Link: the Asset Knowledge Graph and the systems it reads
Asato reads your systems, and shows what goes unused. Link is the first of the platform's three moves. It connects to more than 100 tools, read-only by default, and matches what they hold into one record, the Asset Knowledge Graph, so each license and device is counted once and tied to the team that owns it. A customer keeps every system it runs today, and issues, scopes and revokes the access itself.
Where this sits
The platform works in three moves, and each move runs on one part of the platform.
| Move | Part of the platform | Layers | What it holds | Page |
|---|---|---|---|---|
| Link | Asset Knowledge Graph | L1 Ingestion, L2 Transformation, L3 Asset Knowledge Graph | Sources | Link: Asset Knowledge Graph |
| Think | Data Intelligence Engine | L4 Intelligence | Data products | Think: Data Intelligence Engine |
| Execute | Agentic AI | L5 Action, L6 Interfaces | Agentic solutions | Execute: Agentic AI Solutions |
This page covers Link.
What Link produces
Example, with example data: one employee's license as four systems record it, and as Link records it.
| Source | What it holds |
|---|---|
| Entra ID: Users | Last sign-in 131 days ago |
| Microsoft Graph: License assignments | Microsoft 365 E3, assigned |
| NetSuite: Invoices | Billed to cost center 4410 |
| Zip: Contracts | Renews September 30 |
The one linked record: employee 20418, cost center 4410, Microsoft 365 E3, renews September 30. Found: paid for, with no sign-in for 131 days.
Caption on the page: Example data. One employee's license as four systems record it, and as Link records it. The finding appears only once the records are joined.
Measured results
CDW saw its whole SaaS estate in four weeks.
- Measured: 5 systems connected read-only: identity, ITSM, endpoint analytics, security and contracts.
- Measured: 50,000+ records normalized in the first week.
- Found: about 1,200 unapproved applications, beside 600+ paid applications.
Sanjay Sood, SVP and Chief Technology Officer, CDW, on what came back: "A complete, unified view of our tech estate in just weeks."
Caption on the page: CDW. The figures are from Asato's analysis in the four-week engagement. No Approved or Saved figure is published for it.
How Link works
Link matches a customer's records, so each item is counted once. One record moves through three layers. It enters by API, as a spreadsheet or PDF, or as user input. The last column follows the example license above.
| Layer | What happens | The record is now |
|---|---|---|
| L1 Ingestion: read the source | The source is read, as a one-time load or a regular refresh. Asato reads records about technology: licenses, devices, usage, sign-in activity and costs, plus contracts and invoices if the customer connects them. | Four raw rows, as each system wrote them |
| L2 Transformation: clean and match | Duplicates are removed, identities are matched, and raw data is mapped to one schema. | One matched row: one employee, one license, matched across four systems |
| L3 Asset Knowledge Graph: link | Assets, people, contracts and costs are linked in one graph. The customer can correct it. | One linked record: person, license, contract and cost |
Caption on the page: Example data. The same license on its way through Link: read, matched to one employee, then linked to a contract and a cost.
Trust and governance
Read-only by default. The customer holds the keys: it issues, scopes and revokes every credential. Nothing is installed on an endpoint. Asato reads records about technology and never reads employees' documents, email or messages. Write access is added one system at a time, where the customer grants it. A person the customer names approves each fix, or sets a policy that governs fixes of that kind. A source without an API is read the same way, from a spreadsheet, a PDF or a scheduled file drop. Trust and governance for the platform is described on the platform overview, and the Asato Trust Center is at https://trust.asato.ai
Works with
What Asato reads from the systems a customer runs. Asato reads more than 100 tools, read-only by default, across four kinds of record: users, assets, usage and cost. The page shows this as tiles: one tile for each system Asato holds a logo for, with the logo, the name, the kind of system and one line on what Asato reads from it. Above the tiles are a search box and a filter by kind of system (Identity and HR, Productivity and SaaS, AI, Devices and installed software, Service management and CMDB, Finance, procurement and contracts, Security and network, Telephony, Cloud and data platforms). The tiles are not links. A closing tile reads "And many more": New integrations are added regularly. Asato reads more than 100 tools, and takes a file or an upload where a source has no API. The systems shown as tiles are Okta, JumpCloud, Workday, UKG, Microsoft, Adobe, Atlassian, Salesforce, Slack, Zoom, Figma, Google Workspace, Smartsheet, Box, Dropbox, Anthropic, OpenAI, Cursor, GitHub, LiteLLM, Jamf, CrowdStrike, ControlUp, NinjaOne, Lansweeper, Freshservice, ServiceNow, NetSuite, QuickBooks Online, Coupa, Brex, Zip, Agiloft, DocuSign CLM, Ironclad, Palo Alto Networks, Netskope, Zscaler, RingCentral, Avaya, Azure, AWS, Google Cloud.
