> For the complete documentation index, see [llms.txt](https://hub.equipme.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hub.equipme.io/documentation/automation/connectors/microsoft-entra-id-connector/monitoring-your-tenant.md).

# Monitoring Your Tenant

The monitors are the part of this connector you set up once and then mostly forget. Each one checks a specific condition and reports only when there is something to report.

All of them share the same shape, described in [Working with the Connector](/documentation/automation/connectors/microsoft-entra-id-connector/working-with-the-connector.md): a **findings** output that carries a ready-made summary, and an **ok** output for confirming that the check ran.

#### What each monitor watches

| Monitor                      | Watches for                                                                               |
| ---------------------------- | ----------------------------------------------------------------------------------------- |
| Monitor Expiring Secrets     | App secrets and certificates approaching expiry, optionally including service principals  |
| Monitor Inactive Users       | Members who have not signed in for a given period, including those who never signed in    |
| Monitor Stale Guests         | Guests with unredeemed invitations, or inactive for a given period                        |
| Monitor Unused Licenses      | Disabled accounts that still hold licenses                                                |
| Monitor License Stock        | SKUs below a minimum available count, including overassignment                            |
| Monitor Groups Without Owner | Groups with no owner, optionally security groups only                                     |
| Monitor Expiring Groups      | Microsoft 365 groups approaching expiry                                                   |
| Monitor Deleted Items Purge  | Recycle bin objects close to permanent deletion                                           |
| Monitor Admin Roles          | Too many global admins, disabled accounts holding admin roles, guests holding admin roles |
| Monitor MFA Registration     | Users without registered MFA, admins listed first                                         |
| Monitor Sync Health          | A stalled directory synchronisation in hybrid environments                                |
| Monitor Stale Devices        | Devices with no sign-in for a given period                                                |
| Monitor New Applications     | Recently created app registrations                                                        |

Each monitor has its own thresholds, and the components carry starting values you can work from. Adjust them to your organisation rather than treating them as fixed — 90 days of inactivity means something different in a company of 50 than in one of 5,000.

#### Three that usually earn their keep first

**Monitor Unused Licenses** finds spend that continues after people leave. It is the one that most often pays for the time spent setting all of this up.

**Monitor Expiring Groups** covers Microsoft 365 groups, and therefore Teams. A group reaching its expiry date takes the team with it, which tends to be discovered at an inconvenient moment.

**Monitor Sync Health** matters only in hybrid environments, but there it catches a failure mode that is otherwise invisible: the directory keeps serving data, just increasingly stale data. Cloud-only tenants are recognised as such.

#### Running them

The usual pattern is a scheduler trigger, the monitor, and the findings output going to email, a ticket or a chat message. For a weekly overview, several monitors can share one schedule and write their results into files or a single mail.

A monitor that never fires its findings output is not broken. It means there is nothing to report.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hub.equipme.io/documentation/automation/connectors/microsoft-entra-id-connector/monitoring-your-tenant.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.