Valistry

Microsoft 365 Copilot seats

Which subscription is Microsoft 365 Copilot and how many units it consumes; the users who hold that licence, stored as hashes; and the Copilot usage report's last-activity date per holder. Never a document, never a prompt, never a chat, never a name.

Access

Kind
A read-only key you paste
What to give
App registration, client credentials
Why that one
An Entra app registration with three read-only application permissions. Valistry reads the licence list and the Copilot usage report; never a document, never a prompt, never a chat.

What it attributes on its own

From the source
seat holder (hashed) · seat-days in the window · whether Microsoft saw activity in this period, and in which apps · the SKU and how many units the tenant consumes
Needs a rule or a trace
tokens and models per seat — Microsoft reports activity, not usage · the charge itself — seats × the published or contract price stands in · when a seat was assigned, which the licence does not carry · outcome

The addresses it calls

  • https://login.microsoftonline.com
  • https://graph.microsoft.com/v1.0/
  • https://reports.office.com

Only these. A call anywhere else is refused before it leaves, and every call is logged.

Connecting it

  1. Register an application. Entra ID → App registrations → New registration. Name it so you recognise it in your own audit log. Open ↗
  2. Add three application permissions. API permissions → Microsoft Graph → Application permissions: LicenseAssignment.Read.All, User.Read.All, Reports.Read.All, then Grant admin consent. Each is the least privileged permission Microsoft names for its read.
  3. Create a client secret. Certificates & secrets → New client secret. Copy the Value, not the Secret ID.
  4. Paste the three IDs and click Test and connect. Valistry finds the Copilot SKU, counts its holders, reads the usage report, and stores the secret only if all three reads succeeded.

If the tenant's reports are anonymised (Microsoft 365 admin center → Settings → Org settings → Reports), holders and activity cannot be joined, and every seat is marked unknown rather than idle. Turning the setting off changes only what the report shows an admin; Valistry stores hashes either way.