The method
Any tool can list dormant accounts. The bar is what happens next: a total that survives a finance team's questions, a saving that is only claimed when a licence actually came off the invoice, and a finding that is named even when it cannot be proved. This page is how WantNot gets there.
When a finding disappears, most tools call it a saving. Often it isn't — a dormant user who comes back from leave still holds their licence, and you are still paying for it.
WantNot watches the licence assignment snapshot, not just the findings. A resolution is only counted when the licence was genuinely released or the seat count cut. Findings that stop being flagged for any other reason are reported as absorbed — still assigned, still billed.
The headline is the change in committed spend, because that is the figure that appears on the invoice. Reclaimed numbers are what you take to a renewal.
It is the difference between a number you can present, and one that falls apart the moment somebody checks it.
Why it matters: if absorbed findings were counted as savings, the product would reward its own blind spots. A licence that was never released is not money back — it is next month's invoice.
Five finding types, ordered by how easily each one survives an argument with a finance team. The hottest are unarguable; the last needs a human to confirm.
Purchased and assigned to nobody. The seat count exceeds the people in it — licences bought, billed, and never given a user.
The account was switched off when someone left. The licence stayed attached — and kept billing. Purely administrative waste.
No sign-in in 90 days — interactive or background. A mailbox that still syncs is not flagged, because it is being used.
Licensed at provisioning and never once used. New starters get a 45-day grace window, because onboarding is not waste.
A standalone SKU whose every service is already inside a bundle the same user holds. Computed from service plans, so it stays right as Microsoft reshuffles them.
The differentiator
Microsoft's own reports age out a licence one SKU at a time. It has never had a reason to collect all of a single person's waste into one place — because the whole point of a licence is to keep paying for it.
WantNot collates findings by the person who holds them, then rolls each person up by department, role and user type. A user with six idle licences shows up as six lines under their name instead of six rows scattered through a ledger — and one conversation closes the lot of them at once.
That aggregation is the part Microsoft never builds.
It costs no extra permission: department, role and user type are attributes that already come back with the read-only user scope WantNot holds.
Sorted by who costs the most · $7,822 across the accounts shown
A number nobody can re-derive is a number that will be argued. Every report is built so a reader armed with a calculator gets the same answer.
Each finding rounds its own annual figure while the scan rounds the sum of the monthly ones — a dollar can differ legitimately. Totals are computed from the raw numbers, so a bottom line never lands a dollar under its headline.
When a view shows a subset — filtered, truncated, or per-person — the subset and the full total are stated separately. A bottom line that silently covers only the rows on screen would disprove the headline instead of proving it.
The change in committed spend is the one column never totalled from rows. It is read from the endpoints directly, because a missing comparison would let the intermediate terms cancel and still total to a believable answer.
If the headline and the line items ever disagree by more than a dollar, the report says so out loud and names the gap, rather than hiding it. A mismatch found by the reader is a lost renewal.
Every data source is missing something. A tool that quietly covers less than its reader assumes is the failure this product exists to avoid, so the gaps are part of the report.
The usage report has no sign-in-blocked column; no export carries service plans; a missing licences file makes purchased counts unknowable. Each of those is said in the report that uses it.
If a permission or attribute is missing, the affected finding type is reported as unavailable — the total visibly covers less, rather than pretending to cover everything.
Every safe fallback — a missing hash key, a missing permission — emits a warning or a health field. There is no control that is believed to be on and is not.
Three permissions, all read. Nothing WantNot holds can change anything in a tenant.
Organization.Read.AllWhich licences have been purchasedReadUser.Read.AllWho holds them, whether the account is active, and the department, role and user type used for attributionReadAuditLog.Read.AllLast sign-in dates, to identify dormant accountsReadRuns in the browser with your administrator sign-in. The access is held only while the tab is open, and nothing is stored anywhere.
An administrator grants app-level consent once; scans run nightly with the same three read scopes and nothing more.
The one capability that could change a directory exists but is disarmed. It is never triggered by a timer; a human initiates it, a preview always precedes it, and the plan must be confirmed before anything runs.