30-second answer

PowerShell
# Read-only. Whether anything you read next can be attributed to a person.
Connect-MgGraph -Scopes 'ReportSettings.Read.All' -NoWelcome
Get-MgBetaAdminReportSetting | Select-Object DisplayConcealedNames

True is the tenant default. You still get the activity figures; the user principal names, display names, group names and site URLs come back as concealed identifiers instead.

What this proves

Whether user-level attribution is available in this tenant. It is a tenant setting rather than a permission, and it governs the admin centre, Microsoft Graph and the Teams admin centre reports together.

What it does not prove

  • That nobody used the licence. The reports aggregate over a period you choose. Microsoft publishes four: the last 7, 30, 90, and 180 days.
  • That a last activity date falls inside the period you asked for. It does not have to. Microsoft states that the last activity date is the most recent date on which a user performed any intentional activity within the app, regardless of the selected time period of the past 7, 30, 90, or 180 days. A seven-day report can carry a date from last year, and reading D7 as used in the last seven days is the most expensive mistake available on this report.
  • That the figures are current. Reports typically become available within 24 to 72 hours, but might sometimes take several days.
  • That a deleted account was inactive before deletion. When you delete a user account, Microsoft deletes that user's usage data within 30 days.
  • That the admin centre can assemble one person's cross-service picture. It does not: You can't generate a report where you enter a user's account and then get a list of which services they're using and how much. The Graph report described below does return this.

PowerShell

PowerShell
# All reads.

# The tenant setting that decides attribution.
Get-MgBetaAdminReportSetting | Select-Object DisplayConcealedNames

# Purchased against assigned, per SKU.
Get-MgSubscribedSku |
  Select-Object SkuPartNumber,
                @{n = 'Purchased'; e = { $_.PrepaidUnits.Enabled } },
                ConsumedUnits

# One row per user: licences held, last activity per service, assignment dates.
# Requires Reports.Read.All. The period is part of the call.
Get-MgReportOffice365ActiveUserDetail -Period 'D90' -OutFile .\active-users-90.csv

Example output

Text
DisplayConcealedNames
---------------------
                 True

SkuPartNumber                Purchased ConsumedUnits
-------------                --------- -------------
ENTERPRISEPACK                     500           487
SPE_E5                              60            55

Those SKU numbers come from the directory, so the reports and the concealment setting do not affect them. Thirteen ENTERPRISEPACK and five SPE_E5 are paid for and assigned to nobody.

Explanation

Three questions come up in a licence review, and they are answered by different parts of Microsoft 365.

Held. The directory. Get-MgSubscribedSku returns purchased and consumed counts per SKU, and the per-user assignments say who holds what. Purchased minus consumed is the number assigned to nobody.

Used. The usage reports. They cover a requested period rather than the present, they are published behind live activity, and they are anonymised by default: By default, all reports hide user information such as usernames, display names, groups, and sites to help companies support local privacy laws. The organisation setting behind this also applies to the Microsoft 365 usage reports in Microsoft Graph, so an application reading the API receives the same concealed identifiers as an administrator in the portal. A Global Administrator clears Conceal user, group, and site names in all reports under Settings, Org Settings, Services, Reports, or through the adminReportSettings API. Showing identifiable user information is a logged event in the Microsoft Purview portal audit log.

Needed. No Microsoft 365 report answers this. It is established from the policies, roles, retention obligations and processes that depend on the capability.

The portal and the API differ here

The admin centre states that you cannot enter a user's account and get back what they use. That applies to the admin centre. getOffice365ActiveUserDetail returns a CSV with one row per user and these columns: Report Refresh Date, User Principal Name, Display Name, Is Deleted, Deleted Date, a Has ... License column for Exchange, OneDrive, SharePoint, Skype for Business, Yammer and Teams, a ... Last Activity Date for each of the same services, a ... License Assign Date for each, and Assigned Products.

The concealment setting, the reporting period and the 30-day deletion of a removed user's data apply to this report as to every other.

The period aggregates the report; it does not bound the activity dates. The distinction is easy to lose because both live in the same file: Report Refresh Date and the period describe the report, and each ... Last Activity Date describes the person, unbounded. A row can therefore say this licence was assigned in March and last used in January, in a report requested for seven days.

A concealed name is a pseudonym, not a blank. For the Teams admin centre reports Microsoft documents the concealment as MD5 hashes of display name, group name, email and the Entra user ID. Whether the Graph CSV uses that same form is not stated in the endpoint's own reference, and this page does not claim it does. What follows either way is that a concealed report can still be compared with itself; what it cannot do is name the person.

Six workloads, and no others. Exchange, OneDrive, SharePoint, Skype for Business, Yammer and Teams have a column. A licence for anything outside those six has no activity evidence in this report at all: not Copilot, not Power Platform, not Defender, not Purview, not the rest of Viva. That is a limit of the surface, not a gap in a tool.

What the reports do not cover

Usage reports don't include perpetual license models. Activity through a licence granted outside this tenant's subscriptions is also absent. In both cases the user has no rows in the report, the same result as a user who did nothing.

Production considerations

  • The usage reports can be requested for 7, 30, 90 or 180 days. The reporting period is specified in the request; it is not repeated in each returned row.
  • Reports typically become available within 24 to 72 hours, but might sometimes take several days.
  • DisplayConcealedNames is a tenant setting, read through adminReportSettings. It has been the default for every tenant since 1 September 2021, and showing identifiable user information is a logged event in the Microsoft Purview portal audit log. Turning it off to make a report more useful is a change to what an organisation discloses, and it is recorded as one.
  • The permission is not the whole authorization. Reports.Read.All is the least privileged permission for this report, delegated or application, and there is no higher one. A delegated call additionally requires the signed-in user to hold a qualifying administrative role. Two of the roles on Microsoft's own list, Global Reader and Usage Summary Reports Reader, will only have access to tenant-level data, without visibility into detailed metrics. An identity can hold a listed role, be correctly permissioned, and still not receive this report.
  • The endpoint is available in the global service only. Not US Government L4, not US Government L5 (DOD), not China operated by 21Vianet. Graph supports this is not a statement about a tenant until the cloud is named.
  • There are two parameters, and they ask different questions. period aggregates over a window; date returns the users who performed any activity on one day, within the last 30. One of the two is required, and in PowerShell they are separate parameter sets: -Period and -Date are not passed together.
  • The report is always a file. -OutFile is mandatory in every parameter set of Get-MgReportOffice365ActiveUserDetail, and the REST call answers 302 with a short-lived preauthenticated download URL rather than with the data. Anything built on this needs somewhere to put a CSV; nothing about it arrives in the pipeline.
  • Get-MgSubscribedSku reads the directory. It involves no report, no period and no concealment setting.
  • Reports.Read.All is the least privileged permission for the Graph usage reports, delegated or application. A delegated call also requires the caller to hold an appropriate administrator role.

None. No observed activity and not required are different statements, and these reports establish only the first.

References

Found something wrong? Suggest a correction. The article source is not public; the engine it cites is.

What this answer underwrites

The engine reads these Microsoft operations to collect evidence, so what is established here is what those collectors rest on.

  • licensingwhat is assigned in one tenant, and whether the usage reports are permitted to name the people who hold it