Guide · Licensing
Three reports Microsoft already gives you, an afternoon, and the same three findings every time: leavers still licensed, expensive plans doing cheap work, and duplicates nobody remembers buying. How to run it, and how to turn it into money.
By Alex Makey · 6 September 2026 · 7 min read · Verified against Microsoft documentation, September 2026
Every licensing review we run finds the same three things, in the same order: licences assigned to people who have left, expensive SKUs assigned to people who use a fraction of them, and duplicates across tenants or add-ons nobody remembers buying. Here is how to find each one yourself, with the reports Microsoft already gives you, in an afternoon.
Start with sign-in activity. In the Entra admin centre, Users → All users, add the Last sign-in column and sort ascending. Anyone with a licence and no sign-in in ninety days is a question. In Graph PowerShell:
Get-MgUser -All -Property DisplayName,UserPrincipalName,AssignedLicenses,SignInActivity,AccountEnabled |
Where-Object { $_.AssignedLicenses.Count -gt 0 -and $_.SignInActivity.LastSignInDateTime -lt (Get-Date).AddDays(-90) } |
Select DisplayName,UserPrincipalName,AccountEnabled,@{n='LastSignIn';e={$_.SignInActivity.LastSignInDateTime}}Read the list with someone who knows the people. Three groups fall out: leavers whose accounts were never processed (convert or hold, then remove); service accounts and shared mailboxes that were given a full licence when they needed none; and people on long leave, who may be fine.
The Disabled accounts with licences are the easy win: an account that is blocked from signing in does not need a licence to exist, only to keep a mailbox active, and that has a cheaper answer.
Microsoft 365 admin centre → Reports → Usage. Set the period to ninety days. Three reports matter: Microsoft 365 Apps usage (who opened Word, Excel, Outlook, on which platform), Teams user activity, and Exchange activity.
Export each to CSV, join on UPN, and look for two patterns.
Business Premium or E3 with no desktop app activity. Someone reading email on a phone and joining Teams meetings does not need the desktop suite. F3 or Business Basic covers them at a fraction of the price. On a typical estate this is a fifth of the users.
E5 with none of the E5 features switched on. E5 pays for Defender for Endpoint P2, Entra ID P2, Purview, Teams Phone. If none of those are deployed, the E5 premium buys nothing. The fix is either to switch them on — security you have already paid for is the cheapest security there is — or to move to E3 at renewal. Check the Defender portal and Entra’s Identity Protection blade before deciding; often the features are half-configured.
Admin centre → Billing → Your products. Look at every line, not just the big ones.
Overlapping bundles. A user with Business Premium and a separate Intune licence, or E3 and a standalone Exchange Online Plan 2, or Teams Phone on someone with no phone number. Group-based licensing assigns by membership, and people end up in two groups.
Add-ons nobody uses. Visio, Project, Power BI Pro, Audio Conferencing on plans that already include it. Cross-reference with the usage reports.
Across tenants. If you have more than one, the same person may hold a licence in each. There is no single report; it is a join of the exports. This is the finding that, in a group with several tenants, is usually the largest by value.
Unassigned seats. The difference between purchased and assigned on each subscription. Every unassigned seat on an annual term is paid for until renewal; on monthly it can go this month.
The findings are worth nothing until the renewal dates are on the calendar. Reductions on annual subscriptions happen only at renewal; on monthly, at the next anniversary. So the output of the audit is not a list of licences to remove — it is a list of subscriptions with a target seat count and the date on which that count can be applied. The rules are here.
Two cautions. Do not remove licences from leavers before deciding what happens to their mailbox. And do not downgrade anyone without checking what the higher SKU was doing for them: a user on E3 “for Intune” who is moved to Business Basic loses device management on Monday.
On a tenant of a few hundred seats, run once, this exercise usually recovers between ten and twenty-five percent of annual Microsoft spend. The leaver cleanup is the fastest; the E5-to-E3 question is the largest; the cross-tenant duplicates are the ones nobody expected. It is also the part of a licensing review we do for nothing, because it is the part that convinces people the rest is worth doing.
One email a month, at most
Postmortems, timelines, licensing changes that cost people money. If a month has nothing worth your time, you hear nothing.
Please enter a work email address.
Done. Unsubscribe by replying to any email; we will not argue.
Related questions
Three reports: Entra sign-in activity for licensed accounts with no sign-in in ninety days; the admin centre usage reports for Apps, Teams and Exchange to find people on plans they do not use; and Billing, Your products, for unassigned seats, overlapping bundles and forgotten add-ons.
People with no desktop app activity in ninety days are candidates for F3 or Business Basic. People on E5 with none of the E5 security and compliance features deployed are candidates for E3, or for switching those features on.
On a tenant of a few hundred seats, typically between ten and twenty-five percent of annual Microsoft spend on the first pass, most of it from leaver cleanup, E5 right-sizing and duplicates across tenants.
Only at each subscription’s renewal for annual terms, or at the next monthly anniversary for monthly terms. The output of the audit is a target seat count per subscription with the date it can be applied.
What the higher SKU was doing for them. A user on E3 for Intune device management loses it on Business Basic. Check Intune enrolment, Conditional Access and Defender assignments before moving anyone.
Rather not do this yourself?
Describe the situation and you get back a sequence, an honest view of what will be slow, and a fixed price — usually within one business day. Or ask one question and get one answer.