The full list is given here, in the agent version. Each row below lists what Asato reads from one source. The list is not complete: new integrations are added regularly.
Identity and HR
| Source | Vendor | Type | What Asato reads |
|---|---|---|---|
| Entra ID: Users | Microsoft | Identity provider | User directory and status; Guest and member identities; Last sign-in and account state |
| Entra ID: Group membership | Microsoft | Identity provider | Group and nested-group membership; License-assignment groups; Role assignment scope |
| Entra ID: App assignments | Microsoft | Identity provider | Enterprise app inventory; Per-user app assignment; Consent and permission grants |
| Entra ID: SSO sign-in logs | Microsoft | Identity provider | Per-app sign-in events; Real application usage evidence; Conditional access outcomes |
| Okta: Users | Okta | Identity provider | User directory and lifecycle state; Deactivation and suspension events; Profile attributes |
| Okta: Applications | Okta | Identity provider | App integration inventory; Per-user app assignment; SSO sign-in events |
| JumpCloud: System users | JumpCloud | Identity provider | Directory users and device binding; Account state; Group membership |
| JumpCloud: Applications | JumpCloud | Identity provider | SSO application inventory; Per-user assignment; Access events |
| HRIS (Workday, UKG) | Workday, UKG | HRIS | Who is employed, in which department and cost center, and who has joined, moved or left |
Productivity and SaaS
| Source | Vendor | Type | What Asato reads |
|---|---|---|---|
| Microsoft Graph | Microsoft | Productivity SaaS | Tenant-wide user and service activity; Workload usage reports; Identifiers shared across workloads |
| Microsoft Graph: License assignments | Microsoft | Productivity SaaS | Per-user SKU assignment (E1/E3/E5); Service-plan level entitlement; Assignment history |
| Microsoft 365 Subscriptions | Microsoft | Productivity SaaS | Purchased subscription quantities; Term and renewal dates; Subscription state |
| Exchange Online | Microsoft | Productivity SaaS | Mailbox activity and size; Send/receive volumes; Shared and resource mailboxes |
| SharePoint Online | Microsoft | Productivity SaaS | Site and library inventory; Storage consumption; Sharing and access posture |
| SharePoint Online: Site footfall | Microsoft | Productivity SaaS | Per-site visit counts; Active and dormant sites; Contributor patterns |
| GitHub: Organization | GitHub | Developer platform | Repository and team inventory; Member and outside-collaborator seats; Org-level settings |
| GitHub: Activity | GitHub | Developer platform | Commit, pull request and review activity; Cycle-time inputs; Contributor patterns |
| Adobe | Adobe | Design SaaS | Creative Cloud seat and plan inventory; Per-app entitlement; User activity |
| Atlassian | Atlassian | Work management SaaS | Jira and Confluence user inventory; Product access and tier; Activity |
| Salesforce | Salesforce | CRM SaaS | User license type and profile assignment; Login recency and feature usage; Object and API access patterns |
| Slack | Slack | Collaboration SaaS | Workspace and channel inventory; Plan tier; Workspace-level activity |
| Slack: Users | Slack | Collaboration SaaS | Member, guest and bot classification; Per-user activity; Deactivated accounts still billed |
| Zoom | Zoom | Collaboration SaaS | Host license inventory; Meeting and webinar activity; Add-on entitlement |
| Figma | Figma | Design SaaS | Editor, viewer and dev-mode seat inventory; File and project activity; Plan tier |
| Google Workspace | Productivity SaaS | Per-user SKU assignment; Workload activity; Storage consumption | |
| Smartsheet | Smartsheet | Work management SaaS | Licensed users and collaborators, classified; Sheet and workspace activity; Plan tier |
| Box / Dropbox | Box, Dropbox | File storage SaaS | Seat and storage-tier inventory; Per-user activity; External sharing posture |
AI
| Source | Vendor | Type | What Asato reads |
|---|---|---|---|
| Microsoft 365 Copilot: Usage | Microsoft | AI platform | Per-user Copilot activity; Workload-level adoption; Assigned and active seats |
