After every sync, SeatReaper checks each client's synced data against the rules below. Each match becomes one item in the queue, priced from your price book.
Blocked user still licensed
A Microsoft 365 user whose sign-in is blocked but who still holds paid licenses. This is the most common sign of someone who left: the account was blocked, but the licenses were never removed.
The item lists every paid license the user holds. Licenses marked Ignore in the price book are left out.
With Datto SaaS Protection, KnowBe4 or Duo connected, the same item also lists the person's billed backup seat, active training seat and Duo user, and it stays flagged until all of them are gone, even after the Microsoft 365 licenses are removed. Seats are matched to the person by email or Microsoft 365 object ID.
Inactive user still licensed
A licensed user who has not signed in for 90 days (you can change this). SeatReaper looks at the latest of their interactive, non-interactive and successful sign-ins, so someone who only uses Outlook on a phone still counts as active.
It does not flag:
- guests,
- users created more recently than the threshold who have not signed in yet,
- anyone in a tenant without sign-in data (no Microsoft Entra ID P1 or P2). Blocked users are still flagged there.
Suspended Google user still licensed
A Google Workspace user who is suspended but still has a paid license. Google charges for suspended users, so suspending someone who left does not stop the cost. The item lists every paid license the user has; licenses marked Ignore in the price book are left out.
Inactive Google user still licensed
A Google Workspace user with a paid license who has not signed in for the same inactivity threshold as Microsoft 365 (90 days unless you change it). A user who has never signed in counts from the day the account was made.
It does not flag archived users, Archived User licenses, users with no paid license, or users created more recently than the threshold. Google's last sign-in time is when the person last signed in, which can be long ago for someone who stays signed in on a phone, so check before removing a license.
Seat for someone not in Microsoft 365
A billed user seat in Datto SaaS Protection, KnowBe4 or Duo whose email is on one of the client's Microsoft 365 domains but belongs to no Microsoft 365 user. Usually the account was deleted and the seats were left behind. One item per person lists every tool still billing.
It does not flag addresses on other domains (vendors, partners), shared mailboxes, sites, seats that are not billed, or clients without Microsoft 365 connected.
Unassigned licenses
Licenses purchased but not assigned to anyone. The item shows how many are unassigned and what they cost. Licenses on an annual commitment can usually only be reduced at renewal, so approving one means "reduce at the next opportunity". When the tenant has approved Organization.Read.All, the item shows when Microsoft renews the subscription; with Pax8 connected it also shows how many Pax8 bills and when the term ends.
Dead device still billing
A device that every connected tool considers dead:
- no N-central check-in for 60 days,
- no Datto RMM check-in for 60 days (and not online now),
- no NinjaOne contact for 60 days,
- not seen by CrowdStrike Falcon, SentinelOne, Webroot, Huntress or Sophos Central for 60 days,
- no successful Cove or Acronis backup for 30 days.
When the same device is in more than one of these tools, it is one item listing each charge. Devices are matched by name, ignoring capitals and any domain suffix. Datto RMM devices in the recycle bin are left out.
A device that is dead in one tool but alive in another is not flagged. An RMM agent checking in while Cove backups stopped means a backup problem, not waste, and the reverse means an agent problem. The title only names tools still billing, so a tool whose price is set to Ignore is left out.
Devices with no check-in data at all, such as N-central servers older than 2025.3.1.9, are not flagged.
Phone number nobody uses
A Flowroute number linked to a client with no inbound call, no outbound call using it as caller ID and no text sent or received for 90 days. A text keeps a number in use even when its calls are old, and so does a single inbound call, answered or not.
A number is only flagged once SeatReaper has read call and text history for the whole threshold. A number added to Flowroute after you connected counts from the day SeatReaper first saw it, so a new number is not flagged straight away. Numbers kept on purpose, such as alarm, elevator or fax lines, can be dismissed with a note. Released numbers count as verified savings once a sync no longer finds them on the account.
Thresholds
Owners can change the 90, 60, 30 and 90 days (sign-ins, devices, backups and phone numbers) to anything from 5 to 200 days, in steps of 5, under Settings > Price book, and on Growth and up for a single client on its page. The rules run again straight away.