Getting started

Before you start

Two Azure permissions are involved, and they are usually held by the same person. If they are not, you will need someone else for step 3:

• To approve the connection: a role that can grant tenant-wide admin consent — Global Administrator or Privileged Role Administrator.
• To grant read access: Owner or User Access Administrator on whatever scope you want scanned (a subscription, a management group, or all of them).

The trial is 14 days, covers the full product, and asks for no credit card.

1. Create your account

At app.tenantthrift.com you can either sign up with a work email and password, or use Continue with Microsoft. Both create an organization for you.

Signing up with email asks for your country. That is a billing-eligibility question, not marketing: TenantThrift does not sell into the United States or Canada, so those are not offered. If you sign in with Microsoft instead, no country is collected at that point — you will be asked once, later, the first time you open checkout.

Signing up with Microsoft requires no admin rights on its own. That comes at step 2.

2. Connect your tenant

On the dashboard, press Connect with Microsoft. You are sent to Microsoft's admin-consent screen, which lists exactly what is being approved. Consent creates a service principal — an enterprise application — inside your own tenant that represents TenantThrift. No secret is exchanged with you; the credential stays on our side and is scoped to that one application.

Consent alone grants no access to your resources. It only establishes the identity that step 3 will grant Reader to.

3. Grant Reader

After consent you land on the onboarding page for the new connection. It shows a ready-made command with your app ID already filled in, and lets you pick the scope:

az role assignment create \
  --assignee <app-id> \
  --role Reader \
  --scope /subscriptions/<subscription-id>

You choose whether to assign it across all subscriptions, a management group, or a single subscription. Narrow is fine — you can widen it later and re-verify.

Prefer the portal? Subscription → Access control (IAM) → Add role assignment → role Reader → members: User, group, or service principal → search TenantThrift → Review + assign.

Reader is the only role TenantThrift ever asks for, and the only one it needs. If you grant more, the app will notice and tell you — see Security & trust.

4. Verify access

Press Verify access. TenantThrift probes your tenant, confirms the Reader assignment worked, and discovers which subscriptions it can see. Role assignments in Azure can take a minute to propagate, so if the first attempt comes back empty, wait and press it again.

Verification is also where the connection gets its real name, and where your organization's placeholder name is upgraded to your company's actual domain.

5. Run the first scan

Press Run the first scan. Depending on how many subscriptions and resources are in scope this takes a few minutes; the page moves on to the tenant overview and updates when results land.

A scan reads resource metadata, cost data and — for VMs — runtime metrics. All of that is processed in memory. What is kept afterwards is the bounded set described in Your data.

Optional: Microsoft 365 license optimization

Beyond Azure cost, TenantThrift can find wasted Microsoft 365 licenses — shelfware you bought but never assigned, seats on disabled or long-inactive accounts, idle add-ons, and overlapping SKUs. It is an optional module, off by default, and it uses a separate app registration from your Azure connection.

Why a second consent? Reading license data needs read-only Microsoft Graph permissions (subscribed SKUs, user license assignments, sign-in activity and usage reports). Those live on their own app, so they are only ever granted in tenants that opt in — your Azure-cost connection is never asked for them.

How to turn it on — you need the Admin role in TenantThrift, and a Global Administrator in your Microsoft 365 tenant to approve the consent:

1. Open Settings on the tenant and find Microsoft 365 license optimization.
2. Click Enable & grant consent. You are sent to the Microsoft admin-consent screen, which lists the four read-only Graph permissions.
3. A Global Administrator approves. You return to TenantThrift and a new Licenses tab appears.
4. Run a scan (or wait for the next scheduled one) and the tab fills with per-SKU counts and reclaimable cost.

What it stores: counts and costs only — no names, no email addresses, no user IDs. To see which people hold a license, the tab deep-links into your own Microsoft 365 admin center.

Entra ID P1 sharpens inactive-user detection (it reads sign-in activity); without it, that falls back to Microsoft 365 usage reports. Shelfware, disabled accounts and overlap need neither. To switch the module off later, use the same panel in Settings — that stops the scan pulling license data; revoking the Graph consent itself is done in your own Enterprise Applications.

What to do next

The tenant overview shows a setup checklist that disappears once you are done. The three optional items on it are the ones worth finishing:

• Add a report recipient so the PDF lands in an inbox instead of waiting for someone to log in — see Reports & alerts.
• Turn on new-waste alerts to hear about waste appearing above a threshold you set.
• Turn on cost-spike alerts to hear when spend jumps against its own baseline.

Then set a scan schedule (Settings → Schedule) so this keeps running without you.

Things that trip people up

• You need the Editor or Admin role to finish onboarding. A team member with the Reader role can open the onboarding page but cannot verify or start a scan.
• How many tenants you may connect depends on your plan. Personal and Business allow one connected tenant; MSP and the trial allow as many as you like. Connecting a second tenant on Personal or Business stops with a note rather than a bill.
• A scan needs a verified connection. If verification never succeeded, the scan button will refuse rather than silently do nothing.
• When the trial ends, scanning pauses — everything already scanned stays readable.