licensing

Not in 1.0.0b6. --period and the licensing slice itself arrived after that release. Everything below is written against the engine's main and is not runnable from the published version.

What it observes

What is assigned in a tenant, and whether the usage reports are permitted to name the people who hold it.

m365-governance collect licensing \
  --tenant-url <tenant>.onmicrosoft.com \
  --period D30 \
  --output ./evidence/licensing/

The address is the same --tenant-url every tenant slice takes. This collector opens no SharePoint session with it: it reads Graph, and the address only says which directory the evidence came from.

A different acquisition surface from every other collector

Every other collector here reads SharePoint through PnP. This reads the directory and the reporting endpoints through Microsoft Graph, with different modules, different permissions and a different sign-in.

Reports.Read.All is the least privileged permission Microsoft documents for the usage reports, delegated or application; Organization.Read.All and User.Read.All are the directory half. A delegated call also requires the caller to hold an appropriate administrator role.

The modules are named by m365-governance doctor, with the acquisition surface each one serves, so a machine that cannot run this says which install is missing rather than reporting an empty tenant.

Four coverage areas, and none of them implies another

This is the whole shape of the collector, and the reason it produces no findings.

assignment = completed does not imply usage = completed, and neither implies dependency = completed. A tenant can have every licence read and no usage report; it can have the usage report and no permission to attribute it; and it has never had dependency evidence, because this product collects none.

Concealed is an answer, not an absence

usage_identity is its own area because the three situations underneath it are three different facts:

• completed: the setting was read and the reports may name people.
• partial: the setting was read and says they may not. Microsoft conceals identifiable user information by default, in the admin centre reports, the Microsoft 365 usage reports in Graph and Power BI, and the Teams admin centre reports.
• missing: nobody read the setting.

A report of ten thousand rows whose principal names are concealed supports no statement about any person in it, so usage_rows and usage_rows_naming_a_principal are two separate counts.

What the evidence carries

There is no total number of licences

units_purchased existed and was removed. It summed prepaidUnits.enabled across SKUs and returned 1,130,062 on a tenant with thirty-seven assigned seats: arithmetically correct and meaningless, because the count means something different on a paid seat SKU and on a free or effectively unlimited one.

It was not replaced by a better total. Deciding which SKU quantities are additive is a classification this engine does not have, and an aggregate somebody hand-filtered is the same failure with more steps. The SKUs are published one row each; a consumer that wants a total has to say which rows it added.

consumedUnits is still summed, because an assignment means the same thing on every SKU: somebody holds it.

Whose limitation an absence is

Every acquisition surface records its attempt, and an absent one records who owns the limitation:

• implementation: this version does not collect it yet. Our work.
• tenant-or-identity: the directory refused. A fact about the environment.
• microsoft: not exposed in this cloud. A fact about the platform.
• caller: not asked for, such as a usage read with no period.

Only the first is unfinished product. The others are evidence.

What this does not do

It produces no recommendation, no saving, no unused-licence count and no score. Concluding that a licence can be removed needs evidence of use and of dependency; this reads the first at best and the second not at all, and the absence is recorded as a fact so that a usage figure cannot be read as an answer.