Support

Configuration guide: License reclamation

The configuration options on this page are only accessible to administrators.

Refer to the Usage guide: License reclamation to use library content as a standard user.

Pre-requisites

This library pack contains content from the following expansion products

Some of these products offer default access to their respective content, and can still be used without the expansion products.

Refer to the Nexthink Infinity thresholds and limits overview documentation for more information about default thresholds for expansion products.

Included content and dependencies

This library pack contains the following content and dependencies:

Content type
Name
Description
Dependencies

Workflows

License reclamation

An API call to Entra ID removes a user (based on their user ID) from an application group, which automatically reclaims the license.

Workflows

License reclamation (on-premises Active Directory)

Triggers a remote action to Active Directory to remove a user (based on their SAM account name) from an application group, which automatically reclaims the license.

Campaigns

License reclamation request - Workflow invoke

Asks users if they are still using an application.

Remote actions

Invoke remove user from AD group

The purpose of the Remote Action is to remove a specified user from an on-premises Active Directory group.

Configuring License reclamation

Adapt these suggested configuration steps to edit and customize content according to your organizational needs.

Follow these steps to install and configure content:

Step 1 – Configure remote actions

From the main menu, go to Remote actions > Manage remote actions.

  1. Locate Invoke remove user from AD group.

  2. Review and edit its input parameters as needed for your AD environment.

  3. Set up a manual or scheduled trigger depending on the license cleanup frequency.

Step 2 – Edit campaigns

From the main menu, navigate to Campaigns > Manage campaigns.

For each installed campaign:

  1. Customize the sender name and image.

  2. Review and adjust campaign questions.

  3. Publish the campaign when ready.

Nexthink recommends these settings for the license campaign:

Name
Trigger
Priority

License Reclamation Request

Manual

Not urgent

Step 3 – Configure Entra ID integration

If Entra ID is not yet configured, ask your Azure administrator for assistance.

Two integration points are required:

  1. Import the UPN into the user table.

  2. Store API credentials in the Entra ID connector.

Refer to Entra ID integration for workflows for full setup instructions.

Check the permissions listed in the Entra ID connector thinklet documentation.

Step 4 – Configure workflow parameters

In the workflow editor, verify these parameters:

  • Ask for permission? – Choose whether to require user consent before revoking access.

  • Authorization group – Name of the AD group tied to license provisioning.

  • Application name – Name of the app being managed.

Example use case:

Use the parameters to target users of "Salesforce Lightning" who:

  • Used the app for < 5 minutes in the past 90 days.

  • Did not confirm they still need access in the campaign.

Example NQL (requires Application Experience + Software Metering):

users during past 30d 
| where ad.email_address != null 
| include software_metering.events during past 90d 
| where application.name == "Salesforce Lightning" 
| compute focus_time = web_focus_time.sum() 
| include campaign.license_reclamation_request.responses during past 90d 
| where parameters.application_name == "Salesforce Lightning" 
| where state == answered 
| where answers.question1.label == "yes" 
| compute user_needs_application = user.count() 
| where focus_time < 5min 
| where user_needs_application == 0

Step 5 – Maintain API thinklet credentials

Each Service/API thinklet needs a credential configuration.

  1. Go to Administration > Connector credentials.

  2. Add the required credentials for:

    • Microsoft Graph API

    • Active Directory integration

  3. In the workflow, fill in the Credentials field of each relevant API thinklet.

When a workflow is imported from the Library, credential fields will be blank and must be set locally.

Step 6 – Maintain workflow trigger

This workflow is designed to run on a scheduled basis.

  1. Open the workflow from Workflows > Manage workflows.

  2. Go to the General tab.

  3. Enable the Schedule checkbox.

  4. Define separate schedules per application or group if needed.

For license efficiency, use a tailored NQL query to exclude users who requested to keep their license.

RELATED TOPICS

Last updated

Was this helpful?