations and savings.
Steps
You start on the Home page and finish in Optimization, on the Tasks tab. Each step ends with something you can check.
-
Connect your first tenant. On the Home page, select Get started on the Tenant Manager card, and follow Connect a Microsoft 365 tenant. When you select Connect and sync, the first sync starts. If you selected Tenant Manager in the onboarding wizard, finishing the wizard already connected your tenant and started the first sync, so go to step 2. For details, see Initial setup.
-
Wait for the first sync to finish. The Home card shows that the first sync is running, and then shows your seat and license figures. In Tenant Manager, Last synced in the page header shows the sync time.
-
Open Optimization. In the tree view, expand your tenant, expand License management, and select Optimization. The Users tab opens by default.
-
Read the tiles above the grid. Recommendations counts the people with something to reclaim, Paid licenses to reclaim counts their paid direct seats, and Annual savings adds up the estimated yearly saving. If Annual savings shows a dash or "NA", Tenant Manager knows no seat prices yet. See Troubleshooting.
-
Select the Disabled filter. The All view lists everyone who has something to reclaim, so this filter narrows the grid to disabled accounts that hold direct licenses. The Reason column says why each person is listed, and the Recommendation column says what to do, for example "Remove 1 license because the account is disabled."
-
On a row, select Add to tasks. In the Add change to Tasks dialog, optionally enter a Note, such as a ticket reference. Select Continue.
Tenant Manager confirms that the request is waiting for approval. Nothing has changed in Microsoft 365 yet.
-
Select the Tasks tab, and then select the Awaiting filter. Your task appears with the status Awaiting approval. Select its row to open the task and review the person, the license, and the estimated savings.
-
Select Approve. In the Approve task dialog, optionally enter a Change or ticket reference, and then select Continue.
Tenant Manager removes the license from the person in Microsoft 365 right away, and the task moves to Done. You can't undo the change from Tenant Manager. To reverse it, raise the opposite change.
To refuse a task instead, select Decline. Nothing changes in Microsoft 365, and the person who raised the task must raise it again if it is still needed.
Troubleshooting
-
The Users tab shows "No recommendations yet".
Cause: the first sync is not finished, or no one in the tenant holds a license they don't use.
Fix: check Last synced in the page header. If it shows Never synced, wait for the first sync. Otherwise, try the other filters and the Groups and Licenses tabs. -
Annual savings shows a dash or "NA".
Cause: Tenant Manager has no seat prices. Prices come from a Microsoft Customer Agreement billing account or from a custom price.
Fix: set a custom price in the Global price catalog, or connect a billing account that Tenant Manager can read. -
Add to tasks is disabled with "Already requested".
Cause: an open task already covers the change.
Fix: open the Tasks tab and approve or decline the existing task. -
Approve is disabled.
Cause: the tenant's app registration lacks a permission the change needs. For a license removal, any one of User.ReadWrite.All, LicenseAssignment.ReadWrite.All, or Directory.ReadWrite.All is enough.
Fix: ask your Microsoft Entra administrator to grant one of them with admin consent in Microsoft Entra ID, and then try again. You can also use Trigger notification to send the task to your IT team, or Generate PowerShell script to run the change yourself, and then mark the task as done.