The Microsoft 365 module shows each client's users from their Microsoft 365 tenant: who has which license, who has MFA, and who's actually signing in. Your admin connects each client's tenant once (see Connect Your Integrations).
What you see
Each row is one user, with their license, MFA, sign-in and admin details. Use Group by License to see who holds each license, Filters to narrow the list, and Columns to choose what shows.
What Last Signed In means
Last Signed In is the last time the user signed in successfully. It's empty when:
the client's tenant doesn't have Entra ID P1 or P2 (Microsoft 365 Business Premium includes P1), since Microsoft only shares sign-in data with those licenses
the consent for sign-in data wasn't granted when the tenant was connected
the user has never signed in
Note: If the tenant has Entra ID P1 or P2 and Last Signed In is still empty, check the consent. Your admin can follow the M365 Integration steps again.
Matching users to your PSA contacts
The Microsoft 365 Part on a Report can show each user next to the matching contact from your PSA, with the contact's name, title and status. That's the Merge with Contacts from PSA setting on the Part, which is on by default. It's set on the Part in your Report template, so an Administrator, Manager or Builder changes it there. The contact details only appear if your PSA integration syncs Contacts.
With Merge with Contacts from PSA on, you can spot people who have a license but are no longer a contact. Matched users show the PSA icon, and the contact's status shows as Contact Status. To filter on whether a user is allowed or blocked from signing in to Microsoft 365, use Sign-In Status.
Choosing columns for each mode
Administrators, Managers and Builders can click Columns on the Microsoft 365 Part to choose which columns show in Build Mode, Presentation Mode and Display Mode. The change saves to the Report template, so it applies to every Open Report that uses that template. By default, the contact's title shows in Build only.
Raising Microsoft 365 findings with clients
A few things worth raising with clients:
Users without MFA, especially admins.
Licenses on people who've left, or haven't signed in for months.
More admins than the client needs.
Common questions
Why does a user's MFA show as Disabled when Microsoft 365 says MFA is on?
A user's MFA Status shows Enabled only once the user has registered a method that can do MFA, such as the Authenticator app, a phone or a security key. MFA that's turned on or enforced in Microsoft 365 but not yet set up by the user shows as Disabled. On tenants without Entra ID P1 or P2, Strategy Overview works the status out from the authentication methods each user has registered.
Why do some users disappear when I filter Contact Status to Active?
Users disappear from an Active Contact Status filter when no PSA contact matches their email address, because their Contact Status is blank. Clear that filter, or filter on Sign-In Status, which comes from Microsoft 365.
Next: From Findings to Initiatives