GraphPaaS vs exporting from the Microsoft admin centers

Everything below is available for free in a Microsoft portal. That is not the argument. The argument is what each export costs you once you have it: how far back it reaches, whose names it hides, which permission tier it demands, and how many other exports you need before it answers the question you were actually asked. This is the side-by-side, per question.

Five questions, five different portals

None of these are exotic. They are the questions that arrive by email on a Monday, and each one lands in a different console with a different export button behind it.

The export hands you less than the screen did

Two properties of the Microsoft 365 usage reports catch people out, and both are documented rather than accidental. The reports are available for the last 7, 30, 90 and 180 days and nothing longer, so any question phrased as "over the past year" cannot be answered from that surface at all. And by default every report hides usernames, display names, group names and site URLs to help organisations meet local privacy law. Turning that off is a Global Administrator action in Org settings, it is itself a logged event in the Purview audit log, and it applies tenant-wide — to the Graph reports API and Power BI too, not just the page you were looking at.

The same page is unusually blunt about the shape of what you get: you can't generate a report where you enter a user's account and then get a list of which services they're using and how much. The data is per-report, not per-person. Producing the per-person view is the join you end up doing in Excel — which is where the hours go. There is also a quiet clock on it: when you delete a user account, their usage data is deleted within 30 days, so an offboarding you want to evidence has a month before the evidence goes.

How far back each surface can actually see

Retention is the difference that matters most, because it is the one you cannot fix with effort. Every bar below is a hard ceiling set by Microsoft, not by how organised you are.

The Entra numbers are the sharpest edge. Audit logs and sign-ins are held for seven days on Microsoft Entra ID Free and 30 days on P1 or P2; risky sign-ins get 90 days, but only on P2. Crucially, buying the licence does not backfill: retention changes aren't retroactive, so upgrading from Free to P1 gives you the seven days you still had and nothing more. The audit trail you didn't archive is simply gone.

Purview is the friendlier end. Audit (Standard) now defaults to 180 days — it was 90 for records generated before 17 October 2023 — and Audit (Premium) keeps Exchange, SharePoint, OneDrive and Entra records for a year, but only for users holding an E5 or Purview Suite licence. Guests and non-E5 users fall back to 180 days regardless of the policy you wrote.

The permission asymmetry nobody mentions

Here is the detail that decides whether a reporting tool can be trusted with your tenant. Reading Intune data needs a read scope. Creating an Intune report export does not: the create deviceManagementExportJob API accepts exactly three permissions — DeviceManagementConfiguration.ReadWrite.All, DeviceManagementApps.ReadWrite.All and DeviceManagementManagedDevices.ReadWrite.All. There is no read-only variant. The last of those also authorises wipe, retire and remote lock on every managed device in the tenant.

What actually changes

Azure is the honest illustration of the gap, because Microsoft already built the good answer and it isn't a button. Cost Management exports write scheduled CSV or Parquet into a storage account you own, partitioned into sub-1 GB chunks with a manifest.json you must read to reassemble them — partitioning cannot be disabled, even for tiny exports. Backfilling history through the portal tops out at 13 months and runs one month at a time; past that you're calling the REST API. That is a data pipeline. Microsoft ships the pieces; assembling them is a project, and Excel's row limit is explicitly one of the reasons the files are split.

GraphPaaS is that assembly, done once and run per tenant on a schedule: one multi-tenant app consented per customer, read-only scopes, and a copy of each surface kept on our side before the seven-day and 180-day windows close. The comparison stops being five exports and a join key — unused licences, dormant accounts, device compliance, spend by resource group and consent grants become five pages that were already populated when the email arrived. The portals stay authoritative; they're where you go to change something. They are just a bad place to be asked a question about last March.