Find and eliminate wasted Microsoft 365 licenses. Free, open-source, self-hosted.
LicenseRadar connects to your Microsoft 365 tenant via the Microsoft Graph API and shows you exactly which licenses are wasted, who hasn't signed in, and how much money you can recover — all from a clean, self-hosted web dashboard.
No PowerShell. No SaaS subscription. No CLI. Just upload and audit.
This project is currently under active development.
Star the repo to follow progress and get notified on release.
| Milestone | Status |
|---|---|
| Project architecture & design | ✅ Complete |
| GitHub Pages showcase site | ✅ Complete |
| PHP app — install wizard | ✅ Complete |
| PHP app — Graph API integration | ✅ Complete |
| PHP app — 2FA (Email OTP + TOTP) | ✅ Complete |
| PHP app — Dashboard & reports | ✅ Complete |
| PHP app — 2FA (Passkey / WebAuthn) | ✅ Complete |
| 2026 standards audit (WCAG 2.2, SRI, CSP) | ✅ Complete |
| Security hardening audit (OWASP, info leak, CSRF) | ✅ Complete |
| Race condition fixes (OTP replay, rate limit, TOTP) | ✅ Complete |
| v1.0 public release | 🔜 Coming soon |
LicenseRadar scans your Microsoft 365 tenant and finds:
- Inactive licensed users — assigned licenses but no sign-in in 30/60/90/180 days
- Blocked accounts with active licenses — disabled Entra ID users still consuming paid seats
- Unassigned license slots — purchased seats that aren't assigned to anyone
- Redundant license stacking — users assigned overlapping plans (e.g. M365 E3 + standalone Exchange Online)
- Cost savings estimate — calculates monthly and annual waste in USD and INR
- Zero PowerShell — everything runs in a web browser
- Self-hosted — your data never leaves your server
- Works on shared hosting — Hostinger, cPanel, GoDaddy, Namecheap, LiteSpeed — no SSH needed
- WordPress-style install — fill in DB details, connect Azure, done in under 10 minutes
- 3-method 2FA — Email OTP (default), TOTP app, or Passkey / WebAuthn
- Geist design system — clean Vercel-style UI with auto dark/light mode
- WCAG 2.2 AA — fully accessible, keyboard navigable, screen reader friendly
- PDF & Excel export — one-click savings report for management
- 100% free — no subscription, no account, no tracking
- SRI protected — CDN scripts verified via Subresource Integrity hashes
- CSP hardened — Content Security Policy, HSTS, rate limiting, Argon2id passwords
- Race-condition proof — Atomic OTP verification, TOTP replay prevention, insert-before-check rate limiting
Email + Password
↓
2FA Challenge — choose one:
├── 📧 Email OTP (default, zero setup)
├── 📱 TOTP App (Google / Microsoft Authenticator, Authy)
└── 🔑 Passkey (Face ID / Touch ID / Windows Hello / YubiKey)
↓
Dashboard
LicenseRadar never writes to your tenant. Three read-only application permissions:
| Permission | Purpose |
|---|---|
User.Read.All |
Read all users and sign-in activity |
Directory.Read.All |
Read tenant directory |
Organization.Read.All |
Read subscribed SKUs and license counts |
v1.0 — Launch
- Project architecture & documentation
- Install wizard (WordPress-style, 5-step)
- Graph API integration (client credentials grant)
- Inactive / blocked / unassigned / redundant detection
- Cost calculator (USD + INR)
- PDF & Excel export
- Email OTP 2FA
- TOTP authenticator 2FA (QR code setup)
- GitHub Pages showcase site
- 2026 standards audit (WCAG 2.2, SRI, CSP, PHP 8.4)
- Passkey / WebAuthn 2FA (registration, removal, browser compat check)
- Security hardening audit (OWASP info leak, CSRF on setup, open redirect)
- Race condition fixes (OTP replay, rate limit bypass, TOTP replay)
- End-to-end deployment testing (requires HTTPS hosting)
v1.1 — Notifications
- Scheduled weekly email digest
- Slack & Microsoft Teams webhook alerts
v1.2 — Monitoring
- Entra App Secrets expiry monitor
- MFA coverage report
v2.0 — Scale
- Multi-tenant / MSP mode
- Docker image
Contributions are welcome once v1.0 is released.
Watch the repo or check Issues to see where help is needed.
Apache License 2.0 — see LICENSE for details.
Boopathi R — Senior IT Admin · Web Developer · Microsoft 365 Specialist · Bengaluru, India
Made with ♥ in Bengaluru, India