Microsoft licence review: what it should find, and when you can act on it

A Microsoft licence review compares three numbers for every subscription you hold: the licences you pay for, the licences assigned to people, and the licences those people actually use. Where the numbers disagree, the review should say what to change and the date on which Microsoft’s terms let you change it. That second half decides whether a finding saves anything this year.

Under Microsoft’s new commerce terms, seats can be added at any time but reduced only in a short window after they were added, which reopens at renewal. Under an Enterprise Agreement, the count is reconciled once a year at the true-up. So a Microsoft licence review, or license review as most people search for it, is only as useful as its calendar.

A disclosure, and how to use this article

Veratas is a Microsoft CSP, an indirect reseller, and we earn a margin on licences bought through us: Microsoft 365 E5 pays us more than E3. A review from us that takes licences off your bill reduces what we earn, and one that adds licences increases it. That is why every check below names the Microsoft report, admin page or contract term it rests on, so you can run all of it without us.

Our Microsoft licensing and CSP page offers a free licence review, with no obligation, of your current Microsoft 365, Dynamics and Azure licences. Whoever runs your review, us included, it should cover what follows. This article concentrates on Microsoft 365, Copilot and Power Platform seats and the agreements around them. Azure is a different exercise: Microsoft’s CSP price lists class it as a usage-based service rather than a licence-based one, and it has its own article on Azure cost optimisation.

What the licence reviews we run find

In the licence reviews we run, seven findings come up again and again. In order of frequency:

1. Unassigned licences still billing. Seats bought for a peak, or freed by leavers, sit unassigned and renew at the same count because nobody scheduled a reduction before the renewal window.
2. Disabled or inactive users still holding paid licences. Accounts with sign-in blocked, belonging to leavers, seasonal contractors or people on long leave, still holding Microsoft 365 E3 or E5, Project, Visio or Dynamics 365 licences.
3. Shared mailboxes licensed when they need not be, and the reverse. Leaver mailboxes converted to shared but still licensed, and shared mailboxes that do need a licence, because they are over 50 GB, have an archive or are on litigation hold, left without one.
4. Add-ons and overlapping suites left after an upgrade. Users on E5 still holding standalone E5 Security, E5 Compliance, Defender for Endpoint, Audio Conferencing or Exchange Online Archiving licences, and users holding both Business Premium and E3 because a group licence was added and the direct assignment never removed.
5. Group-based licensing errors and overlapping group assignments. Failures recorded against users with codes such as CountViolation and MutuallyExclusiveViolation, and users in two licensed groups. Since 2023, a user given two suites that both include Exchange Online, such as E3 and E5, holds both with no error, and each takes a paid seat.
6. Self-service purchases and viral sign-ups. Shadow subscriptions for Power BI Pro, Project, Visio or Power Automate, each with its own renewal date.
7. Power Platform auto-claim assigning standalone Power Apps or Power Automate licences from the tenant’s unassigned stock as users open apps or run flows.

Our published figure on what this adds up to comes from Anuj Kumar Mishra’s comparison of CSP, the Enterprise Agreement and the MCA, drawn from 36 Microsoft estate reviews run for prospective and onboarding clients over the past two years, using the same assessment workflow as the free licence review described at the end of this article: “In 26 of the 36 estates, unassigned or dormant licences accounted for a median of 14% of annual licensing spend, with individual estates ranging from 11% to 18%.” Read it with its caveat. The organisations that ask for a review are self-selected, and many already suspect waste or are approaching a renewal, so the figure describes estates like theirs, not the average Microsoft customer.

Start with three numbers per subscription

Count per subscription, not per product. Microsoft’s licence assignment guidance warns that the Licenses page “might show an aggregate total of licenses for all subscriptions for the same product name”, whereas Billing > Your products “displays a row for each subscription you own”, and each subscription’s renewal date decides when anything can change. If you buy through CSP, Microsoft’s guidance on buying or removing licences sends you to your partner to change the count, so ask the partner for each subscription’s term, billing frequency and end date first.