| Anthropic | Anthropic | AI platform | Org-level API consumption; Per-workspace usage and limits; Model and token spend |
| OpenAI: ChatGPT | OpenAI | AI platform | Workspace seat inventory; Per-user activity; Plan tier |
| OpenAI: API usage | OpenAI | AI platform | Org-level API consumption; Per-key and per-user usage; Model and token spend |
| Cursor | Anysphere | AI coding tool | Per-user seat and activity; Plan tier; Org-level usage events |
| GitHub Copilot: Seats | GitHub | AI coding tool | Seat assignment and state; Pending and active invitations; Org and team scope |
| GitHub Copilot: Usage | GitHub | AI coding tool | Suggestion and acceptance metrics; Per-language activity; Active and dormant seats |
| Anthropic: API keys and workspaces | Anthropic | AI platform | API key and workspace inventory; Key creator and last use; Workspace spend limits (alert only) |
| Claude Enterprise: Seats and spend limits | Anthropic | AI platform | Each member's seat and monthly spend limit, and requests for more usage |
| Microsoft 365 Copilot: Credits | Microsoft | AI platform | Copilot credit pool and consumption; Credit caps by group; Alert only: caps are set in the admin center |
| LiteLLM Gateway | LiteLLM | AI gateway | Requests and dollar budgets for each key and each agent |
| Cursor: Spend limits | Anysphere | AI coding tool | Each user's spend limit, and the limit in effect |
| GitHub Copilot: Budgets | GitHub | AI coding tool | Budgets and their state; User budgets with end dates |
| OpenAI: Projects and API keys | OpenAI | AI platform | Project and API key inventory; Key owner and last use; Project limits (alert only) |
| AWS: Bedrock usage and budgets | AWS | Cloud AI platform | Bedrock usage and cost by role; AI lines in the billing export; AWS Budgets and the actions attached to them |
| Azure OpenAI: Usage and cost | Microsoft | Cloud AI platform | Usage and cost by resource; AI lines in the billing export; Cloud budget alerts (alert only) |
| Google Cloud: Vertex AI usage and cost | Cloud AI platform | Usage and cost by project; AI lines in the billing export; Cloud budget alerts (alert only) | |
| Azure API Management: AI gateway | Microsoft | AI gateway | Requests and tokens for each caller, with each caller's token limit; Limits here are counted in tokens |
Devices and installed software
| Source | Vendor | Type | What Asato reads |
|---|---|---|---|
| Intune: Hardware | Microsoft | Endpoint management | Device inventory and model; Enrollment and compliance state; Primary user assignment |
| Intune: Desktop apps | Microsoft | Endpoint management | Installed application inventory per device; Version spread; Install and detection dates |
| Jamf: Hardware | Jamf | Endpoint management | Mac device inventory; macOS version and profile state; User-to-device mapping |
| CrowdStrike: Hardware | CrowdStrike | Endpoint security | Agent-reported device inventory; OS and platform detail; Last-seen and coverage gaps |
| CrowdStrike: Installed software | CrowdStrike | Endpoint security | Installed application inventory; Version and publisher detail; Per-device software footprint |
| ControlUp: Machines | ControlUp | Experience monitoring | Endpoint and VDI machine inventory; Session and logon telemetry; Resource pressure |
| ControlUp: Hardware | ControlUp | Experience monitoring | Hardware specification per endpoint; Age and capacity; Performance headroom |
| ControlUp: Applications | ControlUp | Experience monitoring | Application launch and foreground time; Real desktop-app usage; Per-user application mix |
| NinjaOne | NinjaOne | Remote monitoring and management | Managed device inventory; Installed software and patch state; Warranty and asset attributes |
| Installed software: Inventory | Any | Installed software inventory | Perpetual and installed license footprint; Publisher and edition detail; Per-device install evidence |
| Installed software: Endpoint records | Any | Installed software inventory | Endpoint-managed install records; Cross-check against entitlement; Version spread |
