Home · Solutions · IT & services
Solution · IT & servicesEvery paid seat matched to a person who exists, works here and actually signs in
Software licences reconciled every month
Robots rebuild the whole licence position every month, match every seat to HR and sign-in evidence, and send reclaim proposals to the application owners as tasks in Microsoft Teams.
Executive summary
Leavers, duplicates and dormant accounts keep their paid seats until somebody rebuilds the list by hand.
We build a monthly cycle that answers a question the company cannot answer quickly today: which paid seats belong to somebody who exists.
The licence position is current every month, so seat decisions rest on evidence rather than memory.
the licence workbook on SharePoint; the Power BI licence position; the ITSM queue for reclaims with no API
Business problem
Licence cost control
Per-user software is easy to buy and hard to give back. A manager asks for a seat, the service desk assigns it, and the cost joins a subscription line nobody reads again until renewal. The leaver process closes the Microsoft Entra ID account, which covers every product behind single sign-on and misses every product that keeps its own user directory.
The people who could fix this have no evidence in front of them. The IT asset owner has fourteen exports in fourteen formats. HR knows who left, but by last working day, not by licence. Sign-in activity sits in the tenant, usage with each vendor, contracted seats in a folder in procurement. Joining the four takes a day, so it happens once a year, a fortnight before the renewal it was meant to inform.
At scale the gaps compound quietly. Duplicate tooling survives because nobody can produce the list of people holding both. Editions drift upward because an upgrade takes a click and a downgrade takes a conversation. Departmental purchases on a card never enter the picture. The board sees a subscription bill growing faster than headcount.
How it works today
It starts with the IT asset owner and a folder of exports, and in most companies of this size it runs like this.
- PersonOn the first working day of the month the IT asset owner logs into each admin portal and exports a user list
- PersonFourteen files land in one folder with fourteen column layouts and fourteen names for the same edition
- SystemThe lists are pasted into one workbook and matched against an HR extract already a week old
- WaitingDoubtful lines go to application owners by email and come back over the next fortnight, or not at all
- Risk of errorLeavers keep paid seats: the leaver ticket closed the directory account but not the vendor-side user
- PersonThe finance business partner gets a summary tab, challenges two lines, and the workbook is rebuilt
- WaitingReclaims that survive are executed when somebody has a free afternoon, usually after the renewal date
Why the current process costs more than it appears
Time that disappears before anyone measures it.
- Collecting the data is the visible half. The chasing is invisible: an owner who does not reply, an export whose columns changed last month, a leaver whose HR record and directory account disagree about the leaving date.
- A list two to six weeks old is not evidence, and everyone treats it as such. The renewal then runs on the vendor's seat report, the only count both sides will trust.
- Seats bought outside the IT budget never enter the workbook. A team buys ten on a departmental card, the buyer moves on, and the subscription renews quietly for years with nobody named against it.
- Reclaiming a licence is socially expensive. Asking a director whether the team still needs a tool costs a conversation, so it waits for the renewal, the moment it changes the price least.
- Done once a year rather than monthly because it is unpleasant, the exercise is weakest exactly when the numbers matter most.
Cost of inaction
Sizing, not forecasting, is what the second row does. It assumes about 6,200 assigned seats across the fourteen products, that a first reconciliation flags 210 as reclaimable, and a placeholder blended €300 per seat-year, a modelling number and nobody's price list. Your contracted rates and your own reclaim rate replace both in the first workshop. The row makes one point: the pool is real, it renews on a date already in the calendar, and nothing counts it today.
If nothing changes the pattern repeats in order. The renewal arrives, the vendor's seat report is the only verified number in the room, and the contract is signed at a count nobody inside the company can dispute. The leaver who kept a login to a system holding client files is found later, by an auditor. And the exercise stays attached to one person and one workbook.
A plausible organisation with realistic proportions. The figures are there to be recalculated on your data; they are not a client result.
A professional services group of 3,000 users in five European countries, running Microsoft 365 with a mixed E3 and E5 population plus thirteen other paid products bought by four different budget owners.