Inactive users and unassigned licences

Microsoft’s usage reports are “generally available for the last 7, 30, 90, and 180 days”, and the Microsoft 365 apps Active users report gives each person a last active date for each service and the date each licence was assigned. A licence assigned months ago with no activity since is the first thing to look for.

Two points before you export anything. The reports conceal names by default, and showing identifiable user information “is a logged event in the Microsoft Purview portal audit log”, so agree who approves it before the review starts. And “Usage reports don’t include perpetual license models”, so perpetual software needs its own count.

Sign-in data answers a different question: whether the account is used at all. There “isn’t a built-in report for inactive user accounts”, says Microsoft’s guidance on inactive user accounts, so filter the Users list in the Microsoft Entra admin center by last interactive sign-in. It suggests 90 to 180 days as “a reasonable window for inactive user accounts” in many organisations.

Unassigned is not cancelled. Deleting a leaver’s account frees the licence: “When you delete a user account, their license is immediately available to assign to someone else.” You keep paying until the licence comes off the subscription, and “You can’t reduce the number of licenses for your subscription if all licenses are currently assigned to users.” Freeing a licence and reducing the subscription are separate steps; only the second saves money, inside the window described further down.

Duplicate and overlapping licences

Some duplicates come from the upgrade path itself. Microsoft’s Partner Center subscription guidance says “Duplicate (redundant) licenses can be created when purchasing a higher-level SKU” when the upgrade is unsupported, as for Enterprise Mobility + Security E5 to Microsoft 365 E5, or when the higher product needs no prerequisite. Where the higher product was bought alongside the lower one, both can be billing.

The fix has a deadline: the partner cancels the redundant subscription by Partner Center support request within the current term, and “if the upgrade occurs with three months remaining in the subscription, you need to submit the ticket within those three months.” List every higher plan bought in the past year and check that what it replaced has stopped billing.

Add-ons are the second pattern. Microsoft’s Microsoft 365 Enterprise licensing page describes E5 Compliance and E5 Security as “add-ons to their Microsoft 365 E3 subscriptions”, and its Defender pricing page sells the Defender Suite as an add-on that “Requires: Microsoft 365 E3; or Office 365 E3 and Enterprise Mobility + Security E3”, delivering Defender capabilities “without the productivity or compliance services included in Microsoft 365 E5.” Before renewal, ask what such an add-on gives an E5 user that E5 does not.

Overlapping suites are the third pattern, and since 2023 they no longer announce themselves. Microsoft’s group licensing guidance still gives a conflict as its example, Office 365 E1 assigned directly and Office 365 E3 through a group, fixed by “remove the redundant direct license”. But in January 2023 Microsoft’s Exchange Team announced that suites containing Exchange Online can be held together, including through group-based licensing: “users can be concurrently assigned Microsoft 365 E3 and Office 365 E5 licenses”. What used to fail with an error now succeeds, and “if two (or more) licenses are assigned, all of them are ‘in use’ (and might be billed).” A user in both an E3 group and an E5 group holds both and no licensing error flags it, so the review has to find those users by comparing group membership and remove the lesser licence.

Group-based licensing: where assignments drift

Microsoft’s group licensing guidance lists the failure modes a review should look for:

• Nested groups are ignored. It “doesn’t currently support nested groups”; “only users in the first-level group are assigned licenses.”
• Errors arrive late. Group-based licensing “records the failure on the user object and surfaces it later in the admin portal”, where admins review it under Billing > Licenses, the product, then the Errors & issues tab. Microsoft Graph records each failure as one of six values: “CountViolation, MutuallyExclusiveViolation, DependencyViolation, ProhibitedInUsageLocationViolation, UniquenessViolation, and Other.”
• Deleting a licensed group can leave direct assignments behind, because an inherited licence another product depends on can be converted “into a direct assignment so the dependent service keeps working.”