| Lansweeper | Lansweeper | IT asset management | Network-discovered devices; Hardware and OS inventory; Installed software scans |
Service management and CMDB
| Source | Vendor | Type | What Asato reads |
|---|---|---|---|
| Freshservice: Hardware | Freshworks | ITSM and CMDB | Asset records and ownership; Lifecycle state; Assignment history |
| Freshservice: Hardware export | Freshworks | ITSM and CMDB | Bulk asset export; Custom asset attributes; Historical snapshots |
| ServiceNow: Installed software | ServiceNow | ITSM and CMDB | Software install records from the CMDB; Publisher and version detail; Links between configuration items |
| ServiceNow: CMDB | ServiceNow | ITSM and CMDB | Configuration items and relationships; Asset ownership and lifecycle state; Request and change history |
| Service desk tickets | ServiceNow, Freshservice | ITSM and CMDB | Incident and request records; Category and resolution detail; Volume and effort per asset |
Finance, procurement and contracts
| Source | Vendor | Type | What Asato reads |
|---|---|---|---|
| NetSuite: Invoices | Oracle NetSuite | Finance and ERP | Vendor invoice lines; GL and cost-center coding; Actual paid amounts |
| NetSuite: Purchase orders | Oracle NetSuite | Finance and ERP | PO lines and quantities; Committed against invoiced amounts; Requisition trail |
| QuickBooks Online | Intuit | Finance and ERP | Vendor bills and payments; Chart-of-accounts coding; Spend by category |
| Coupa | Coupa | Procurement | Requisition and PO workflow; Approved supplier records; Contract-linked spend |
| Brex: Transactions | Brex | Expense | Card transaction lines; Merchant-level SaaS purchases; Department-coded spend |
| P-card transactions | Any | Expense | Purchasing-card line items; Off-contract SaaS purchases; Cardholder attribution |
| Zip: Contracts | Zip | Contract lifecycle management | Contract repository; Renewal dates and auto-renew flags; Negotiated terms |
| Zip: Invoices | Zip | Contract lifecycle management | Invoice records tied to contracts; Billed against contracted quantities; Payment status |
| Zip: Purchase orders | Zip | Procurement | Intake-to-procure requests; Approval trail; Policy compliance |
| Agiloft: Contracts | Agiloft | Contract lifecycle management | Contract repository and clauses; Renewal and termination windows; Obligation tracking |
| Labor cost feed | Any | Finance and ERP | Labor cost by role and team; Internal rate cards; Effort-to-cost inputs |
| DocuSign CLM | DocuSign | Contract lifecycle management | Contract repository; Renewal dates and auto-renew flags; Negotiated terms and SKUs |
| Ironclad | Ironclad | Contract lifecycle management | Contract repository; Renewal dates and auto-renew flags; Negotiated terms and SKUs |
Security and network
| Source | Vendor | Type | What Asato reads |
|---|---|---|---|
| Microsoft 365 Posture | Microsoft | Security posture | Tenant configuration baseline; Policy and sharing posture; Drift against secure defaults |
| Defender for Cloud Apps: Usage | Microsoft | CASB | Discovered cloud apps from network logs; Data volume per app; Risk scoring and sanctioning state |
| Defender for Cloud Apps: Users | Microsoft | CASB | Per-app user population; Shadow IT user attribution; First-seen and last-seen |
| Syslog | Any | Network logs | Device and appliance event streams; Network-observed activity; Infrastructure inventory |
| Syslog: Palo Alto | Palo Alto Networks | Network logs | Firewall traffic logs; Cloud app reach per user; Shadow IT discovery |
| Vendor compliance registries | Public registries | Compliance registry | Third-party attestations; Sub-processor lists; Risk classification |
| Netskope | Netskope | CASB and SWG | Cloud app traffic logs; Shadow IT discovery; Data loss prevention events |
| Zscaler | Zscaler | CASB and SWG | Cloud app traffic logs; Shadow IT discovery; User to app reach mapping |
Telephony
| Source | Vendor | Type | What Asato reads |
|---|---|---|---|
| Teams Phone / PSTN | Microsoft | Telephony | Call detail records; Minutes and call volume per user; Calling plan assignment |
| RingCentral | RingCentral | Telephony | Extension and DID inventory; License type per extension; Account structure |
