Stop paying for Microsoft 365 licenses nobody uses.

No. We connect with read-only OAuth 2.0 delegated permissions. We have no write access. Nothing in your tenant can be modified, created, or deleted by Sentsai. Ever. This is a deliberate security choice, not a missing feature: even if Sentsai were ever compromised, nobody could change anything in your tenant through us, because we simply do not have that capability. You review every recommendation and make each change yourself, on your own terms.

We store your Microsoft tenant ID, your admin email, the name and email of whoever runs each scan (shown on that report), and your encrypted scan findings. Those findings may include named user references as part of remediation guidance: for example, identifying which specific accounts hold wasteful licenses. Raw directory data is not retained beyond the scan itself. All findings are encrypted at rest and automatically purged after your retention period (default 90 days). We also keep a license history with no names in it (seat counts per product, subscription renewal dates and savings totals for each scan), the status and optional note your team sets on each recommendation, the prices you enter in your price book, and a record of each share link you create, holding only a hash of the link itself. If you keep an account on purpose (a break-glass or service account, say), we keep a keyed hash of its Microsoft ID with the reason and any note, never its name. These are kept until you erase your data or delete your account, except share link records, which are deleted 90 days after the link expires or is revoked. Separately, we retain your organization name, admin email, and the headline savings figure we identified so we can send you re-scan reminders: about five months after a free scan, or yearly once you are a customer, plus up to three follow-ups if you run a free scan and do not unlock it. You can opt out of all of these at any time in Settings. We also keep a security log of sign-ins, scans and report views (with IP address and browser) and records of payments; the Privacy Policy lists everything we keep and for how long. You can export your data at any time from your account Settings page. Requesting erasure or changing your retention window affects your whole organization, so those need a Microsoft 365 administrator.

The scan is completely free, and it shows your price before you pay anything. The full remediation report costs $2 per licensed user for 12 months, with a minimum of $99. A licensed user is an enabled account in your directory with at least one paid Microsoft license assigned; disabled and unlicensed accounts are not counted, and guests are counted only if they hold a paid license. That one payment activates a 12-month subscription: every scan you run for the next year is unlocked automatically, with no per-report fee, so you can re-scan any time to confirm the savings you capture after making changes. Next year costs the same formula, counted again from a recent scan. If the savings a scan identifies are less than the price, we tell you before you pay. Automatic renewal is optional and off by default - unless you turn it on, the subscription simply expires unless you choose to renew, and if you do turn it on we email you the exact amount about 30 days before charging.

People inside your own Microsoft 365 organization, and anyone you send a share link to. Microsoft grants app consent once per tenant rather than per user, so once one of your administrators approves Sentsai for your organization, anyone in your directory can sign in and start a scan. That distinction matters: an administrator who approves only for their own account is the sole person who can use it, and everyone else keeps seeing "Need admin approval" from Microsoft. Once signed in, an administrator can grant it for the organization from Settings, under Organization access; a colleague who is blocked also gets that action on the sign-in error they see. For complete results, the person running the scan also needs a reporting role: Microsoft releases usage reports, sign-in activity and MFA registration details only to accounts that hold one, such as Reports Reader. When someone without one runs a scan, the checks that need that data are skipped and the report says so. An administrator can assign Reports Reader in the Microsoft Entra admin center. If you would rather narrow who can sign in, you can do that in Microsoft Entra: open Enterprise applications, select Sentsai, then Properties, and set "User assignment required" to Yes. Results are scoped to your tenant ID and Sentsai never shares them with other customers. A share link shows one report, read-only, to whoever holds it until it expires or is revoked, with names hidden unless you choose to show them.

One administrator, once. Every Microsoft Graph permission Sentsai requests is read-only, and Microsoft classifies all four as requiring administrator approval, so nobody at your organization can use Sentsai until an administrator approves it for the tenant. The roles Microsoft permits to do this are Global Administrator, Privileged Role Administrator, Cloud Application Administrator, Application Administrator, and AI Administrator. Cloud Application Administrator is the least privileged of those and is sufficient for Sentsai. User Administrator and Helpdesk Administrator cannot approve applications, so those roles will still see "Need admin approval" from Microsoft. The ordinary sign-in screen makes organization-wide approval an easily missed checkbox, and missing it approves Sentsai for that one administrator while leaving the rest of your team blocked. To avoid that, sign in and use Approve Sentsai for the whole organization in Settings, under Organization access, which approves for everyone in one step. Anyone blocked by Microsoft also gets the same action on the error they see, so they can send it to an administrator.

Go to Microsoft Entra admin center, open Enterprise Applications, find Sentsai, and delete it. Microsoft then stops giving Sentsai any new access to your tenant. A sign-in token Microsoft has already issued cannot be recalled and stays valid until it expires, normally within 60 to 90 minutes; signing out of Sentsai first discards it at once. Your report remains available in your dashboard until your retention period expires.

Yes. Our GDPR Article 28 DPA is available at /legal/dpa and is automatically accepted when you agree to our Terms of Service. We act as a data processor; your organization is the controller. You can exercise your rights directly from your account Settings page. Export is open to any signed-in user; erasure and retention changes apply to the whole organization, so they need a Microsoft 365 administrator.

No, Sentsai currently scans Microsoft 365 licensing only (user accounts, license assignments and subscriptions, mailbox and app usage, MFA, guest accounts). We do not access or analyze Azure virtual machines, storage, networking, or subscription billing. Azure cost optimization is a different permission model and is not in scope today.

Savings are calculated against Microsoft's standard commercial list prices (ERP) in USD. They do not account for nonprofit, education, or government pricing tiers, promotional discounts, time-limited offers, Microsoft Action Pack benefits, trial credits, CSP (Cloud Solution Provider) partner margin, volume discounts, or individually negotiated EA (Enterprise Agreement) or MCA (Microsoft Customer Agreement) rates. If your organization pays less than standard list price for any reason, the savings figure will overstate your actual opportunity. Treat the report as a ceiling on potential savings and verify against your own agreement pricing before acting on any recommendation. If you enter what you actually pay under Your prices in the dashboard, the report also shows savings at those prices beside the list-price figure. Sentsai's price does not depend on this figure: it is set by your licensed users.