Roughly 6,200 assigned seats across the fourteen products; about 60 leavers and 70 joiners a month; three products keep their own user directory, and two were bought departmentally and never reached the asset register.
One person exports fourteen user lists at the start of the month, pastes them into a workbook, matches them against a week-old HR extract and emails the questionable lines to owners.
Three hours per product per month of collecting, normalising and chasing, and a picture two to six weeks old by the time anyone acts on it. Reclaims are executed after the renewal, not before.
Robots rebuild the position monthly from Microsoft Graph, vendor admin APIs and admin portals, match every seat to employment status, account state and last sign-in, and send each owner one Teams task with their own proposals and the evidence.
In the modelled case the assembly work shrinks to a review of exceptions, the picture is never more than a month old, and the reclaimable pool becomes a monthly number instead of an annual argument. The figures below are a model, not a measurement.
Proposed solution
We build a monthly cycle that answers a question the company cannot answer quickly today: which paid seats belong to somebody who exists, works here and uses the tool. A robot per product collects the seat list. For the Microsoft 365 tenant that is Microsoft Graph: subscribed SKUs with their purchased and consumed counts, the licences assigned per user, and the sign-in activity on the user object. For the rest it is the vendor's admin API, or the portal screen where none exists.
Every seat is then matched to a person: the HR export gives employment status and leaving dates, Microsoft Entra ID gives account state and group membership, the product's own data gives evidence of use. A seat that passes all three is left alone. One that fails becomes a proposal with its reason attached: a leaver whose directory account is closed but whose vendor-side user is not, an account with no sign-in for sixty days, a person holding two tools that do the same job, an edition above what the role needs.
Proposals reach the application owners where they already work. Each gets one task in Microsoft Teams with their own seats, the evidence and a deadline, and answers keep, reclaim or exception. Approved reclaims run by API where the product allows it and become tickets where it does not. The month closes with a report in the IT and finance channel and a refreshed position in Power BI; before each renewal the same data produces the true-up view.
Microsoft Graph subscribed SKU, licence assignment and sign-in activity endpoints; Microsoft Entra ID account and group data; UiPath Orchestrator schedules, queues and credential stores; UiPath Action Center tasks completed in Microsoft Teams; Excel Online and Power BI refresh
The collection robot per product, the identity matching layer, the rule set and its thresholds, the approval flow, the execution and ticketing step, the monthly report and the true-up view
Vendor admin APIs product by product, UI automation against the portals of products with no API, and a read connection to the HR employment-status export
How the automated process works
- AutomationOn an Orchestrator schedule a robot per product collects the seat list: Microsoft Graph for the tenant, vendor APIs where they exist, portal screens where they do not
- AutomationEach seat is joined to a person through the HR export, the Microsoft Entra ID account, the last sign-in and the product's own activity data
- SystemThe rule set marks each seat active, leaver, dormant beyond its threshold, duplicated against an overlapping tool, or on an edition above the role, with the evidence beside the verdict
- PersonEach application owner gets one Action Center task in Microsoft Teams with their own proposals, and answers keep, reclaim or exception before the deadline
- AutomationApproved reclaims run where the vendor exposes an API and become ITSM tickets where it does not, each logged with approver, timestamp and evidence
- AutomationThe workbook and the Power BI position refresh, and the monthly report goes to the IT and finance channel
- AutomationAhead of each renewal the same data produces the true-up view: contracted, assigned and active seats, and the gap
Human-in-the-loop model
Automation handles
- Collecting seats and assignments from every product, by whichever route it offers
- Joining every seat to a person, an employment status, an account state and a last sign-in
- Applying the rules and assembling the evidence behind each proposal
- Executing approved reclaims, refreshing the position and posting the monthly report
People decide
- Whether a flagged seat goes, stays or becomes a standing exception, owner by owner
- The dormancy threshold per product: a tool used at quarter end is not a tool used daily
- Anything touching shared accounts, service accounts, executives and people on long-term leave
- Whether an edition is downgraded, which is a conversation about the role
Before and after
Systems and integrations
Everything below runs on licences and systems you already hold, or would need anyway.
