Microsoft 365 License Cleanup Before Renewal: Unassigned, Duplicated and Over-Provisioned Seats

Microsoft's admin guidance sets two constraints on reducing licenses: you cannot reduce a subscription's license count while every license is assigned, so you unassign first; and on a Microsoft Customer Agreement billing account you can remove licenses only within seven days of buying or renewing, after which the reduction is scheduled for the next renewal. Subscriptions bought through a Cloud Solution Provider under the New Commerce Experience have the same shape — annual commitments reduce at renewal or inside the allowed window after it, monthly commitments at their monthly renewal — and the NCE explainer covers the term mechanics.

So the analysis, the unassignments and the decisions have to be finished before the renewal date. Start several weeks out; the four steps below are in the order that usually finds the most money for the least work.

These are licenses sitting on no user at all. The Microsoft 365 admin center's Licenses page shows, per subscription, how many are assigned and how many are available; anything available is a candidate to remove at renewal, or to reassign to a new starter instead of buying another.

Three places hide seats that look assigned but are not used:

• Leavers whose accounts are blocked from sign-in but still licensed; blocking sign-in does not release the license. Convert the mailbox to shared if the mail must be kept, then unassign.
• Group-based licensing errors. Users a group could not license — usually because the subscription ran out of seats or two products conflict — show under errors and issues on the Licenses page; resolve the cause and reprocess.
• Test users and service accounts created with a full suite because it was quick.

For a read-only pass over all of this, the Tenant Optimizer scans a tenant and reports unused licenses with their annual cost, stale accounts and privileged accounts without MFA, ranked by severity. It reads no mailbox or file content.

Duplication is paying twice for a service plan a user already holds through a suite. It is invisible in a seat count and obvious in a per-user export of service plans. The common shapes:

• A suite plus a standalone version of something it contains: Microsoft 365 E3 plus a separate Exchange Online Plan 1, or Microsoft 365 Business Premium plus a standalone Microsoft Entra ID P1 the suite already includes.
• Add-ons Microsoft has since folded into the suite. On 1 July 2026 Microsoft's packaging update added Microsoft Defender for Office 365 Plan 1 to Office 365 E3 and Microsoft 365 E3, and Intune Plan 2, Remote Help and Advanced Analytics to Microsoft 365 E3 and to EMS E3 and E5; Microsoft 365 E5 gained those plus Security Copilot, Endpoint Privilege Management, Cloud PKI and Enterprise Application Management. Anyone still paying for those as separate add-ons is paying twice until the add-on is cancelled at its own renewal; our note on the 2026 packaging changes lists them.
• Two suites on one user, usually after a migration or merger, where the old plan was never removed.
• Per-user add-ons — Visio, Project, Teams Phone, Copilot — on users whose usage reports show nothing.

Export every user with every assigned product and enabled service plan and look for the same service plan twice on one user; the hidden duplication article walks the export. Duplicates are removed by unassigning the standalone, which is then reduced at its own renewal date, not necessarily the suite's.

The third pass is users on a plan whose distinguishing features they do not use: E5 seats where nothing E5-specific is switched on, Business Premium on users who need only mail, Copilot seats assigned in a pilot and never revisited.

Evidence comes from the usage reports in the Microsoft 365 admin center, which cover the last 7, 30, 90 and 180 days per service with a last activity date per user. By default they conceal user, group and site names; a Global Administrator can display them for the collection window, or you accept aggregate findings. Global Reader, Reports Reader and Usage Summary Reports Reader can read them without changing anything, so a license audit never needs a role that writes.

The decision is per population, not per person: which roles need the E5 security and compliance features, which need Teams Phone, which need desktop apps at all. The E3 versus E5 comparison sets out where the upgrade pays, and the Microsoft 365 Plan-Mix Optimizer turns headcount by role plus the controls you need into the lowest-cost compliant plan mix at Microsoft's list price, with an all-E5 alternative beside it. Downgrades have side effects, and the right-sizing guide lists where a downgrade creates risk.

Microsoft's guidance is unambiguous: a shared mailbox can store up to 50 GB without a license, and the same applies to room and resource mailboxes. A shared mailbox needs an Exchange Online Plan 2 license in three cases only: more than 50 GB (Plan 2 raises the limit to 100 GB), a larger in-place archive, or litigation hold; for archive and hold, Plan 1 with the Exchange Online Archiving add-on also qualifies.

The candidates:

• Shared mailboxes carrying a full user license because they were created as users and converted later. The license is removed from the Active users page, not the shared mailbox page, and the account should have sign-in blocked.
• Leavers' mailboxes kept for a period. Convert to shared, which keeps the contents, then unassign, with the 50 GB and hold caveats.
• Room and equipment mailboxes licensed by habit.
• Service accounts that need no mailbox at all, holding a suite because they were created from a template.

One warning from the same documentation: a shared mailbox at its storage limit eventually stops receiving mail and senders get a non-delivery report, so check the size before removing a license from a large one, and put a hold decision in writing for any mailbox legal needs to keep. Unassigning is half the step; you are still paying until the quantity is reduced on the subscription.

Can I remove licenses in the middle of the term?

On a Microsoft Customer Agreement account, only within seven days of buying or renewing; otherwise at the next renewal. Under CSP annual commitments, at renewal or inside the allowed window after it; monthly commitments change at their monthly renewal. Unassign now, reduce at the date.

Does a shared mailbox ever need a license?

Only above 50 GB, for a larger archive, or for litigation hold: Exchange Online Plan 2, or Plan 1 with Exchange Online Archiving for the archive and hold cases. Below that, none, and the people using it need only their own licensed mailboxes.

What about users whose sign-in is blocked?

A blocked account keeps its license and its cost. Convert the mailbox to shared if it must be kept, then unassign. It is the most common source of seats that look assigned and are not used.

Who can do the cleanup without full admin rights?

Analysis needs Global Reader and Reports Reader. Assigning and unassigning needs License Administrator or User Administrator; changing quantities on the subscription needs Billing Administrator. Nobody needs Global Administrator.

How do we stop the tenant drifting back?

Assign licenses by group, keyed to role; automate the leaver step so a blocked account is unassigned the same day; and re-run the four steps on a schedule. That cycle, with the renewal decision presented before each term, is what our license optimization subscription does.

• Microsoft Learn: Understand subscriptions and licenses in Microsoft 365 for business; Buy or remove licenses for a Microsoft business subscription; Assign or unassign licenses for users in the Microsoft 365 admin center; About shared mailboxes in Microsoft 365; Create a shared mailbox; Microsoft 365 admin center usage reports overview
• IT Partner: Microsoft 365 and Entra Price and Packaging Changes in 2026; Hidden Duplication in Microsoft 365 Licenses; Right-Sizing Microsoft 365; Microsoft NCE Explained; Microsoft 365 Business Premium security features included with Microsoft Entra ID P1