Monitoring Your Tenant

The monitors are the part of this connector you set up once and then mostly forget. Each one checks a specific condition and reports only when there is something to report.

All of them share the same shape, described in Working with the Connector: a findings output that carries a ready-made summary, and an ok output for confirming that the check ran.

What each monitor watches

Monitor	Watches for
Monitor Expiring Secrets	App secrets and certificates approaching expiry, optionally including service principals
Monitor Inactive Users	Members who have not signed in for a given period, including those who never signed in
Monitor Stale Guests	Guests with unredeemed invitations, or inactive for a given period
Monitor Unused Licenses	Disabled accounts that still hold licenses
Monitor License Stock	SKUs below a minimum available count, including overassignment
Monitor Groups Without Owner	Groups with no owner, optionally security groups only
Monitor Expiring Groups	Microsoft 365 groups approaching expiry
Monitor Deleted Items Purge	Recycle bin objects close to permanent deletion
Monitor Admin Roles	Too many global admins, disabled accounts holding admin roles, guests holding admin roles
Monitor MFA Registration	Users without registered MFA, admins listed first
Monitor Sync Health	A stalled directory synchronisation in hybrid environments
Monitor Stale Devices	Devices with no sign-in for a given period
Monitor New Applications	Recently created app registrations

Each monitor has its own thresholds, and the components carry starting values you can work from. Adjust them to your organisation rather than treating them as fixed — 90 days of inactivity means something different in a company of 50 than in one of 5,000.

Three that usually earn their keep first

Monitor Unused Licenses finds spend that continues after people leave. It is the one that most often pays for the time spent setting all of this up.

Monitor Expiring Groups covers Microsoft 365 groups, and therefore Teams. A group reaching its expiry date takes the team with it, which tends to be discovered at an inconvenient moment.

Monitor Sync Health matters only in hybrid environments, but there it catches a failure mode that is otherwise invisible: the directory keeps serving data, just increasingly stale data. Cloud-only tenants are recognised as such.

Running them

The usual pattern is a scheduler trigger, the monitor, and the findings output going to email, a ticket or a chat message. For a weekly overview, several monitors can share one schedule and write their results into files or a single mail.

A monitor that never fires its findings output is not broken. It means there is nothing to report.