Inputs
- Microsoft Graph (subscribed SKUs, assigned licences, sign-in activity)
- vendor admin APIs
- admin portals where no API exists
- the HR employment-status export
- the contract register
Automation layer
- UiPath Orchestrator
- UiPath Robots
- UiPath Integration Service
- UiPath Action Center
Target systems
- the licence workbook on SharePoint
- the Power BI licence position
- the ITSM queue for reclaims with no API
Human touchpoints: reclaim approvals as Action Center tasks in Microsoft Teams; the monthly report in the IT and finance channel; the pre-renewal true-up review
Technologies used
schedule the cycle, queue every product, retry failures, hold the audit trail
Areach tenant data through Microsoft Graph, post the monthly position to a Teams channel
Areclaim proposals as tasks completed in Microsoft Teams, with assignment, deadlines and escalation
Asubscribed SKUs with purchased and consumed counts, licences per user, sign-in activity on the user object
Aaccount state, group membership and group-based licensing: the identity spine of the exercise
Athe reconciliation workbook, one row per seat with evidence and verdict
Athe licence position by product, owner and cost centre
Athe leaver and joiner record every seat is matched against
CIllustrative economic model
A model, not a promise.
Treat every input here as an assumption to be replaced by your own numbers; it is built from the scenario above and not measured at a client. Three hours per product covers exporting the list, normalising it, matching it against HR and chasing the owners who have not answered, averaged across easy exports and awkward ones. €38 is a fully loaded hourly cost for an IT asset or service-delivery role in Central Europe. The model counts assembly effort only; the seats themselves are a separate pool, sized in the next section.
Run the numbers on your data
An illustrative estimate from your own inputs. It models released capacity; it is not a promise of savings.
Business benefits
- The licence position is current every month, so seat decisions rest on evidence rather than memory
- Leavers' seats stop being paid for within days of the leaving date, and the same run closes the access they carried
- Duplicate tooling becomes a list of named people holding both products, the only form in which that conversation moves
- Renewals and true-ups open with your own verified consumption, the gap between contracted, assigned and active seats already quantified
- The reconciliation stops depending on one workbook and one person's knowledge of which export column means what
- Application owners spend minutes a month on their own list instead of a fortnight of email chasing
The management view
- Subscription spend becomes attributable: every product carries an owner, a contracted seat count and a consumption figure
- The gap between contracted, assigned and genuinely used seats is a standing number rather than an annual surprise
- Reclaim decisions carry their evidence, so a licence audit becomes a matter of exporting the record
- Growth changes the numbers rather than the work behind them; a fifteenth product is one more collection step, not one more tab
Board-level KPIs
Security and governance
The automation holds exactly the rights it needs, and not one more.
- Each product is read by a named service account with a read-only admin role where the vendor offers one; removals run under a separate account whose rights stop at licence assignment
- No password ever appears in a workflow. Each one is fetched at run time from the Orchestrator credential store or from your own Azure Key Vault, and rotates with your other privileged accounts
- Nothing is removed on a robot's authority: every reclaim carries an approver, a timestamp and its evidence, and that record survives in Orchestrator and in the workbook
- Employment status and sign-in timestamps are personal data, so the cycle holds only the fields the rules need and drops the detail at close; while it holds them they sit in your Microsoft 365 tenant and in UiPath Automation Cloud's EU region
- Two categories are never executed automatically: shared and service accounts, and anyone HR has flagged as on long-term leave
Why now
Renewal dates are fixed and the negotiation runs on seat counts. If the only verified count in the room is the vendor's, the discussion starts from their number; a monthly cycle means you arrive with your own.
Licence assignment and sign-in activity are readable from the production Microsoft Graph endpoints, and tasks can be completed in Microsoft Teams with no portal for anyone to learn. What once needed a custom tool is now largely configuration.
