Four places Microsoft 365 licence money leaks

Microsoft bills grow quietly. People join, leave and change roles, plans are added for one project and never removed, and nobody reviews the whole picture until a renewal lands. Here are four places to look first, where to find the evidence, and how to act on it without creating a security problem.

Microsoft changes its plans, reports and admin screens from time to time, so treat the steps below as a guide and confirm them against the current Microsoft 365 admin centre and Microsoft’s licensing documentation, linked below.

1. Inactive users still holding paid seats

Leavers who were never removed, accounts created for a one-off task, and licences assigned to people who changed role long ago. The usage reports in the Microsoft 365 admin centre show last activity for each service, and the user list in Microsoft Entra ID shows when each person last signed in. Together they are the quickest way to spot seats that nobody is using.

A practical rule is to list everyone with no sign-in or activity for 60 or 90 days, then check each name with a manager. Do not remove a licence from a mailbox that holds data you need to keep. Decide first what happens to the mail and files, because an unlicensed mailbox can eventually be deleted.

2. Overlapping licences

Two plans that provide the same capability, or add-ons bought for features that a higher plan already includes. This often happens when plans are changed over time and the old ones are left in place. Look at each user’s assigned licences, not just the totals, because duplicates are invisible in a summary.

Group-based licensing in Microsoft Entra ID can help. When licences follow group membership, a person who moves out of a group loses the licence automatically, which prevents old assignments from piling up. It needs a licence level that includes it, so check what your plan provides.

3. Over-specified seats

Higher-tier plans assigned to people who only use the features of a lower tier. It is easy to standardise on the top plan for everyone, and expensive. Ask what each group of people actually needs: someone who only reads email and joins Teams meetings may not need the same plan as an analyst or an administrator.

Be careful here. Some security features, such as Conditional Access and device management, are licensed per user. If you move a person to a cheaper plan, you may remove the controls that protect their account. Cost and security have to be checked together.

4. Separate tools for things you may already own

Meetings, basic identity protection, email filtering and file storage are examples of capabilities that many plans include to some degree. Check what your plan already entitles you to before renewing a separate subscription for the same job. The reverse also happens: a business pays for a premium add-on, such as Copilot, and finds a few months later that only a handful of people use it.

Accounts that may not need a paid licence

Not everything in the user list needs a seat. These are worth checking, because paying for them is a common source of waste:

• Shared mailboxes. A shared mailbox below the storage limit generally does not need its own licence. Above the limit, or if you add features such as an online archive or a litigation hold, it usually does. Check Microsoft’s current shared mailbox rules.
• Room and equipment mailboxes. These generally do not need a user licence.
• Service and test accounts. Old accounts created for scanners, applications or experiments. Some are still needed, so find out before you remove them.

Never assume. The rules for each account type have conditions, and Microsoft updates them.

Where to find the numbers

1. In the Microsoft 365 admin centre, open the licences page under Billing to see how many you bought and how many are assigned.
2. Open the usage reports to see last activity by user and by service.
3. Export the user list, and compare it with your staff list from HR or payroll.
4. In Microsoft Entra ID, check last sign-in activity for each account.

Put it all in one spreadsheet, with columns for name, plan, last activity and what you decide. It will not take long, and it is more reliable than asking people.

What to do with the findings

Work out which savings are safe to make now, and which need a security or usage check first. Cutting a licence that protects your data is a false economy, so cost and security should be reviewed together. Treat any saving as something to test, not a promise: until you have confirmed with the people involved and seen your next invoice, it is an estimate.

Do the clean-up well before renewal. Some licence changes are only possible at renewal or within a short window, so timing decides how much you can change. Our renewal checklist sets out a 90-day plan, and Microsoft 365 plans compared explains what each plan includes. Read ten security controls to set first before you downgrade anyone.

More on licence cost

These pages go deeper on one question each: Microsoft 365 licence optimisation, how to reduce Microsoft 365 licence costs, what unused Microsoft 365 licences look like, and how to run a Microsoft 365 licence audit or a Microsoft 365 licence review.

About this guide

Innoligo is an authorised Microsoft CSP partner. This guide is general information and applies whoever you buy your licences from. An expert-led assessment covers the wider picture.

Microsoft, Microsoft 365, Entra and Copilot are trademarks of the Microsoft group of companies. This guide is independent and is not published or endorsed by Microsoft.