How to Run a Microsoft 365 License Audit (and What to Look For)

Begin with what the organization is paying for, not with the user list. Export active subscriptions from the Microsoft 365 admin center or Partner Center: product name, SKU, purchased quantity, assigned quantity, available quantity, renewal date, billing term, commitment term, and whether the subscription is monthly or annual under the New Commerce Experience (NCE).

Build a baseline by SKU. Example: 500 Microsoft 365 E3 licenses purchased, 463 assigned, 37 available, renewal in 18 days. Those 37 licenses are waste, but the action depends on the term. If the subscription is annual and outside the cancellation or seat-reduction window, document the reduction target, stop additional purchases, and reduce seats before renewal.

Separate suites from add-ons. Review Microsoft 365 E3/E5, Office 365 E1/E3/E5 where still used, Microsoft 365 Business Basic/Standard/Premium, Microsoft 365 F3, Exchange Online, Microsoft Entra ID, Microsoft Intune, Microsoft Defender, Microsoft Purview, Visio, Project, Power BI Pro, Teams Phone, Audio Conferencing, and Microsoft 365 Copilot. Savings usually come from the SKU mix, not from one product.

Export users from Microsoft Entra ID and include user type, account enabled status, department, job title, manager, last interactive sign-in, last non-interactive sign-in where available, assigned licenses, direct versus group-based assignment, mailbox type, mailbox size, archive status, OneDrive activity, Teams activity, and device enrollment status.

Classify accounts before changing licenses. Use practical categories: active employee, frontline worker, contractor, guest, shared mailbox, room/resource mailbox, service account, emergency access account, leaver, and unknown. A disabled former employee on litigation hold is different from an inactive contractor. A service account may show no Teams or OneDrive activity but still support an application.

Target obvious hygiene first: disabled users with paid licenses, test accounts with premium suites, stale contractors, and shared mailboxes with unnecessary licenses. Shared mailboxes normally do not need a license unless they require features such as an archive mailbox, litigation hold, Microsoft Purview retention or eDiscovery requirements, a mailbox size above the unlicensed limit, or direct sign-in.

Do not remove licenses based on sign-in alone. A user may have low interactive sign-in activity but still use mail through a client, mobile app, delegated access, or a service workflow. The reverse is also common: a user authenticates regularly but does not use the premium workloads in the assigned license.

Use a 30/60/90-day review model. At 30 days, flag accounts for review. At 60 days, validate with the manager or application owner. At 90 days, remove or downgrade the license unless there is a documented exception. Check Exchange mailbox activity, Teams chat and meeting activity, OneDrive and SharePoint file activity, Microsoft 365 Apps activation, Power BI activity, Defender device onboarding, Intune enrollment, and Entra sign-ins. Use more than one window: eDiscovery, audit review, Project, Visio and Power BI use is periodic, and a 30-day report alone flags people who open the product once a quarter.

For example, a user with Microsoft 365 E5 who signed in last week is not inactive. But if that user has no Microsoft Defender for Endpoint Plan 2 dependency, no Microsoft Entra ID P2 requirement, no Purview advanced compliance use, no eDiscovery (Premium) involvement, no Teams Phone requirement, and no Power BI Pro usage, E5 may still be excessive. Audit for mismatched entitlement, not only unused accounts.

Map licenses to roles. Executives, finance, legal, security, IT administrators, and regulated users may justify E5. Standard information workers may fit E3. Eligible small and midsize business users may fit Microsoft 365 Business Premium. Frontline users may fit Microsoft 365 F3 or another frontline plan, depending on mailbox, app, and device needs.

Model the SKU mix at Microsoft list price, October 2026 price list, annual commitment: Microsoft 365 Business Premium $22.00, Microsoft 365 E3 $39.00, Microsoft 365 E5 $60.00 and Microsoft 365 F3 $10.00 per user per month. The E5 to E3 difference is $21.00 per user per month, so moving 100 users who have no E5-only dependency saves $2,100 per month, or $25,200 per year, before any add-on they might need instead. The E3 to F3 difference is $29.00, but F3 changes mailbox size, desktop app rights and Windows rights, so it is a different plan to validate per population, not a discount.

Check duplicate entitlements. Microsoft 365 Business Premium includes Microsoft Entra ID P1, Microsoft Intune Plan 1, Defender for Business, and Microsoft 365 Apps for business. Users with Business Premium usually should not also have separate Entra ID P1, Intune Plan 1, or overlapping small-business security add-ons. Microsoft 365 E5 can overlap with standalone identity, security, compliance, analytics, and voice add-ons depending on the exact subscription mix.