| RingCentral: Detailed usage | RingCentral | Telephony | Per-extension call detail; Minutes and direction; Idle extension evidence |
| Avaya On-Prem | Avaya | Telephony | On-premise PBX station inventory; Extension assignment; Deployment topology |
Cloud and data platforms
| Source | Vendor | Type | What Asato reads |
|---|---|---|---|
| Azure Synapse | Microsoft | Data platform | Customer-side warehouse tables; Curated enterprise datasets; High-volume historical extracts |
| Cloud billing | Azure, AWS, GCP | Cloud billing | Detailed billing and usage records; Commitment and discount coverage; Account and tag-level attribution |
| Cloud resource inventory | Azure, AWS, GCP | Cloud inventory | Running resource inventory; Utilization and idle state; Environment and owner tags |
Reseller records
| Source | Vendor | Type | What Asato reads |
|---|---|---|---|
| Reseller asset records | The customer's reseller | Reseller portal | Asset records from the customer's reseller; Serial and warranty attributes; Order-to-asset linkage |
| Reseller price comparables | The customer's reseller | Price benchmark | Peer purchase comparators; SKU-level price bands; Market price movement |
| Reseller bid upload | The customer's reseller | Reseller portal | Quoted bid lines; Proposed pricing per SKU; Bid validity windows |
| Reseller order-to-bid upload | The customer's reseller | Reseller portal | Orders reconciled to originating bids; Price paid against the quote; Fulfillment records |
| Reseller renewal report upload | The customer's reseller | Reseller portal | Upcoming renewals and their contract lines, as the customer's reseller holds them |
| Reseller invoice upload | The customer's reseller | Reseller portal | Invoice lines from the customer's reseller; Billed quantities and pricing; Reconciliation against orders |
Files and uploads
| Source | Vendor | Type | What Asato reads |
|---|---|---|---|
| SharePoint Lists | Microsoft | Upload | Customer-maintained reference lists; Ownership and cost-center mappings; Other lists the customer keeps |
| AI credit consumption upload | Any | Upload | Credit and token consumption records; Per-team attribution; Consumption-metered AI spend |
| Atlassian: Entitlement export | Atlassian | Upload | Purchased entitlement per product; Tier and term detail; Billing quantities |
| Financial data upload | Any | Upload | Budget and actuals extracts; Cost-center hierarchies; Other finance exports |
| SFTP drop | Any | File transport | Scheduled file drops; Vendor-generated extracts; Sources that have no API |
| SFTP server / client | Any | File transport | Push or pull file exchange; Customer-hosted transfer endpoints; Batch delivery |
| Generic spreadsheet upload | Any | Upload | Any spreadsheet export; Asato works out the columns and records where each upload came from |
| Application tier upload | Any | Upload | Customer application tiering; Business criticality classification; Owner assignment |
| Service management user upload | Any | Upload | User records from the service-management estate; Department and manager mapping; A stand-in for employment status |
| Entitlement upload | Any | Upload | Purchased entitlement per publisher; Contract quantities; True-up baselines |
| AI contract rates and budget owners upload | Any | Upload | Contract rates per AI vendor; Budget owner per team; Cost-center mapping |
Next step
The page's heading for this section: No savings, no fee. The line under it: Your Asset Clarity Report: a priced list of savings, in one week. The one action: "Get your Asset Clarity Report", at https://www.asato.ai/talk-to-sales
The customer connects the systems for one area, read-only, and in one week holds its Asset Clarity Report.
The Asset Clarity Report is a priced list of what to stop paying for in one area, with the owner of each item. It takes one week, and access for that week is read-only. If it finds no savings, the customer pays nothing.
Related pages
- Platform overview
- Link: Asset Knowledge Graph
- Think: Data Intelligence Engine
- Execute: Agentic AI Solutions
- Site index for agents
Last updated: 2026-10-06
