Read-only Microsoft access
SeatSaver requests LicenseAssignment.Read.All and Reports.Read.All. It does not request write permissions.
Opening SeatSaver 365…
Security and data handling
Designed around narrow access and human approval.
SeatSaver 365 is intentionally limited to license inventory and usage-report analysis. It does not inspect Microsoft 365 content or modify tenant resources.
Limited persistence
Tenant settings, billing state, and aggregate scan totals are stored. Account-level candidates are not stored in scan history.
Protected sessions
Customer and private-preview sessions use signed, HTTP-only, secure cookies with same-site restrictions.
Server-only credentials
Microsoft, Stripe, Neon, and Resend credentials remain server-side and are not exposed to browser code.
Verified billing events
Stripe webhook signatures are verified against the unmodified request body before subscription state changes.
Human-controlled action
SeatSaver reports opportunities but cannot remove licenses, change users, or act on Microsoft 365 content.
Microsoft Graph permissions
Explicit product boundaries
- No permission to assign or remove Microsoft 365 licenses.
- No access to mailbox messages, Teams chats, OneDrive files, or SharePoint content.
- No automatic changes based on an inactivity recommendation.
- No storage of account-level review candidates in scan history.
- No contracted Microsoft pricing inferred from Graph data.
Security questions?
Use the sales form to request a permissions walkthrough or discuss your organization’s review requirements.
Contact SeatSaver