Do not downgrade until dependencies are checked. Before moving from E5 to E3, validate Microsoft Defender for Endpoint Plan 2, Microsoft Entra ID P2, Microsoft Purview advanced compliance, Audit (Premium), eDiscovery (Premium), Insider Risk Management, Information Protection, Power BI Pro, Teams Phone, and audio conferencing requirements. Before moving from E3 to Business Premium, check the 300-user limit, Exchange mailbox and archive requirements, device management design, security baseline requirements, app deployment, and VDI/RDS activation needs.

Many tenants drift because licensing is assigned through old Microsoft Entra groups with unclear ownership. A user joins a department group and receives E3, moves roles and receives E5, then gets a project add-on through another group. The admin center shows the assigned products, but the business rule is often buried in group membership.

Export assignment paths for each paid SKU. Identify direct assignments, group-based assignments, dynamic group rules, nested group assumptions, HR provisioning mappings, and onboarding workflows. Direct assignments are often exceptions that were never removed. Group-based licensing is cleaner only when group ownership and membership rules are governed.

Use role-based licensing groups with named owners and documented criteria. Examples: M365-E3-Standard-Users, M365-E5-Security-Users, M365-F3-Frontline, PowerBI-Pro-Approved, TeamsPhone-Enabled, Copilot-Approved. Avoid vague groups such as All Staff Premium or Test Licensing Group.

Split findings into four action buckets: remove now, downgrade after validation, keep with documented justification, and review at renewal. This separates real savings from savings that are blocked by contract terms, feature dependencies, or business risk.

For removals, start with disabled users, confirmed leavers, duplicate add-ons, available licenses that can be reduced, and inactive accounts approved by the business owner. For downgrades, pilot with a small group and confirm access to Exchange, Microsoft 365 Apps, Teams, Conditional Access-protected resources, Defender, Intune, Power BI, Teams Phone, and Purview workflows.

Set a renewal review 45 to 60 days before each subscription anniversary. For NCE annual commitments, seat reductions generally need to be planned at renewal or during the allowed cancellation/reduction window. Track target quantity, current quantity, forecast hiring, approved exceptions, and the person accountable for the change.

Add controls after cleanup. Require approval for E5, Microsoft 365 Copilot, Power BI Pro, Project, Visio, Teams Phone, and other premium add-ons. Tie leaver workflows to license removal. Review direct assignments monthly. Keep emergency access accounts licensed only where required by your identity and security design.

Separate license cleanup from access cleanup: block sign-in, convert or hold the mailbox, transfer OneDrive ownership, remove groups, app permissions, privileged roles and guest access, and only then remove the license.

The fastest first pass is stacking: a user with a base suite plus a standalone product the suite already contains. It shows up in a per-user export of products and service plans before any usage report, and it usually starts with a sensible purchase that was never retired when the users moved up a suite.

At Microsoft list price, October 2026 price list, annual commitment, the usual leftovers are Entra ID P1 at $7.00, Intune Plan 1 at $8.00 and Defender for Office 365 Plan 1 at $2.00 per user per month. A 300-user tenant that moved to Business Premium and kept them on 120, 80 and 60 users pays $840 + $640 + $120 = $1,600 per month for nothing. The add-ons Microsoft folded into the enterprise suites on 1 July 2026 are the newest case; our note on the 2026 packaging changes lists them.

The reverse finding matters too: Entra ID P2 with no Privileged Identity Management, Defender for Endpoint Plan 2 with no devices onboarded, Purview with no policies. Deploy the control with an owner and a date, or cut the count to the people who use it.

How often should we audit Microsoft 365 licenses?

Quarterly for a stable organization, monthly if headcount changes fast, and always 45 to 60 days before an annual renewal, because the renewal is when a reduction takes effect.

Can we reduce seats in the middle of an annual term?

Under the New Commerce Experience only within seven calendar days of the purchase, the renewal or a mid-term seat increase; after that the reduction waits for the renewal. Unassign now so the seat can be reused, and schedule the quantity change for the renewal date.

Does disabling a service plan save money?

No. Turning off a service plan inside a suite changes what the user can open; the suite's price does not change. Savings come from moving the user to a lower-cost SKU or removing the license.

• New commerce cancellation policy — Microsoft Learn (Partner Center), checked 2026-10-11
• Product names and service plan identifiers for licensing — Microsoft Learn, suite contents as listed in the August 2026 edition