30-second answer

PowerShell
# Read-only. Whether anything you read next can be attributed to a person.
Connect-MgGraph -Scopes 'ReportSettings.Read.All' -NoWelcome
Get-MgBetaAdminReportSetting | Select-Object DisplayConcealedNames

True is the tenant default. You still get the activity figures; the user principal names, display names, group names and site URLs come back as concealed identifiers instead.

What this proves

Whether user-level attribution is available in this tenant. It is a tenant setting rather than a permission, and it governs the admin centre, Microsoft Graph and the Teams admin centre reports together.

What it does not prove

  • That nobody used the licence. The reports aggregate over a period you choose. Microsoft publishes four: the last 7, 30, 90, and 180 days.
  • That the figures are current. Reports typically become available within 24 to 72 hours, but might sometimes take several days.
  • That a deleted account was inactive before deletion. When you delete a user account, Microsoft deletes that user's usage data within 30 days.
  • That the admin centre can assemble one person's cross-service picture. It does not: You can't generate a report where you enter a user's account and then get a list of which services they're using and how much. The Graph report described below does return this.

PowerShell

PowerShell
# All reads.

# The tenant setting that decides attribution.
Get-MgBetaAdminReportSetting | Select-Object DisplayConcealedNames

# Purchased against assigned, per SKU.
Get-MgSubscribedSku |
  Select-Object SkuPartNumber,
                @{n = 'Purchased'; e = { $_.PrepaidUnits.Enabled } },
                ConsumedUnits

# One row per user: licences held, last activity per service, assignment dates.
# Requires Reports.Read.All. The period is part of the call.
Get-MgReportOffice365ActiveUserDetail -Period 'D90' -OutFile .\active-users-90.csv

Example output

Text
DisplayConcealedNames
---------------------
                 True

SkuPartNumber                Purchased ConsumedUnits
-------------                --------- -------------
ENTERPRISEPACK                     500           487
SPE_E5                              60            55

Those SKU numbers come from the directory, so the reports and the concealment setting do not affect them. Thirteen ENTERPRISEPACK and five SPE_E5 are paid for and assigned to nobody.

Explanation

Three questions come up in a licence review, and they are answered by different parts of Microsoft 365.

Held. The directory. Get-MgSubscribedSku returns purchased and consumed counts per SKU, and the per-user assignments say who holds what. Purchased minus consumed is the number assigned to nobody.

Used. The usage reports. They cover a requested period rather than the present, they are published behind live activity, and they are anonymised by default: By default, all reports hide user information such as usernames, display names, groups, and sites to help companies support local privacy laws. The organisation setting behind this also applies to the Microsoft 365 usage reports in Microsoft Graph, so an application reading the API receives the same concealed identifiers as an administrator in the portal. A Global Administrator clears Conceal user, group, and site names in all reports under Settings, Org Settings, Services, Reports, or through the adminReportSettings API. Showing identifiable user information is a logged event in the Microsoft Purview portal audit log.

Needed. No Microsoft 365 report answers this. It is established from the policies, roles, retention obligations and processes that depend on the capability.

The portal and the API differ here

The admin centre states that you cannot enter a user's account and get back what they use. That applies to the admin centre. getOffice365ActiveUserDetail returns a CSV with one row per user and these columns: Report Refresh Date, User Principal Name, Display Name, Is Deleted, Deleted Date, a Has ... License column for Exchange, OneDrive, SharePoint, Skype for Business, Yammer and Teams, a ... Last Activity Date for each of the same services, a ... License Assign Date for each, and Assigned Products.

The concealment setting, the reporting period and the 30-day deletion of a removed user's data apply to this report as to every other.

What the reports do not cover

Usage reports don't include perpetual license models. Activity through a licence granted outside this tenant's subscriptions is also absent. In both cases the user has no rows in the report, the same result as a user who did nothing.

Production considerations

  • The usage reports can be requested for 7, 30, 90 or 180 days. The reporting period is specified in the request; it is not repeated in each returned row.
  • Reports typically become available within 24 to 72 hours, but might sometimes take several days.
  • DisplayConcealedNames is a tenant setting, read through adminReportSettings.
  • Get-MgSubscribedSku reads the directory. It involves no report, no period and no concealment setting.
  • Reports.Read.All is the least privileged permission for the Graph usage reports, delegated or application. A delegated call also requires the caller to hold an appropriate administrator role.

None. No observed activity and not required are different statements, and these reports establish only the first.

References

Found something wrong? Suggest a correction. The article source is not public; the engine it cites is.

What this answer underwrites

The engine reads these Microsoft operations to collect evidence, so what is established here is what those collectors rest on.

  • licensingwhat is assigned in one tenant, and whether the usage reports are permitted to name the people who hold it