All templates

Automated Entra ID Unused Licence Reclaim

Every Monday, WebRun opens Microsoft Entra ID, reads licence assignments across your users, finds paid products held by disabled accounts, leavers and people who have not signed in for months, records each one in Google Sheets with the product and the user, and drafts a confirmation email to each manager for you to send.

Runs on WebRun · Strict Lockdown policy
Every Monday at 9:00 AM WebRunorchestrates each step
1 Microsoft Entra ID review licence assignments
2 Google Sheets list the reclaimable licences
3 Gmail draft the manager confirmation
In short

How do I find unused paid licences in my directory?

WebRun reviews Microsoft Entra ID licence assignments every Monday and finds paid products held by leavers, disabled accounts and users who have not signed in for months. It lists each one in Google Sheets grouped by product, then drafts a confirmation email per manager for you to approve.

  • The next renewal is sized to real usage, not last year's headcount
  • Leaver and disabled accounts are separated from merely inactive ones
  • Manager confirmations are written for you and never send unapproved

Built for IT admins · IT managers · finance and procurement · managed service providers · operations leads

Step by step

What does WebRun do on every run?

The exact actions WebRun takes, in order - in plain language, so you can adjust anything.

  1. WebRun signs in and gets to work

    Opens entra.microsoft.com in a real browser with your saved login - no setup, no API keys.

  2. 1
    Microsoft Entra ID - review licence assignments
    entra.microsoft.com
    WebRun in Microsoft Entra ID: review licence assignments
    WebRun opens Microsoft Entra ID to review licence assignments.
    • Open Microsoft Entra ID and read the licence assignments across your users and groups
    • Flag paid products assigned to accounts that are disabled, blocked from sign-in or marked as leavers
    • Flag active accounts that hold a paid product but have not signed in for the period you set
    • Note whether each assignment is direct or comes from group based licensing, since the fix differs

    Done when Every questionable licence assignment has a user, a product and a reason attached.

  3. 2
    Google Sheets - list the reclaimable licences
    google.com
    WebRun in Google Sheets: list the reclaimable licences
    WebRun opens Google Sheets to list the reclaimable licences.
    • Write one Google Sheets row per reclaimable licence with the user, the product, the reason and the assignment type
    • Group the rows by product so the count per subscription is clear at a glance
    • Carry over last week's rows and mark which were actioned, so progress is visible
    • Sort disabled and leaver accounts above merely inactive ones, since those are the safe wins

    Done when The sheet shows this week's reclaim list grouped by product with last week's outcomes marked.

  4. 3
    Gmail - draft the manager confirmation
    gmail.com
    WebRun in Gmail: draft the manager confirmation
    WebRun opens Gmail to draft the manager confirmation.
    • Draft one Gmail message per manager listing their team members holding an unused paid licence
    • Ask them to confirm the licence can be reassigned or dropped, and give the last sign-in date as evidence
    • Leave every message in Drafts. WebRun never emails a manager on its own
    • Skip managers already asked about the same user inside your chosen window

    Done when A confirmation email is drafted for each manager and none has been sent.

Run settings

How is each run configured?

Starting pageWhere Chrome opens at the start of each run
entra.microsoft.com
ScheduleRuns automatically on this cadence
Every Monday at 9:00 AM
DeliveryHow each run's result reaches you
Licence reclaim list · Google Sheets
OutputWhat each run produces - A weekly reclaim list of paid licences held by leavers, disabled accounts and inactive users, grouped by product, with a drafted manager confirmation each.
Text
Setup & safety

Secure by default

Connect once, stays signed in

WebRun signs in once and keeps each session in a persistent environment, so every run picks up right where it left off.

Your credentials stay in your own private environment - WebRun never stores your passwords.
Strict Lockdown

Every action is checked against this policy before it runs.

Domains ALLOWLIST
Typed input ALLOW
Shell command BLOCK
File uploads BLOCK
Runs in a contained environment More on policies
Good to know

Questions, answered

Will it remove licences or disable accounts?

No. WebRun reads the directory and reports what looks reclaimable. Removing a licence, changing a group or disabling an account stays a human action inside Entra ID.

Does it email managers automatically?

No. Each confirmation is left as an unsent Gmail draft for you to review and send, so nobody is told their licence is going without an admin approving it.

How does it decide someone is inactive?

By the last sign-in recorded in Entra ID against the threshold you set, typically 60 or 90 days, and the date is included as evidence in every row and email.

Put this on autopilot.

Turn it on in minutes - or have our team set it up for you.