The Microsoft 365 License Audit That Happens After Renewal Is Already Late

Christof Gunt — Wed, 19 Aug 2026 13:06:46 +0000

Microsoft 365 administrators are good at finding licensing problems.

They can identify inactive accounts, unassigned seats, conflicting service plans and users with overlapping assignments. The problem is that many organizations perform this work immediately after receiving a renewal invoice.

At that point, the technical finding may be correct and the financial opportunity may already be locked into another term.

Under Microsoft’s new commerce model, subscription timing is part of license architecture. A useful audit must connect tenant data with renewal data before anyone changes a group or removes a license.

The three datasets you need

Do not begin with one enormous report. Start with three small datasets that answer different questions.

1. Tenant inventory

This shows which SKUs exist and how many units are enabled and consumed.

Connect-MgGraph -Scopes "Organization.Read.All","User.Read.All"

$skus = Get-MgSubscribedSku -All | Select-Object `
    SkuId,
    SkuPartNumber,
    ConsumedUnits,
    @{Name='EnabledUnits';Expression={$_.PrepaidUnits.Enabled}}

$skus | Export-Csv .\TenantSkuInventory.csv -NoTypeInformation

2. Assignment inventory

This shows who holds licenses and whether the account is enabled.

$users = Get-MgUser -All -Property `
    DisplayName,UserPrincipalName,AccountEnabled,AssignedLicenses

$assignments = foreach ($user in $users) {
    foreach ($license in $user.AssignedLicenses) {
        [PSCustomObject]@{
            DisplayName       = $user.DisplayName
            UserPrincipalName = $user.UserPrincipalName
            AccountEnabled    = $user.AccountEnabled
            SkuId             = $license.SkuId
        }
    }
}

$assignments | Export-Csv .\UserLicenseAssignments.csv -NoTypeInformation

3. Commercial calendar

This is the dataset most technical audits omit.

For every subscription, record:

renewal date;
commitment term;
billing frequency;
current quantity;
auto-renew status;
scheduled change, if any;
provider or purchasing channel.

Microsoft Graph directory data alone does not give you the complete commercial picture. The calendar may need information from Partner Center, the Microsoft 365 admin center, your provider or procurement records.

That is fine. The goal is not to force everything through one API. The goal is to make the decision before the deadline.

Why renewal timing changes the result

Suppose the audit finds 80 seats that the organization no longer needs.

Technically, administrators can remove assignments. Commercially, the organization may still be committed to the purchased quantity until the next eligible reduction point.

Microsoft documents a seven-day cancellation window for new commerce license-based subscriptions at the beginning of a term. Quantity reductions are similarly limited outside the applicable window and can be scheduled for renewal.

This creates three distinct dates:

The date the unnecessary assignment is discovered.
The date access can safely be changed.
The date the purchased quantity can be reduced.

Those dates are not automatically the same.

Build a renewal queue

Once you have the commercial calendar, create a queue ordered by the next actionable date.

Each entry should contain the subscription name, renewal date, current quantity, proposed quantity and review status. For example, a Microsoft 365 E3 subscription could remain under role validation, an F3 reduction could require manager confirmation, and a Power BI Pro reduction could already have complete usage evidence.

The useful part is the operating model:

start the review well before renewal;
freeze the proposed quantity after business validation;
schedule the commercial change;
coordinate technical assignments separately;
verify both billing and user access afterward.

Do not use last sign-in as a delete button

Sign-in activity is evidence, not a decision.

An account with no recent interactive sign-in might belong to a person on leave, an integration, a shared operational process or a workload with different activity signals. Before removing access, combine directory data with HR status, application ownership and manager confirmation.

The audit should classify findings:

safe to remove;
safe to downgrade;
requires business confirmation;
technical dependency present;
commercially committed until renewal;
exception approved.

This is slower than deleting every inactive account. It is also much less likely to cause an outage.

Keep assignment changes separate from purchasing changes

This distinction prevents many avoidable mistakes.

