SeatReaper reads each client's Microsoft 365 tenant directly. An admin of the client's tenant approves SeatReaper once; after that it syncs every day on its own.
Connect a client
- Make sure the client has its Microsoft 365 tenant ID recorded (see Adding a client and finding its IDs).
- Open the client and, under Data sources, choose Connect Microsoft 365. Owners and techs can do this.
- Microsoft opens. Sign in as a Global Administrator or Privileged Role Administrator of the client's tenant (not your own MSP tenant) and choose Accept.
- You come back to the client's page. SeatReaper checks the approval worked and runs the first sync.
If you use GDAP and your account can't approve app permissions in the client's tenant, ask someone at the client with one of those roles to do step 3. Start the connection from SeatReaper, then send them the Microsoft page before it expires (30 minutes).
What SeatReaper can read
SeatReaper asks for four read-only Microsoft Graph application permissions:
| Permission | Used for |
|---|---|
| User.Read.All | Users, whether sign-in is allowed, and which licenses each one has |
| AuditLog.Read.All | Each user's last sign-in date, and whether they have registered for MFA (for the MFA coverage report) |
| LicenseAssignment.Read.All | Licenses purchased and assigned in the tenant |
| Organization.Read.All | Each license subscription's renewal date and Microsoft subscription ID, used to match Pax8 billing |
It cannot read email, files, chats or calendars, and it cannot change anything in the tenant: no permission it holds allows writes. Blocking sign-in and removing licenses from SeatReaper (Growth and up) use a separate app, SeatReaper Actions, that the client's admin approves on its own; see Removing licenses from SeatReaper.
Approving the new permission
Organization.Read.All was added in October 2026. Clients connected before then keep syncing as before, and their page shows Approve again in Microsoft. An admin of the client's tenant chooses it and approves once; Microsoft lists the permissions SeatReaper asks for. Until then, renewal dates and Pax8 matching by subscription ID are not available for that client.
Sign-in dates need Entra ID P1
Microsoft only gives last sign-in dates to tenants with a Microsoft Entra ID P1 or P2 license (included in Microsoft 365 Business Premium, E3 and E5). For other tenants SeatReaper still syncs users and licenses, and the client's page says sign-in dates are unavailable. MFA registration needs the same license, so for those tenants the MFA coverage report says it is unavailable.
What you see
The client's page lists the tenant's licenses (assigned, purchased and unassigned) and its users with their licenses and last successful sign-in. Dates more than 30 days old are highlighted, and more than 90 days old in red.
Syncing
Every connected tenant syncs once a day. Choose Sync now on the client's page for an immediate sync (once every 5 minutes).
Problems
| Message | What to do |
|---|---|
| SeatReaper is not approved in this tenant yet | Choose Approve again in Microsoft and sign in as an admin of the client's tenant |
| That tenant ID was not found | Check the tenant ID under Tool IDs |
| Microsoft denied access | The approval was removed or changed. Approve again |
| A Conditional Access policy blocked SeatReaper | Exclude the SeatReaper Connector app from that policy in the client's tenant |
Removing access
Disconnect on the client's page stops syncing, deletes everything synced from the tenant and ends any approval for changes. To remove SeatReaper's access completely, an admin of the client's tenant deletes SeatReaper Connector under Entra ID > Enterprise applications.
In compliance reports
On Growth and Pro, Microsoft 365 is the base of the compliance evidence reports: the Access review lists every account, MFA coverage shows who has registered for multifactor authentication, and Security training status and Backup status use the licensed, enabled users. Without sign-in dates (see above), no account is listed as inactive.