For the “not enough licenses” error, Microsoft’s fixes include “remove unused direct assignments”. That is the drift to measure: one-off direct assignments nobody removed once a group took over.

Copilot and Power Platform: assigned is not the same as used

The Microsoft Copilot usage report counts Enabled Users, who hold Copilot licences, and Active Users, who “tried a user-initiated Microsoft Copilot feature”, over 7, 28, 90 or 180 days. A single try counts as active, so the per-user last activity dates say more about real use. Reading it in depth is covered in Copilot adoption after the licences.

Moving licences from people who do not use them to people who will is limited by Microsoft’s Product Terms. Unless a service’s own terms allow otherwise, “Customer may not reassign an SL on a short-term basis (i.e., within 90 days of the last assignment)”, except to cover a user’s absence or a device out of service, and any other reassignment “must be for the remaining term of that License.” The Microsoft 365 Product Terms list “Microsoft 365 Copilot (User SL)” and add no reassignment terms of their own, so the rule applies, and for a user licence the only short-term exception is a user’s absence. Whether to buy Copilot at all is covered in Microsoft 365 E7 and Copilot licensing and Copilot Studio licensing.

With one of Microsoft’s auto-claim policies in place, Power Platform licences can be claimed without an admin assigning them. Under Microsoft’s Power Apps and Power Automate auto-claim guidance, a user without a standalone Power Apps licence who opens an app needing a premium licence, or any app in a managed environment, is assigned a Power Apps per user licence from the tenant’s unassigned stock, and the Power Automate triggers include a user who “triggers, saves, or turns on a premium cloud flow (or standard flow for managed environments)”. Scope has two choices: “All Environments or Only Managed Environments.” The feature is off by default, but “In some cases, the auto-claim feature is turned on by default”, with some policies preconfigured. Turning a policy off stops new claims, but “users who already claimed a license don’t lose their license.”

So open Billing > Licenses > Auto-claim policy, note which policies are on, which subscriptions they draw from and their scope, and read the policy report for the past 90 days. If you are growing a Power Platform maker community, this report is where that growth shows up as licences. Microsoft’s separate “Users requiring licenses in managed environments” report is covered in Power Platform managed environments licensing.

Licences bought outside central control

Some licences in a tenant may not have been bought by IT, and Microsoft governs them with two separate controls.

The first covers self-service purchases and in-app trials. Microsoft’s self-service purchase guidance says “By default, all new products are set to allow users to make a self-service purchase”, and the AllowSelfServicePurchase policy “is managed on a per-product basis”. A change affects only purchases and trials from that point forward, not what is already there. Self-service purchases “automatically renew at the end of the subscription term”, and some self-service trials “automatically convert to a paid version when the trial ends.”

The second covers email-based, or viral, sign-up, set in Microsoft Entra for the whole tenant. Microsoft’s self-service sign-up guidance says “Admins have two self-service controls today”: whether users can join the tenant by email, and whether they can license themselves for applications and services. Neither can be set per product, and some Power Apps trials need Microsoft’s separate block-trial commands.

Admins can see self-service purchases under Billing > Your products with the Self-service filter and take the subscription over. List each one with its owner, price and expiry, and decide whether it moves under central control or ends.

Under-licensing: the half that protects you

A review that only looks for waste misses the findings that carry risk. The Microsoft Customer Agreement, which CSP customers must accept before a partner can order for them, says “Microsoft may verify Customer’s and its Affiliates’ compliance with this Agreement at any time upon 30 days’ notice”, at Microsoft’s expense. Unlicensed use must be licensed within 30 days, and where it “is 5% or more of Customer’s total use of all Products”, the customer also reimburses Microsoft’s verification costs and buys the missing licences “at 125% of the then-current Customer price or the maximum allowed under applicable law, if less.”