The assembly work modelled here is €1,596 a month, and it is the smaller half. The larger half is the pool of seats nobody has questioned.
Relevant executive roles
The subscription line stops being an unexplained increase and becomes a number with a seat count, an owner and an audit trail behind it
Licence position, access hygiene and leaver completeness arrive as one monthly artefact instead of three separate arguments
Every renewal opens with verified consumption rather than with the vendor's seat report
Common questions and objections
Most of the tenant data comes from Microsoft Graph and the larger products expose admin APIs. Where a product offers nothing, a robot reads the same admin screen a person reads today, on a schedule and without getting bored. The rule set does not care which route the data arrived by.
It annoys people when it arrives as an accusation two weeks before renewal. A monthly proposal that names the seat, shows the last sign-in and offers a one-click keep is a different conversation, and an exception the owner marks is respected by the next run.
An access review answers who should have access. This answers what you are paying for, and the two lists differ. Products with their own user directory, departmental purchases and edition mismatches never appear in one.
When this is not the right solution
- A few hundred users and four or five paid products, where a quarterly look at two portals costs less than anything automated
- Contracts priced per organisation or per tier rather than per user, so reclaiming a seat changes nothing until a boundary is crossed
- No usable HR feed and no reliable identifier linking a person to their vendor-side accounts; that mapping has to be fixed first
A question for the next management meeting
Which of the seats we will pay for next quarter belong to someone who has signed in this quarter, and who in this company can show me the evidence?
Implementation approach
The first week looks the same at every client: we look at the data.
We deliver
- An inventory of the fourteen products with owners, contracted seats, renewal dates and how each is read
- A collection robot per product: Microsoft Graph and vendor APIs first, portal screens only where nothing else exists
- The matching layer joining seats to employment status, Microsoft Entra ID account state and last sign-in
- The rule set: leaver, dormant, duplicated, edition above need, and each owner's standing exceptions
- Reclaim approvals as Action Center tasks in Microsoft Teams, with reminders, escalation and a decision record
- The monthly report, the Power BI licence position and the pre-renewal true-up view
We need from you
- The product list with contract owners, contracted seat counts and renewal dates
- A monthly employment-status export from the HR system, or read access to it
- Admin credentials per product, issued to service accounts rather than to a person
- One decision per product on the dormancy threshold, from the application owners
Stages
Discovery
Product list, owners, contracted seats, and which products expose an API
Design
Dormancy thresholds per product, duplicate pairs, edition mappings, and who approves what
Build
Collection robots, the matching layer, the workbook and Power BI model, the Teams tasks
Validation
A parallel month against your last manual reconciliation, with every difference explained
Go-live
The first cycle in proposal-only mode, then execution switched on product by product
Quick win. Effort is driven by how many products expose a usable admin API, how clean the join is between HR identifiers and vendor-side user names, and how many owners join the first round.
At the next renewal, the only verified seat count in the room will be the vendor's.
Send us your product list with the contracted seat counts and one month of your current licence workbook. We come back with the rules we would apply per product and a first sizing of the reclaimable pool.
Size your reclaimable licence poolThe neighbouring process usually has the same problem
Managers sign off on entitlements they cannot read, and nobody withdraws what nobody uses.
View solution HR & peopleJoiner, mover, leaver: access on day one, revoked same dayNew starters wait days for access; leavers keep theirs for weeks. Both are the same missing handover.
View solution Management & planningThe management pack in Power BI, not fourteen Excel filesThe board pack should not depend on which analyst merged which spreadsheet on which day.
View solution IT & servicesCloud spend explained to the people who cause itA third of your resources have no owner, so the invoice is explained with a screenshot of a chart.
View solution Case studyThe IT helpdesk agentPasswords, access, VPN, folder permissions.
View case study Case study24/7 application supportWe provide round-the-clock support (24/7/365) for any business-critical application — in factories and companies of any industry.
View case studyIndustries we deliver this in most oftenManufacturing & industryRetail & e‑commerceServices & IT