Overview

This event monitor connects to your Microsoft 365 account and monitors licensing parameters including the number of available licenses, changes in license counts, and more.

Use Cases

• Detecting changes in the number of available licenses
• Receiving alerts before licenses expire

Monitoring Options

This event monitor provides the following options:

Alert with [Info/Warning/Error/Critical] if Microsoft 365 cannot be contacted

If the event monitor cannot contact Microsoft 365 for any reason, the event monitor generates an alert with the alert level that you select here.

Alert with [Info/Warning/Error/Critical] if the total license count changes

This option will alert you if your total number of Microsoft 365 licenses changes. For example, if you purchase more licenses in the Microsoft 365 portal, this option will alert you when it detects the new license count.

Alert with [Info/Warning/Error/Critical] if the number of consumed licenses changes

This option will alert you when your number of available Microsoft 365 licenses changes. The number of available licenses can change if you assign unused licenses to users or if you remove users from license categories, thereby making those licenses available.

Alert with [Info/Warning/Error/Critical] if the number of available licenses is less than [#]

This option will alert you when your number of available Microsoft 365 licenses drops below the threshold you specify.

Alert with [Info/Warning/Error/Critical] if the number of available licenses is more than [#]

This option will alert you when your number of available Microsoft 365 licenses exceeds the threshold you specify. This option can be useful for identifying cost savings by sizing your paid license count to better match your requirements.

Alert with [Info/Warning/Error/Critical] about licenses that will expire after the 30-day grace period

Microsoft offers trial licenses for Microsoft 365. Use this option to get alerted about trial licenses that will expire soon.

Only check licenses with the following SKUs: [List]

Many organizations have a mix of different types of Microsoft 365 licenses. Use this option to tell the event monitor which license SKUs you want to check. To see the SKUs in use by your account, run the event monitor once with this option set to be blank and then look in the resulting event text.

Authentication and Security

When using a username/password to authentication, the account used to authenticate must have the Office 365 Management APIs permission in the Azure Portal.

When using an Azure app registration to authenticate (recommended), the app must have the "Microsoft Graph > LicenseAssignment.ReadWrite.All" permission.

Protocols

Data Points

This event monitor generates the following data points:

Data Point	Description
Available License Count	The number of available licenses.
Consumed License Count	The number of consumed licenses.
Licenses Expiring	The number of licenses expiring soon.
Total License Count	The total number of licenses.

Sample Output

Tutorial

To view the tutorial for this event monitor, click here.