Shared mailboxes cut both ways. Microsoft’s shared mailbox guidance says “A shared mailbox can store up to 50 GB of data without assigning a license to it”. Above 50 GB, “the shared mailbox must be assigned an Exchange Online Plan 2 license”, which raises the limit to 100 GB. Growing the archive needs “an Exchange Online Plan 2 license or an Exchange Online Plan 1 license with an Exchange Online Archiving add-on license”, and Microsoft’s Exchange Online limits allow archive mailboxes only for an entity “for which a license has been applied”, so treat any shared mailbox with an archive as needing one of those two. Litigation hold needs the same.

Retention policies are less clear, because Microsoft’s own pages disagree. The Purview service description says a shared mailbox needs a licence only for features that require an E5-level licence, such as retention policies that use adaptive scopes. The Exchange Online limits page says a shared mailbox in a retention policy “must be licensed for such feature(s)”. Treat an unlicensed shared mailbox in a retention policy as something to check, not a confirmed shortfall.

Leaver mailboxes are different again. When a leaver’s account is deleted while a hold or retention policy applies, the mailbox becomes an inactive mailbox, and the Purview service description is explicit: “Inactive mailboxes do not require a usage license.” So a leaver account kept licensed only to preserve its mail can go: a confirmed hold keeps the mail, unlicensed, as an inactive mailbox once the account is deleted. The licence matters earlier, as Microsoft’s inactive mailbox guidance puts it: “To make a mailbox inactive, it must be licensed correctly so that a hold can be applied to the mailbox before it’s deleted.”

In an Enterprise Agreement, the under-licensing check is the true-up itself, covered below.

When a licence can actually come off the bill

The rules below are Microsoft’s for new commerce subscriptions bought through CSP; buying direct under a Microsoft Customer Agreement is covered after them, and how the rules shape the agreement decision is in Anuj’s comparison of CSP, the Enterprise Agreement and the MCA.

Three details change how a review should hand over its findings.

Scheduled changes are fragile. Partners can schedule “License increases or reductions” for renewal, but only while autorenew is on, and a saved scheduled change is deleted by midterm changes including turning off autorenew, changing a quantity or upgrading. A reduction agreed in March can quietly disappear if someone adds five seats in June.

Auto-renew off is not a cancellation. Since 4 May 2026 the free grace period on non-renewed subscriptions has gone. For subscriptions eligible for extended service terms, autorenew set to false “without an explicit cancellation set” is converted to an extended service term with autorenew on, billed monthly at the monthly rate plus 3%, or 23% where no monthly plan exists. Anything the review says should end needs an explicit cancellation at term end.

Downgrades are a reduction plus a new purchase. Microsoft documents product changes at renewal only as upgrades, and states “Downgrades aren’t supported.” Moving users from E5 to E3 therefore takes three steps. Reduce the E5 subscription’s renewal quantity, or set it to cancel at the end of its term, since auto-renew off alone moves an eligible subscription to an extended service term. Buy E3 as a separate subscription. Then, on the day, move the users from the E5 licensing group to the E3 group, after checking which E5-only features they use.

If you buy directly under a Microsoft Customer Agreement, the same seven-day rule applies: you “can only remove licenses from your subscription if it’s within seven days of buying or renewing”.

One recent review: what could come off, and what had to wait

The client, anonymised here, is a UK logistics and distribution business with 480 seats. We reviewed it as an independent advisory engagement, six weeks before its main annual renewal; its Project and Visio subscriptions renewed five months after that. The review found:

• 38 unassigned Microsoft 365 E3 licences, left over from a warehouse closure seven months earlier.
• 19 disabled accounts still holding E3. Eleven had already been converted to shared mailboxes, all under 15 GB. The other eight needed converting before the licence came off, and Microsoft’s conversion guidance requires that while the mailbox is still licensed: “The user mailbox needs a license assigned to it before you convert it to a shared mailbox.”
• 14 executives and IT staff on E5 who still held standalone E5 Security and Audio Conferencing add-ons.
• 22 Project Plan 3 and 16 Visio Plan 2 seats on separate annual subscriptions, with no activity for more than 120 days.
• 9 shared mailboxes, converted from former staff so teams could keep using them, whose licences had been removed after conversion. Six were on Litigation Hold, and three had in-place archives that were still growing, two of them nearing the 50 GB limit. Microsoft’s shared mailbox guidance requires Exchange Online Plan 2, or Plan 1 with Exchange Online Archiving, to place a shared mailbox on Litigation Hold and to grow its archive.

