The Microsoft Graph integration enables secure, read-only data ingestion from Microsoft 365, Intune and Microsoft Entra ID (formerly Azure Active Directory) into Licenseware.
The Microsoft Graph API integration is designed to:
- Collect Microsoft usage and activity reports
- Retrieve device inventory data from Entra ID and Intune
- Automate Microsoft 365 user and subscription analysis
The integration is API-based and does not require agent deployment. Once connected, it syncs bi-weekly: twice a week, every Monday and Wednesday at 22:00 UTC.
The integration operates with read-only permissions. No changes are made to the customer tenant.
Granted Permissions
- Read all users’ full profiles
- Read all usage reports
- Read all devices
- Read Microsoft Intune managed devices
- Read directory data (Microsoft Entra ID)
This ensures:
- No write access
- No modification of tenant configuration
- No impact to production systems
- Secure and compliant data ingestion
What Data Is Collected
1. User & Directory Data (Microsoft Entra ID)
Used for Microsoft 365 license position analysis.
Includes:
- User profiles
- Assigned licenses
- Service plan assignments
- Disabled accounts
Purpose:
- Identify assigned vs unassigned licenses
- Detect inactive and disabled users consuming licenses
- Build effective license position (ELP) models
2. Usage & Activity Reports (Microsoft 365)
Used for optimization and cost control.
Includes:
- Microsoft 365 service usage
- Activity reporting
- Workload-level engagement (where available)
Purpose:
- Identify underutilised subscriptions
- Support downgrade recommendations
- Detect dormant accounts
3. Device Inventory Data (Microsoft Entra ID & Intune)
Supports both Microsoft analysis and SIM software recognition.
Includes:
- Entra ID joined devices
- Hybrid Entra ID devices
- Microsoft Intune managed devices
- Device metadata (OS, ownership, compliance state, etc.)
Purpose:
- Cross-checking user-device relationships
- Feeding SIM and other applications for software inventory enrichment
Configuration
Step 1 – Open Microsoft Graph in Datasources
In Licenseware, open Datasources and search for Microsoft. Click Microsoft Graph.
Click Connect.
Licenseware explains that an administrator needs to authorize the connection, and that you’ll be redirected to Microsoft to sign in and grant access. Click Continue.
Step 2 – Authorize Tenant
- Sign in with a Administrator or appropriate delegated role.
- Review requested read-only permissions.
- Grant tenant consent.
Check and manage the connection
In Datasources, click Microsoft Graph to open its page. It brings in Intune and Entra devices, Intune app inventory and Microsoft 365 licenses, and feeds IFMP, SIM and MDM.
The top of the page shows:
- Last Sync, and how many Devices and Software Installs the source brought in.
- Sync Schedule: API connections sync automatically twice a week, Mon & Wed at 22:00 UTC.
- The connection’s settings, such as the Microsoft Tenant ID for Microsoft Graph. Stored values stay hidden.
- Documentation: the setup guide for this source.
Buttons
- Sync Now: Starts a sync straight away instead of waiting for the next scheduled one.
- Update Credentials: Opens the connection’s credentials so you can replace them.
- Verify Connection: Checks that Licenseware can connect with the credentials it has stored.
- Reset data: Removes everything this data source has imported. The connection itself stays.
- Delete Integration: Removes the connection’s configuration together with the devices it brought in.
Runs
The Runs table lists every sync, newest first, with when it Started, its Type, such as Scheduled sync, and its Status, such as Synced. Filter, download or expand the table from the icons at its top right.
Feed Errors
Feed Errors collects the errors the source reported while syncing. Expand it when a run didn’t complete or the data looks incomplete.
Microsoft Graph Last Sync Endpoints
For Microsoft Graph, this table breaks the last sync down by the Microsoft Graph endpoint it read from, such as users, subscribed_skus and activity_report. Each row shows the endpoint’s Status, how many Records Fetched, and any Error. Use it to see which part of a sync failed.