Removing licenses from SeatReaper

SeatReaper is read-only by default. On the Growth and Pro plans an owner can let the team make the most common changes without leaving SeatReaper:

• Block sign-in for a Microsoft 365 user and sign them out of every app and device.
• Remove licenses from a Microsoft 365 user, all of them or the ones you choose.
• Lower a Pax8 or Partner Center subscription's quantity, for example after licenses were freed up.

Anything else (deleting a user, converting a mailbox, removing a device from N-central) still happens in the vendor's own console, and SeatReaper confirms it on the next sync.

Turn it on

An owner opens Settings > Removals and chooses Turn on. Turning it off makes SeatReaper read-only again straight away. Both are recorded in the audit log. If the workspace moves to a plan below Growth, changes stop.

Who can make changes

• Owners and techs, for the clients they can see. A tech an owner limited to some clients can only change those clients.
• Viewers never can.

Approve changes in each client's Microsoft 365

Syncing uses the read-only SeatReaper Connector app. Changes use a second app, SeatReaper Actions, so a tenant that only approved reading can never be changed. Once removals are on, open the client and, in the Microsoft 365 card, choose Approve changes in Microsoft 365. An admin of the client's tenant signs in and accepts, the same way as connecting Microsoft 365. SeatReaper Actions asks for these Microsoft Graph application permissions:

It cannot read email, files, chats or calendars, and it cannot delete users or change passwords. Stop allowing changes on the client's page ends it in SeatReaper; to remove the app from the tenant too, an admin deletes SeatReaper Actions under Entra ID > Enterprise applications. Disconnecting Microsoft 365 also stops changes.

Microsoft does not let an app block or change an administrator account (for example a Global Administrator). Do those in the Microsoft 365 admin center.

Make a change

• In the queue, open items for inactive or blocked users show Fix it from SeatReaper, and unassigned licenses billed through Pax8 or Partner Center show Lower the Pax8 quantity or Lower the Partner Center quantity.
• In an offboarding, the person's sign-in and licenses can be handled at the top of the page.
• On a client page, the Microsoft 365 user list has a Changes column once the client has approved changes. Open it for any person to block their sign-in or remove the licenses you tick. Nothing is ticked to start with, since most people on the list still work there.

Every change takes two steps: the button, then a confirmation that names exactly what will change. The change happens right away. SeatReaper updates its own copy at once, so the queue and the offboarding move on, and the next sync confirms it. Removing licenses or lowering a Pax8 or Partner Center quantity also approves the item in the queue, so the saving counts as verified once it is gone.

Partner Center

Lowering a quantity uses your Partner Center connection. Microsoft allows decreases on new-commerce subscriptions only within 7 days of purchase or renewal, and the lowest quantity is 1 (to end a subscription, cancel it in Partner Center). When Microsoft refuses, SeatReaper shows its reason and nothing changes.

Pax8

Lowering a quantity uses your Pax8 connection; its API credentials must belong to a Partner Admin. Pax8 refuses to lower most Microsoft (NCE) subscriptions in the middle of a term: they can be lowered just after they renew. When Pax8 refuses, SeatReaper shows its reason and nothing changes.

Limits and history

• At most 200 changes an hour per workspace, and the same change cannot run twice at once.
• Settings > Removals lists the last 100 changes with who made them, and each client's page lists its last 10. Every change and its outcome is also in the audit log, attributed to the person who made it.

Problems