Six weeks was enough for the main renewal. The 57 E3 seats (the 38 unassigned and the 19 from disabled accounts) and the add-ons on the 14 E5 users came off at that renewal: the client instructed its UK CSP partner to schedule the reductions in Partner Center from our action list. The same review added nine Exchange Online Plan 2 licences for the shared mailboxes, the one place it raised the bill. The Project and Visio seats could not follow. They were unassigned from the inactive users and scheduled for reduction at their own subscriptions’ renewal, which left them on the bill for another five months, with the scheduled reduction exposed throughout to any midterm change that would delete it. Same review, same kind of finding, two different dates: what decided it was the subscription each seat sat on.

Enterprise Agreement true-up: what it is and what it asks of you

On an Enterprise Agreement, the calendar is set by the true-up, which Microsoft’s Enterprise Agreement licensing guidance defines as “an annual inventory of products, services, users, and devices added during the year”.

Microsoft sets the timeline: discuss the true-up with your account team, Licensing Solution Provider or Enterprise Software Advisor at 120 days before the enrollment anniversary, review the order at 60, and “Finalize your True-up between 60 and 30 days prior to your Enrollment Anniversary.” A year with no change still needs paperwork: “If no changes have been made, an Update Statement must be submitted to Microsoft.” Under an Enterprise Subscription Enrollment the process is the Annual Order, “through which you can increase or decrease your license subscription counts.”

Microsoft also presents the true-up as a way to “Easily manage compliance”, so the review’s job in an EA is to count what was deployed so the order is right, starting at the 120-day mark rather than the 30-day one.

What to check on CSP pricing

Microsoft’s CSP price lists carry two prices per product: the list price, “The price the partner pays”, and the ERP price, “The estimated or recommended retail price to the customer”. The gap is what Microsoft calls partner margin, ours included. Only “CSP partners with the capability to transact” can download the lists, so ask your partner for the ERP of each line on your invoice, then confirm the price holds until renewal. What we commit to on price is in our guide to choosing a Microsoft CSP partner.

Our position: the risk is in the renewals, not the seat price

Our position is that the real risk in a CSP relationship is standing privileged access and unmonitored renewals, not a small difference in seat price. A licence review is where the second half shows up. Microsoft’s rules make the point: a seat found idle two weeks after renewal stays on the bill until the next one, a scheduled reduction can be wiped by a midterm change, and an eligible subscription set not to renew now rolls on monthly at a premium unless explicitly cancelled. None of that appears on a per-seat quote.

The first half shows up too. When we onboard an estate for licensing advice, managed services or a security review, we find the Partner relationships page in the Microsoft 365 admin center is rarely clean: access left by former partners is common, and it outlives the contracts that granted it. A licence review is the natural moment to check who can still act on your tenant; what to look for is in our CSP partner guide.

Four more positions follow from what the reviews find, and a partner could dispute any of them.

• A licence that has shown no activity for 90 days should come off at the next renewal unless someone names the reason. Before removing it, decide whether the mailbox must be kept. To keep it as a record, apply a hold and confirm it is in place before deleting the account, so the mailbox becomes inactive. To keep it in use, convert it to a shared mailbox while it is still licensed and under 50 GB. Removing an Exchange Online licence starts a 30-day window, after which the data is deleted unless a hold was placed first.
• A seat reduction should always be locked in as a scheduled renewal quantity change at least 30 days before the renewal date, never left to last-minute manual edits on renewal day or confused with switching off auto-renew.
• Copilot licences are never rotated between active users. Microsoft 365 Copilot is a User SL, so the Online Services terms bar reassigning it on a short-term basis, within 90 days of the last assignment, except to cover a user’s absence, and any other reassignment must be for the licence’s remaining term. Rotating seats among people who are all at work is not allowed; moving a leaver’s seat to a new user for good is.
• Group-based licensing should be the only assignment method, with direct assignments treated as exceptions to be justified at each review.

