Questions and answers

IT directors and the admins who work with them, at small and medium-sized businesses that run on Microsoft 365. It's built for the person responsible for the tenant: someone who needs to know what the licenses cost, what's being wasted, and where the risks are, and who has to explain it to leadership.

No. Seat Census runs in your browser: sign in with Microsoft and run the audits. There's no agent, no PowerShell and no modules on your side. It works in current versions of Edge, Chrome, Firefox and Safari on a computer.

The audits read across the whole tenant: licenses, users, roles, apps and their permissions, Conditional Access, groups, sites, Exchange and Teams. Seat Census is made for the person who holds that responsibility, so it checks for an active Global Administrator role at every sign-in. If you use Privileged Identity Management, activate the role before you sign in.

It depends mostly on the number of users, groups and sites in your tenant. Audits run on our servers in the background, so you can close the tab or carry on with other work and come back to the results.

Delegated permissions, which let Seat Census act as you, with your rights, only while you use it. A Global Admin approves them once, on one Microsoft consent screen:

• Microsoft Graph read permissions for users, groups, apps, devices, policies, usage reports, audit logs and sites
• The Exchange Online and Teams admin access their PowerShell modules use, for the Litigation Hold check and the Exchange and Teams tools, which Seat Census only uses to read

The permission to change apps (Application.ReadWrite.All) isn't part of sign-in. Microsoft asks for it the first time you run an action.

Not on its own. The audits and tools only read. The one exception is the enterprise app lookup, which can disable, enable or delete an enterprise app, and only after you confirm the change in the app.

Everything Seat Census keeps from your tenant is encrypted with your tenant's own key. Every Global Admin of your tenant who signs in sees your account's audits; a tool's result stays with the admin who looked it up and is deleted when they sign out. Our administration panel shows account details only, not your audit data. See Security and the privacy policy.

Close your account on the Subscription page. Everything is deleted immediately, including your tenant's key, and seven days later no backup copy can be decrypted either. You can also remove Seat Census from your tenant in the Microsoft Entra admin center, under Enterprise applications.

Microsoft verifies an app's publisher through its partner program. Until Seat Census is verified, the consent screen shows it as unverified. A Global Admin can still approve it.

Seat Census runs what it can and says what it skipped. Without Exchange Online, the Litigation Hold check and the Exchange tools are unavailable. Without Teams, the Teams tools are. Sign-in logs and last sign-in times need Microsoft Entra ID P1 or P2.

Seat Census has a built-in price list for common Microsoft 365 licenses. On the paid plans you can enter the prices you actually pay, so the spend and waste figures match your invoices.

No: one account, and one subscription, covers one tenant. Consultants and managed service providers sign in to each tenant separately and need a subscription for each.

Your account moves to the free plan at the end of the period you paid for. Your latest audit stays; what the free plan doesn't keep is deleted. Free accounts that nobody signs in to for 90 days are deleted.

Seat Census is new. It works, and you can rely on how it treats your data, but features and plans may change and there's no service-level agreement yet. We'd like to hear what you think: support@seatcensus.com.