How a Wisconsin MSP Automates Firewall Renewals and Microsoft 365 License Reviews

Every MSP manages two things that take steady attention as the client list grows: firewall coverage that has to be renewed on time, and Microsoft 365 licenses that should match the people actually using them. Done well, both are routine. Done by hand, both take real hours every month.

An established Wisconsin MSP with decades in the business has always stayed on top of both. Their team tracked renewals and reviewed licensing carefully, the way good MSPs do. As they grew, they asked a different question: why should careful people spend hours assembling information a system could keep current on its own? So they built an internal command center called Spartan. Two of its screens took over that legwork entirely: one keeps every firewall renewal in front of the team well before it’s due, and one keeps every client’s Microsoft 365 licensing matched to the people who use it. Here’s how it works and the details that make it reliable.

What is Spartan?

Spartan is the MSP’s own operations dashboard. It sits on top of the tools they already run: their PSA, their RMM, their documentation and inspection platform, Microsoft 365, and vendor portals like FortiCloud. Scheduled syncs pull data from each one into a small data warehouse every few hours, and dashboards turn that data into work queues. The same data is connected to AI, so a tech or account manager can simply ask, “What should I bring up in Lakeview’s QBR?” and get an answer that spans all of it.

The license audit page is just one part of it. But it’s the part clients notice most.

Firewall renewals: one list, always current

Tracking renewals by hand works, but it takes time: logging into the vendor portal, matching each device to a client, checking dates, and keeping a list current. Spartan does that legwork automatically, straight from the source, with no retyping.

How Spartan handles it

Once a week, Spartan pulls every Fortinet device registered under the MSP’s FortiCloud partner account, along with its coverage and hardware dates, straight from the FortiCloud API. The renewals card then does a few simple things well:

• Shows only what needs attention. By default, it lists devices with coverage ending in the next 90 days, soonest first. Everything else stays out of the way.
• Colors the urgency. Under 30 days in red, 31 to 90 days in amber, covered in green.
• Flags aging hardware. Devices approaching or past end of support are marked for a planned replacement conversation instead of another renewal.
• Keeps the list honest. A one-click status marks a device as declined (still in service, client chose not to renew) or replaced (swapped for a different firewall). Devices retired in FortiCloud drop off automatically.

The detail that matters

A device can carry several entitlements that expire on different days. The obvious choice is to show the earliest expiration date. But if one entitlement has already ended and another is still active, that date is misleading. Spartan anchors each renewal on the next active expiration, the soonest date among entitlements that are still current. It’s a small choice that keeps the list accurate.

How the team uses it

The account managers review the 90-day window every week. Renewal quotes go out well ahead of the date, so clients have time to approve them without a scramble. Hardware nearing end of support comes up at the client’s next QBR, months before it becomes urgent, so replacement is a planned budget item instead of a surprise.

Microsoft 365: paying only for what’s used

License waste comes in two flavors, and Spartan watches for both:

1. Seats bought but not assigned to anyone. Usually what’s left after someone leaves and the subscription hasn’t been trimmed yet.
2. Seats assigned to people who aren’t really there. Former employees, or accounts nobody has touched in months.

The data comes from the MSP’s inspection platform, Liongard, which already collects Microsoft 365 details from each managed tenant. Spartan expands that into one row per user and one row per license type, across more than 40 client tenants and over 4,000 accounts, refreshed every four hours.

Unused paid licenses

For each license type in each tenant, Spartan compares the seats the client is billed for against the seats actually assigned. Any gap shows up with a dollar figure at Microsoft’s list price, so the team can see what it’s worth to trim. Changes are made at the right point in the subscription term, and the savings show up in the client’s next QBR.

Getting the numbers exactly right takes three details:

• Count billed seats, not “purchased” seats. Under NCE, seats reduced or cancelled mid-term can sit in a suspended state until the renewal date, and the total-purchased figure keeps counting them. Counting only enabled, billed seats means a seat disappears from the report the moment it’s cancelled, instead of looking like waste for months.
• Ignore the free placeholders. Microsoft provisions some free products at huge counts, like 10,000 or even a million “seats.” Those are filtered out entirely so they never distort the totals.
• Handle nonprofit grants one license at a time. Qualifying 501(c)(3) charities get free Business Basic and some free Business Premium, so those unused seats aren’t waste. But the same charity’s paid Visio or Exchange seats still are. And 501(c)(6) organizations, like chambers and tourism bureaus, don’t get the grant at all. A blanket “nonprofit” flag would get both cases wrong.

Dormant accounts

The second card looks for licensed, enabled accounts with no activity in 60 days or more. The key decision was how to define “activity.”

Email alone isn’t enough. Some employees barely touch email but live in Teams all day. An email-only rule would flag working people for license removal. So Spartan checks the most recent activity across Exchange, Teams, OneDrive, and SharePoint together.

The team also tested whether simply receiving email resets the Exchange activity date. They sent a message to an account with no email client set up anywhere, waited for the reports to refresh, and checked. The date didn’t move. Exchange activity reflects real reading and sending, so a stale date there means something.

A recent sign-in is not an all-clear. An account can show no real activity for months but still show a recent sign-in, for example a former employee’s phone quietly refreshing its connection. Spartan never treats that as “active.” It flags it as its own case, dormant with recent sign-in, to investigate first. The safe order is to revoke sessions, then convert or disable the account.

Watch for hidden names. Many tenants have a Microsoft 365 privacy setting turned on that hides user names in usage reports. With it on, activity dates can’t be matched to people. Spartan treats those accounts as “can’t evaluate,” never as “dormant,” falls back on sign-in data where it exists, and shows each client’s data quality so a gap never looks like a clean bill of health. The real fix is turning that setting off in each tenant.

From finding to action

Each dormant account has an Offboard button. It doesn’t change anything in Microsoft 365 by itself. It files an employee offboarding ticket in the MSP’s PSA with every required field already filled in. A tech reviews it and runs the offboarding. A person approves every change, which is the right design for anything that touches a client’s tenant.

Why stale data is treated as a bug

A scheduled sync can finish “successfully” and still not save anything, and a dashboard built on old data looks just as confident as one built on fresh data. So Spartan doesn’t take a green checkmark at its word. It records the health of every sync, including how many records were actually written, and the license cards ignore any tenant that hasn’t been inspected in 14 days. Old data can never turn into a billing decision.

What it means day to day

• Renewals stay weeks ahead, effortlessly. Sales and account managers work a short, sorted list that builds itself.
• License reviews are part of every QBR. Clients see exactly what they’re paying for, and that they’re only paying for what they use.
• Security checks run on their own. Dormant accounts that are still signing in get investigated as a matter of routine.
• The hours go back to the team. The data refreshes itself, and anyone can ask the AI about it.

Can your MSP build this?

Yes, though probably not by buying it. Spartan fits one MSP’s stack like a glove, which is exactly why it wouldn’t fit yours off the shelf. But the pieces are the same for most shops: a vendor portal for coverage dates, an inspection platform or direct Microsoft 365 access for licensing, your PSA for tickets, scheduled syncs, and a small warehouse to hold it all.

If you build it, keep the principles that make this one work: start with one card, check every number against reality, treat stale data as a bug, and keep a person approving anything that changes a client’s environment.

That’s the work we do with MSPs. We bring the patterns and the lessons, and your team builds your version on infrastructure you own. No developers needed. See how we work with MSPs.