Finding unused AI licences — without revoking them automatically

The situation

The project folder does not document it. No README, no design notes, no ticket references — and no commit messages, because the repository contains no commits at all. Any account of the prior situation would be invented.

What the code implies, and no more: it answers “are we paying for seats nobody uses?” — a per-seat cost is configurable, and unused seats are priced out to an annual waste figure. And the email tells the reader to filter the attached spreadsheet in Excel “before any bulk action”, which suggests such reviews were previously done by hand. An inference, not a statement.

The approach

A single Function App with two entry points: a weekly timer and an HTTP endpoint for on-demand runs. Both call the same pipeline.

Authentication goes through the managed identity — no credentials anywhere in the code. It pulls the user directory with licence assignments and last sign-in timestamps, the per-user usage report, and three baseline activity reports covering email, Teams and files. Directory data arrives as JSON; the baseline reports are only reliably served as CSV, which the collector normalises into the same shape.

These sources are joined per person into one wide record of 47 fields: identity, department, country, manager, which applications the AI was used in, and how long ago.

On top sits a department benchmark: median and upper quartile of days since last use, computed only for departments with at least three licence holders so small teams do not skew the picture. A rules engine classifies each user; results go to storage as CSV and JSON, and out as an HTML email with the spreadsheet attached.

Where it could have gone the other way

The system recommends, but never acts.

Every call in the entire codebase is a read. No path removes a licence, changes group membership or emails an end user — despite having everything needed to do so, including each affected person’s manager.

The judgement is clearest in the classification rules. A user with no AI activity is not automatically flagged for removal. The rules first check whether that person is otherwise active — meetings attended, emails sent, files touched. If so, the recommendation becomes coach, not reclaim. A cost problem turns into a training problem.

This could have gone the other way: a simpler tool would flag every non-user as waste and automate revocation. The design trades that automation away deliberately, and several “review” cases exist purely to route ambiguity to a person — for example users seen only in chat, which also exists as a free tier.

The result

13 modules, around 1,690 lines, of which roughly 750 are the email rendering alone. Four connected systems, nine API endpoints, two entry points.

A second entitlement path is handled separately: the AI workspace tier is not a per-seat licence; access comes from usage-based spending policies scoped to security groups. The system resolves transitive membership of two configured groups to determine it.

Limits stated openly: there is no test suite — including for the classification rules, whose output drives cost decisions. Workspace credit consumption is not exposed through the API at all; the report says so in its own output and points to the admin centre rather than substituting a proxy metric.

And the most honest limitation is in the project too: activity is a proxy for value. “Last active” says somebody opened the application, not that it helped. Light-but-critical use looks exactly like habitual low-value use.