src/Private/Get-GraphSubscribedSkus.ps1

function Get-GraphSubscribedSkus {
    <#
    .SYNOPSIS
        Retrieves the tenant's subscribed SKUs (license inventory) from Microsoft Graph.
    .DESCRIPTION
        Reads /subscribedSkus via Invoke-MgGraphRequest. Gives prepaid vs consumed counts per SKU,
        which lets the report express reclaimable licenses against what the tenant actually owns. Read-only.
    .OUTPUTS
        PSCustomObject: SkuId, SkuPartNumber, PrepaidEnabled, ConsumedUnits
    #>

    [CmdletBinding()]
    param()

    if (-not (Get-Command Invoke-MgGraphRequest -ErrorAction SilentlyContinue)) {
        throw "Microsoft.Graph.Authentication is required (Invoke-MgGraphRequest not found)."
    }

    $response = Invoke-MgGraphRequest -Method GET -Uri '/v1.0/subscribedSkus' -OutputType PSObject -ErrorAction Stop

    # Set-StrictMode -Version Latest throws on any absent property of a PSObject, so probe with
    # PSObject.Properties before reading - the Graph payload is not guaranteed to carry every field,
    # and a bare `if ($s.prepaidUnits)` would throw instead of treating it as absent.
    $values = if ($response -and ($response.PSObject.Properties.Name -contains 'value')) { $response.value } else { @() }

    foreach ($s in $values) {
        $props = $s.PSObject.Properties.Name
        $prepaid = 0
        if (($props -contains 'prepaidUnits') -and $s.prepaidUnits -and
            ($s.prepaidUnits.PSObject.Properties.Name -contains 'enabled')) {
            $prepaid = [int]$s.prepaidUnits.enabled
        }
        [pscustomobject]@{
            SkuId          = if ($props -contains 'skuId')         { [string]$s.skuId }         else { '' }
            SkuPartNumber  = if ($props -contains 'skuPartNumber') { [string]$s.skuPartNumber } else { '' }
            PrepaidEnabled = $prepaid
            ConsumedUnits  = if ($props -contains 'consumedUnits') { [int]$s.consumedUnits }    else { 0 }
        }
    }
}