No tenant connection
The workflow itself never signs in to Active Directory or Microsoft 365. Any generated PowerShell runs only after you review and execute it locally.
Microsoft 365 License & Account Review
Review Microsoft 365 license capacity and common account-state gaps with a small set of read-only Entra checks.
Use this workflow when the job is clear and bounded.
This guide is designed for a single administrative task rather than a broad tenant-wide assessment. It keeps discovery, preparation, any manual change and final verification separate so you can review each step before moving on.
A focused license and account-state review using existing Free reports
The workflow, in order.
Start with the first step. Open later steps only when you need them; all guidance remains on this page and remains crawlable.
01 · SCRIPTReview tenant license capacityHide step
Export subscribed SKUs and consumed units so capacity pressure is visible before reviewing individual account states.
Open Export tenant license SKUs →02 · SCRIPTExport licensed usersShow step
Capture the current licensed-user population as the baseline for the review.
Open Export licensed Entra users →03 · SCRIPTExport unlicensed usersShow step
Review accounts without assigned licenses and confirm whether each state is expected.
Open Export unlicensed Entra users →04 · SCRIPTReview disabled usersShow step
Separate disabled identities from active licensing questions so lifecycle state is not mistaken for a license issue.
Open Export disabled Entra users →05 · SCRIPTCheck disabled users with recent sign-inShow step
Review recent sign-in signals for disabled accounts as a follow-up check. Treat the output as a review signal, not proof of compromise.
Open Find disabled Entra users with recent sign-in →06 · REVIEWReview exceptions before making changesShow step
Classify unexpected license or account states in your normal change process. This workflow does not assign licenses, enable accounts or revoke access.
PRIVACY & CONTROLYour tenant stays outside Opselith.View details
Local progress only
Completed workflow step IDs can be stored in your browser. Identity values, tickets, usernames, domains and generated output are not part of that progress record.
Manual changes stay manual
Where no suitable reviewed script exists, the guide labels the action as a manual change rather than pretending the website performed it.
TRUST / EVIDENCEValidation and execution boundariesView details
Recorded trust facts, not a certification. Opselith separates metadata review, static QA, analyzer evidence and runtime evidence. A missing runtime result or a Pending analyzer state is shown as-is rather than converted into a pass claim.
Workflow catalog, ordered runbook, local-progress and manual-change boundary QA.
A guided workflow is not itself a PowerShell artifact.
No accepted runtime result is recorded for this workflow yet.
browser-guided-runbook · no website tenant connection · tenant output stays outside Opselith.
Trust metadata reviewed for the current release contract.
5 referenced scripts · 5 analyzer Passed · 0 Pending
Pending and Not yet recorded are evidence states, not failures. Review the generated script or runbook and validate it in your own environment before production use.
RELATED POWERSHELL5 scripts used by this workflowView scripts
Verify in the authoritative admin tools.
Use the final verification step to confirm the resulting account, membership, licensing or service state in the relevant Microsoft administration portal or Active Directory tooling. Opselith is a runbook and script-generation layer, not the system of record.