This report crosses Microsoft 365 license utilization data (3.25 million licenses across 137 unique SKUs) with Datto RMM alert volumes (135,387 alerts) to identify companies where licensed devices sit unused while still generating excessive monitoring alerts. Two data sources, one question: where are you paying three times for assets nobody touches?
This report crosses Microsoft 365 license utilization data (3.25 million licenses across 137 unique SKUs) with Datto RMM alert volumes (135,387 alerts) to identify companies where licensed devices sit unused while still generating excessive monitoring alerts. Two data sources, one question: where are you paying three times for assets nobody touches?
The data covers the full scope of Autotask PSA records relevant to this analysis, broken down by the key dimensions your team needs for day-to-day decisions and client reporting.
Who should use this: NOC teams, asset managers, and service delivery leads
How often: Weekly for fleet reviews, monthly for lifecycle planning, quarterly for budgeting
This report crosses Microsoft 365 license utilization data (3.25 million licenses across 137 unique SKUs) with Datto RMM alert volumes (135,387 alerts) to identify companies where licensed devices sit unused while still generating excessive monitoring alerts. Two data sources, one question: where are you paying three times for assets nobody touches?
EVALUATE ROW("TotalLicenses", SUM('BI_MicrosoftPartnerCenter_Subscribed_Skus'[total_units]), "ConsumedLicenses", SUM('BI_MicrosoftPartnerCenter_Subscribed_Skus'[consumed_units]), "AvailableLicenses", SUM('BI_MicrosoftPartnerCenter_Subscribed_Skus'[available_units]))The portfolio-wide utilization of 0.13% is extremely low. This means that out of 3.26 million provisioned license seats, only a fraction are actively consumed. This pattern is common in MSP environments where trial SKUs, legacy subscriptions, and bulk provisioning inflate the denominator. But even accounting for that, the gap between purchased and consumed seats represents a significant cost exposure that most CFOs never see in their monthly reports.
| Company | RMM Alerts | M365 Licenses | Utilization | Risk |
|---|---|---|---|---|
| Client A | 26,873 | n/a | No data | High |
| Client B | 27,225 | 3,234,204 | 0.12% | Critical |
| Client C | 9,307 | n/a | No data | High |
| Client D | 7,430 | n/a | No data | Medium |
| Client E | 5,032 | n/a | No data | Medium |
| Client F | 4,086 | 1,513 | 0.86% | Critical |
| Client G | 3,838 | 20,403 | 1.73% | Critical |
| Client H | 3,437 | n/a | No data | Medium |
| Client I | 2,920 | n/a | No data | Medium |
| Client J | 2,646 | n/a | No data | Medium |
Client B stands out as the worst case: 27,225 RMM alerts combined with 3.2 million provisioned licenses at 0.12% utilization. That is the textbook definition of a ghost fleet. Client F and Client G show the same pattern at a smaller scale: low utilization paired with thousands of alerts. These three companies should be the first targets for a license and alert cleanup.
The top two companies alone account for 54,098 alerts, which is almost 40% of the entire portfolio's alert volume. This kind of concentration means that cleaning up just two accounts would cut alert noise by nearly half. For the service desk, that translates directly into fewer false triage cycles and faster response to the alerts that actually matter.
EVALUATE TOPN(15,
SUMMARIZECOLUMNS(
BI_Autotask_Companies[company_name],
"LicenseUtil", [License Utilization %],
"ActiveUsers", [Active Users],
"TotalLicenses", [Total Licenses],
"Alerts", COUNTROWS(BI_Datto_Rmm_Alerts)
),
COUNTROWS(BI_Datto_Rmm_Alerts), DESC
)| Status | Devices | % of Fleet |
|---|---|---|
| Online | 3,395 | 48.8% |
| Offline | 3,556 | 51.1% |
| Unknown | 2 | 0.0% |
These three companies are the confirmed "triple waste" cases. They burn license costs on seats nobody uses, generate thousands of RMM alerts from those idle devices, and consume technician hours triaging noise. Client F has the worst alerts-per-license ratio at 2.70, meaning their small license footprint generates disproportionate noise. Client B has the highest absolute alert count but a low ratio because of their massive license pool.
For CFO-level reporting, the math is straightforward: multiply unused seats by the per-seat license cost, add the estimated technician time per alert (typically 5-10 minutes for initial triage), and you get the monthly burn rate for devices that deliver zero value.
