Right-Sizing Microsoft 365: Match Licenses to Actual Usage

The Microsoft 365 admin center shows what users are entitled to use. It does not prove that they need those entitlements.

Common findings include:

• Microsoft 365 E5 assigned to users with no use of E5 or add-on-dependent capabilities such as Microsoft Defender for Office 365 Plan 2, Microsoft Purview advanced compliance features, Microsoft Entra ID P2 features, Power BI Pro, or Teams Phone.
• Microsoft 365 Business Premium assigned where users only need Exchange Online, Teams, and web apps.
• Frontline or task workers licensed like full knowledge workers.
• Departed employees retaining licenses after offboarding.
• Service, scanner, application, room, and shared mailbox accounts consuming full user SKUs without a documented reason.
• Project, Visio, Teams Phone, Power BI Pro, Microsoft 365 Copilot, Defender, or Purview add-ons attached to accounts with no recent workload activity.

Use list pricing only as a sizing guide, because Microsoft pricing varies by term, region, program, and billing model. As a simple example, if Microsoft 365 E3 is about $36 per user/month and Microsoft 365 E5 is about $57 per user/month, the E5 premium is about $252 per user/year. If 200 users have E5 and only 70 have a validated E5 requirement, the potential annual waste on the suite delta alone is about $32,760 before add-ons. The point is not to downgrade blindly; it is to keep premium licensing where it reduces risk or enables work, and remove it where it is parked.

Begin with tenant telemetry and business requirements. SKU names are packaging; usage data shows operational need.

Collect evidence from these areas:

• Identity activity: last interactive sign-in, non-interactive sign-ins, disabled accounts, stale guests, privileged roles, and accounts with no recent activity.
• Core Microsoft 365 usage: Exchange mailbox activity, Teams chat/meeting/calling activity, SharePoint and OneDrive file activity, Microsoft 365 Apps activation, Outlook activity, and mobile/web-only use.
• Premium workload usage: Defender alerts and investigations, Defender XDR advanced hunting, Purview eDiscovery, Audit (Premium), retention, communication compliance, insider risk, DLP and endpoint DLP, sensitivity label publishing and auto-labeling, Power BI reports/workspaces, Teams Phone numbers/call queues/auto attendants, Project, Visio, and Copilot activity.
• Security dependencies: Conditional Access, Intune device compliance, Microsoft Defender for Endpoint or Defender for Business coverage, privileged identity management, identity protection, access reviews, and risk-based policies.
• Role requirements: executives, finance, legal, HR, IT admins, regulated teams, frontline workers, contractors, shared-device users, board members, seasonal staff, and non-human accounts.

Treat a user as an E5 user only when E5-included capabilities are used, required by policy, or intentionally assigned for risk control. Otherwise, evaluate E3, Business Premium, frontline plans, or targeted add-ons.

Department-based licensing is too blunt. Finance may include a CFO who needs elevated identity protection, analysts who need Power BI Pro, AP clerks who need standard productivity, and contractors who need time-bound access. One department can contain several licensing profiles.

Use workload profiles instead:

1. Full productivity users: need desktop Microsoft 365 Apps, Exchange, Teams, OneDrive, SharePoint, and standard security controls. Depending on organization size and security requirements, these users may fit Microsoft 365 Business Standard, Business Premium, E3, or E5. Business plans are capped at 300 users per tenant.

2. Security-sensitive users: executives, finance, HR, IT, and privileged users with elevated risk. These users may justify Business Premium, E3 plus security add-ons, Microsoft 365 E5 Security, or E5, depending on Entra ID, endpoint, email security, and investigation requirements.

3. Compliance-heavy users: legal, records management, regulated teams, and users in eDiscovery, retention, DLP, audit, insider risk, or communication compliance workflows. E5 or Microsoft 365 E5 Compliance may be justified when those capabilities are deployed and assigned to the right users.

4. Frontline or task workers: users who need Teams, email, mobile/web apps, or shared-device workflows but not full desktop apps. Microsoft 365 F-series plans can fit, but validate mailbox size, app access, device management, and compliance requirements first.

5. Light or occasional users: board members, seasonal workers, contractors, vendors, and project-based staff. These accounts need expiration dates, access reviews, and license reviews.