What a licence review should hand you

The output of a Microsoft licence review is a list of actions, each tied to a Microsoft report and a date:

1. A table per subscription: product, term, renewal date, and licences paid, assigned and active.
2. Licences to remove, each dated to its window and set up as a scheduled change or explicit cancellation, not an auto-renew switch.
3. Redundant subscriptions after upgrades, with the ticket deadline.
4. Add-ons and overlapping plans on users who already hold the capability.
5. Assignment drift: group licensing errors, leftover direct assignments, nested groups and overlapping group licences.
6. Gaps on the other side: shared mailboxes, self-service purchases and sign-ups, auto-claim policies and, in an Enterprise Agreement, deployments not yet in the true-up.
7. Who can change your licences: the partner of record on each subscription and the partner relationships on your tenant.

What our free licence review involves

Our free licence review works through that list. What you receive is a written licensing and renewal action pack, walked through with you on a screen share:

• A savings schedule mapping every unassigned seat, blocked user’s licence, redundant add-on and inactive workload to the renewal date on which it can come off.
• A compliance and under-licensing check covering shared and leaver mailboxes, self-service purchases, and licensing exposure in managed environments and on Copilot.
• A partner access snapshot: who can still act on your tenant.

It takes 30 to 45 minutes of your time: an export call of up to 15 minutes, then a 30-minute walkthrough three to five business days later.

You choose how we see the data. In the first route, you run the exports in the table near the top of this article and send them with your latest invoice, and we need no access to your tenant. In the second, you grant temporary read-only access as Global Reader, which Microsoft’s role reference calls “the read-only counterpart to Global Administrator”, and which can read billing, product subscriptions and usage reports. It has one limit that matters if you buy through a partner: “For subscriptions purchased through a partner, the Global Reader role isn’t available,” says Microsoft’s admin roles guidance. So under either route, subscription and renewal details come from your invoice. We do not ask for Billing Administrator, because it is not read-only: Microsoft’s description of it begins “Makes purchases, manages subscriptions”.

To start, request the free licence review on our Microsoft licensing and CSP page. Keeping licences right between reviews is an operating job rather than a project, the distinction behind managed service versus project delivery, and part of what our managed services cover. Either way, talk to our team.

Frequently asked questions

What is a Microsoft licence review? A comparison, for each subscription, of the licences you pay for, assign and use, drawn from the Microsoft 365 admin center’s billing pages and usage reports. A useful review also dates each change, because most reductions are only possible within seven days of purchase or at renewal.

What is a Microsoft true-up? The annual reconciliation in an Enterprise Agreement, which Microsoft describes as “an annual inventory of products, services, users, and devices added during the year”. It is finalised between 60 and 30 days before the enrollment anniversary, and an Update Statement is required even if nothing changed.

Can we reduce Microsoft 365 licences mid-term? Under new commerce, only within seven days of the licences being added; otherwise at renewal. A reduction can be scheduled for renewal, but only while autorenew is on, and a midterm change such as adding seats deletes it.

Does unassigning a licence stop us paying for it? No. You keep paying until the subscription’s quantity is reduced, which Microsoft will not allow while every licence is assigned, and which is subject to the seven-day and renewal rules.

Is a licence review the same as a Microsoft audit? No. A review is your own check. Under the Microsoft Customer Agreement, Microsoft can verify compliance on 30 days’ notice, and where unlicensed use is 5% or more of total use, the customer pays the verification costs and buys the missing licences at 125% of the then-current price.

Manish Kumar

Senior Business Intelligence Architect with 22 years of experience designing enterprise analytics and data platforms. Focus areas include Power BI, real-time analytics, and large-scale BI architecture across the Microsoft data stack.