EVALUATE ROW("TotalDevices", COUNTROWS('BI_Datto_Rmm_Devices'), "OnlineDevices", COUNTAX(FILTER('BI_Datto_Rmm_Devices', 'BI_Datto_Rmm_Devices'[Online] = TRUE()), 1), "OfflineDevices", COUNTAX(FILTER('BI_Datto_Rmm_Devices', 'BI_Datto_Rmm_Devices'[Online] = FALSE()), 1))The estimated $146,000 per month in wasted technician time is based on a conservative 5-minute triage per alert at a $50/hour blended rate. This does not include the license costs themselves, which vary by SKU but can easily add another $30,000-50,000 per month in unused E3/E5 seats alone. The total cost of ghost devices in these three accounts could exceed $2 million annually when you combine license waste, alert triage, and the opportunity cost of technicians who could be working on billable projects instead.
The data paints a clear picture. The managed portfolio has a ghost device problem that runs deep. With 99.87% of license seats sitting unused and 135,387 RMM alerts spread across the environment, the overlap between unused licenses and noisy devices creates a compounding waste loop.
Three companies drive the bulk of this waste. Client B holds over 3.2 million license seats at near-zero utilization while generating 27,225 alerts. This is likely a provisioning artifact where bulk license purchases or trial SKUs were never cleaned up after deployment. Client F and Client G show a more typical pattern: moderate license pools with sub-2% utilization paired with thousands of alerts from devices that should have been decommissioned.
The companies without license data (Client A, C, D, E, H, I, J) still generate significant alert volumes. These could be environments where RMM agents run on devices that were never linked to M365 tenants, or where the Bridge_All_Companies mapping is incomplete. Either way, they represent cleanup opportunities.
For the CFO, the takeaway is simple: ghost devices are not just an IT operations problem. They are a financial leak that shows up in three line items at once. License costs, support hours, and reduced service quality all trace back to the same root cause. Fix the ghost device inventory and you fix all three.
This single account holds the vast majority of unused licenses. Run a per-SKU breakdown, identify trial and legacy subscriptions, and decommission anything that has seen zero activity in the past 90 days. The license savings alone could be substantial, and reducing the device footprint will cut alert volume proportionally.
Create a Datto RMM policy that automatically suppresses non-critical alerts on devices where the linked M365 account shows no sign-in activity. This removes the noise without decommissioning the device, giving the client time to confirm whether the device should be retired or reactivated.
Seven of the top ten alert generators have no M365 license data. That means the Bridge_All_Companies table is incomplete or those environments lack M365 integration. Complete the mapping to get a full picture of which alerts come from licensed vs. unlicensed devices.
Configure a Power BI alert that fires when any company's license utilization drops below 5%. Catch the problem early instead of discovering a 0.12% utilization rate months later. This gives the account manager a trigger to start a conversation with the client about right-sizing their license pool.
Package the combined cost of unused licenses + alert triage hours + opportunity cost into a single dollar figure. Track it quarterly. When the CFO sees a $2M annual line item for devices nobody uses, the cleanup project gets funded. Numbers drive decisions, and this number is hard to ignore.
A ghost device is a machine that holds an active M365 license and has an RMM agent installed, but shows little to no actual user activity. It continues to generate monitoring alerts and consume license costs without delivering any value to the end user or the business.
The triple waste combines three cost components: (1) the license fee for unused M365 seats, (2) the technician time spent triaging RMM alerts from those devices, and (3) the opportunity cost of that technician time not being applied to billable or value-generating work. The report estimates triage time at 5 minutes per alert and uses a $50/hour blended rate.
The 0.13% utilization rate reflects the entire portfolio including trial SKUs, legacy subscriptions, and bulk-provisioned licenses that were never activated. In MSP environments, it is common for Partner Center to report large license pools that include free or trial tiers. The absolute number matters less than the trend and the per-company breakdown.
Microsoft 365 license data from Partner Center (purchased, consumed, and available seats per SKU per tenant) and Datto RMM alert data (all monitoring alerts across managed devices). Proxuma Power BI connects the two through Bridge_All_Companies using proxuma_company_id.
Yes. Connect Proxuma Power BI to your Microsoft 365 Partner Center and Datto RMM instance, add an AI tool (Claude, ChatGPT, or Copilot) via MCP, and ask the same question. The AI writes the DAX queries, runs them against your data, and builds a report like this in under fifteen minutes.
Connect Proxuma Power BI to your PSA, RMM, and M365 environment, use an MCP-compatible AI to ask questions, and generate custom reports - in minutes, not days.
See more reports Get started