Articles

The licence review prompt of the GraphPaaS connector for Claude, run end to end on our demo tenant: every step, the query it became, and the traps in the data.

Connect GraphPaaS to Claude and ask your Microsoft 365 tenant questions in plain English. Setup in three steps, three real questions, and the limits.

Azure Backup bills every block a retained recovery point still holds. How GFS retention, GRS, archive and orphaned vaults make a cheap backup expensive.

Ticking

Budget alerts, forecast alerts and anomaly alerts answer different questions at different speeds. How late each one fires, and which to set per scope.

Unallocated is the biggest cost centre in most Azure tenants. Why tags never reach the bill on their own, and what actually fixes the gap.

Six questions an admin actually asks before moving blobs to a cheaper tier — retention floors, what rehydration costs, and the lifecycle trap that re-archives what you just restored.

A dev environment used 40 hours a week bills for 168. Five steps to close the gap — and the power state that keeps charging you after someone

The choice isn

Break-even utilisation for an Azure reservation is 1 minus the discount. The cheapest reservation is deliberately under-used — and the real risk is the exit door.

The Copilot usage report only returns rows for people who already have a Copilot licence. Here is what the other reports say about who would use it, and what each number is actually worth.

Four Defender add-ons do not add up to the Defender Suite. Two service plans are missing from the à la carte column entirely — which changes the arithmetic.

Visio and Project are the two seats every tenant over-buys — and the one usage report that would prove it has no column for either. The five-step audit that works anyway.

Power Apps and Power BI bill across four separate meters that land on two different invoices. Here is what each one measures, and which of them your licence report can actually see.

Warehouse and shop-floor staff on E3 is the most expensive licensing habit in most tenants. The four measurements that say who actually fits an F seat — and the 2 GB ceiling that stops the rest.

You bought 240 seats. 197 are assigned. A five-step monthly reconciliation that turns that gap into a number with an owner and a deadline.

Someone clicked

Monthly billing costs about 20% more, and half the tenants paying it aren

Shared mailboxes are free up to 50 GB. Then sending stops, receiving stops, and senders get bounces. The three cases that need a licence, and what the report shows.

Half your tenants assign licences both ways at once. The property that tells them apart, the order that migrates them without an unlicensed gap, and the five errors.

A snapshot says storage is fine. The trend says you

Your tenant sits inside the EU Data Boundary. The reporting tool you are about to connect to it does not inherit that. Three architectures, compared.

Devices that stopped checking in keep reporting the compliance state they had on the day they went quiet. Six questions about cleaning them up, answered bluntly.

Three users hold most of your OneDrive storage and the biggest SharePoint sites are the ones nobody opens. A five-step playbook for finding both before the tenant goes read-only.

Your Teams rollout succeeded and the usage data disagrees. What the report actually counts as an active user, and the three numbers that survive scrutiny.

Five questions admins get asked, the admin-center export that answers each one, and what that export costs in permissions, retention and concealed names.

You could build the reporting with PowerShell. The honest answer to the build-vs-buy question is not about year one — it is about what year two costs you.

Your clients don

Timed, one monthly Microsoft 365 client report by hand takes 3h 28m — and only 22 minutes of it is analysis. Where the rest goes, and the ceilings that cause it.

Your sign-in logs already show the breach attempt. What the numbers in a real tenant look like — and why hidden, aggregated and 7 days are the three words that decide what you can see.

The five Conditional Access policies every Microsoft 365 tenant should have, in deployment order, with the done-condition for each one.

A practical guide to finding Microsoft Entra guest accounts that are stale, pending, poorly owned, or still carrying access.

Basic auth is gone from Exchange Online. The legacy protocols are not — and the mailboxes still speaking them are the ones password sprays aim at. How to name them.

Client secrets and certificates expire silently in every Entra tenant. The integration breaks at 3am, and the error message never says the word expired.

MFA enforced is not MFA registered. The gap between the policy and the user list is where the account takeovers happen — how to measure it and close it.

Licence waste isn

Half your E3 users only send email. Matching the SKU to real mailbox, Teams and OneDrive activity is a €15/user/month decision — here

Your Azure invoice says what you spent. It never says why. The drill-down that turns one number into a decision: subscription → resource group → resource → meter.

You deleted the VM but kept the bill. Unattached disks, idle public IPs and forgotten snapshots quietly accrue every month — here

Ex-employees, ended projects, forgotten service accounts — how to find the licensed users who stopped signing in, and what each one is costing you.

Typical tenants waste 15–25% of their M365 licence spend. Here is where it hides — dormant users, leavers, duplicate SKUs — and how to audit it in an afternoon.

Why signing in with @fabrikam.com vs @sandbox.pt lands you in the right organization automatically - and what happens with multiple domains, guests and MSP setups.

Step-by-step guide for Azure admins: assign the Cost Management Reader role and connect Azure Billing in GraphPaaS.