6. Non-human accounts: shared mailboxes, room and equipment mailboxes, scanner accounts, application accounts, service accounts, and emergency access accounts. Do not assign full user SKUs by habit. Document the exact reason when a license is required.

Right-sizing is controlled change, not cost cutting by spreadsheet. Several capabilities are license-sensitive, and removing the wrong license can create security, compliance, or productivity gaps.

Check these dependencies before downgrading or removing a license:

• Mailbox limits: Exchange Online Plan 1 and Plan 2 have different mailbox, archive, and compliance capabilities. Shared mailboxes can often be unlicensed, but a license is required for scenarios such as an archive mailbox, larger mailbox requirements, or certain compliance needs.
• Desktop apps: Business Basic and many frontline plans do not include desktop Microsoft 365 Apps. Moving a desktop-app user to a web-only plan will create activation issues.
• Identity: Conditional Access requires Microsoft Entra ID P1 for covered users. Identity Protection, Privileged Identity Management, and access reviews require Entra ID P2.
• Device management and endpoint security: Intune, Defender for Business, and Defender for Endpoint licensing must still cover users/devices after the change.
• Email and collaboration security: Defender for Office 365 Plan 1 and Plan 2 capabilities differ; do not remove Plan 2 where investigation, automation, or advanced protection workflows depend on it.
• Compliance: eDiscovery (Premium), Audit (Premium), advanced retention, endpoint DLP, auto-labeling, communication compliance, and insider risk management may require E5 or compliance add-ons.
• Voice and meetings: Teams Phone, Calling Plans, Operator Connect, Direct Routing, resource accounts, call queues, auto attendants, and audio conferencing should be checked before removing voice-related licenses.
• Specialized apps: Power BI Pro, Project, Visio, and Microsoft 365 Copilot are separate entitlement checks. Confirm actual use and base-license eligibility before removal.

Savings are real only when the target license still supports the user’s work, security posture, and compliance obligations.

Microsoft 365 licensing drifts because onboarding templates, manager requests, projects, reorganizations, and security initiatives change faster than renewals. Make right-sizing a recurring operating process.

Use this 90-day cycle:

• Week 1: Export assigned licenses, group-based licensing rules, direct assignments, add-ons, disabled users, inactive users, shared/resource mailboxes, privileged accounts, service accounts, and emergency access accounts.
• Week 2: Pull 30/60/90-day usage signals. Use more than one time window because some workloads, such as eDiscovery, audit review, Project, Visio, and Power BI, may be periodic.
• Week 3: Map users to workload profiles. Identify removals, downgrades, add-on cleanup, and exceptions requiring documentation.
• Week 4: Review proposed changes with IT, security, compliance, finance/procurement, and business owners. Approve an exception list with owners and review dates.
• Weeks 5-6: Pilot changes with a small group. Monitor help desk tickets, sign-in failures, Office activation, mailbox issues, Teams calling, Power BI access, compliance workflows, and Conditional Access impact.
• Weeks 7-8: Apply approved changes in batches. Keep rollback instructions and record before/after license state.
• Weeks 9-12: Update group-based licensing, onboarding templates, request forms, offboarding automation, access reviews, and procurement quantities so the same waste does not return.

A one-time cleanup reduces today’s bill. A governed cycle prevents the next renewal from rebuilding the same problem.

Manual license assignment creates a record of old decisions. Use governed assignment rules instead.

A practical model:

• Baseline licenses by role and employment type.
• Premium suites only for approved security, compliance, analytics, voice, or productivity requirements.
• Add-ons assigned by workload owner approval and reviewed against usage.
• Exceptions with expiration dates.
• Disabled users reviewed automatically for license removal after offboarding and retention checks.
• Direct license assignments minimized; group-based licensing used where groups are governed.

Group-based licensing is not governance by itself. An “All Employees - E5” group only automates overspend unless membership rules and exceptions are controlled.

Separate license cleanup from access cleanup. Removing a license is not the same as disabling access, and disabling access is not the same as preserving data. Offboarding should cover mailbox conversion, OneDrive ownership transfer, retention or legal hold requirements, group memberships, app permissions, privileged roles, guest access, and license removal in the correct order.