Removing a user from a licensing group changes their entitlement. It does not automatically reduce the number of seats purchased from Microsoft or a CSP.

Reducing a subscription quantity changes commercial capacity. It does not automatically redesign your Entra ID groups or validate that remaining users have the right service plans.

Treat them as two linked workstreams. The technical workstream covers users, groups and service plans. The commercial workstream covers quantities, terms and renewal instructions. Once both are complete, validate user access, licensing errors, the invoice and the audit record.

One owner can coordinate the process, but the steps should remain explicit.

A practical review sequence

For teams building this process for the first time, use the following order:

Export subscriptions and assignments.
Add renewal and commitment data.
Identify unassigned capacity and inactive accounts.
Map active users to real service requirements.
Check group-based and direct assignment paths.
Validate dependencies and exceptions.
Approve target quantities.
Schedule commercial changes.
Apply technical changes in a controlled window.
Verify access, licensing errors and the next invoice.

This Microsoft 365 renewal checklist provides a compact version that procurement, finance and IT can use together.

The real output

The output of a license audit should not be a spreadsheet showing that 80 seats look unnecessary.

It should be an approved statement saying:

which seats will change;
why the change is safe;
who owns the decision;
when access will change;
when the financial reduction becomes effective;
how the result will be verified.

That is the difference between discovering waste and actually removing it.

The Microsoft 365 License You Buy Is Not the Cost You Pay

Christof Gunt — Tue, 18 Aug 2026 17:51:38 +0000

Microsoft 365 licensing often looks simple: choose a plan, multiply the price by the number of users, and approve the invoice.
In practice, that number rarely represents the real cost.
The biggest waste usually does not come from one expensive license. It comes from hundreds of small decisions accumulating inside the tenant.

The default-license problem
A new employee joins, so someone assigns the standard company package.

That is reasonable. The problem starts when the same package becomes the default for everyone:

Office-based employees
Frontline workers
Contractors
Shared-device users
Employees who only need email

Users who require one specific security feature
They do not necessarily need the same services. Yet many organizations keep most users on E3 or E5 because reviewing individual requirements takes time.

The difference may look insignificant for one account. Across hundreds or thousands of users, it becomes a serious annual cost.
Licenses survive longer than users

Offboarding is another common source of waste.
Disabling an account does not automatically mean that every paid subscription associated with it has been removed or reduced. Licenses may remain assigned to inactive users, test accounts, former contractors or accounts retained for administrative reasons.
Nobody intentionally approves this expense. It simply becomes part of the next renewal.

A useful review should therefore compare:
Active employees
Enabled accounts
Recently active users
Assigned licenses
Actual service requirements

These numbers are often surprisingly different.
Add-ons make comparisons difficult.
Two Microsoft 365 offers may use the same base product name and still have very different total costs.

Teams Phone, Copilot, security products, compliance features and other add-ons can significantly change the annual cost per user. Billing frequency, commitment period, currency and partner conditions matter as well.

This is why comparing only the headline price is rarely enough.
Before comparing two offers, normalize them:
Use the exact same SKU.

Confirm whether Teams is included.
Compare the same commitment and billing period.
Include every required add-on.
Use one currency.

Calculate the complete annual cost.
Otherwise, the cheaper-looking offer may simply contain less.
Start with roles, not product names
The cleanest licensing model begins with a small number of real user profiles.

For example:

Knowledge workers
Security-sensitive employees
Frontline workers
Email-only users
Contractors
Shared-device users

Define what each group actually needs before choosing the corresponding license.

This is usually more effective than reviewing users one by one, and more accurate than assigning one package to the entire organization.

Review before the renewal window
The worst time to discover licensing waste is after an annual commitment has renewed.

A practical review should start early enough to identify inactive accounts, unnecessary add-ons and users assigned to an unsuitable plan. Procurement can then compare equivalent offers using the corrected configuration rather than last year’s invoice.
For a more detailed breakdown of the factors that influence Microsoft licensing prices, this article provides a useful overview:

What Determines Microsoft License Pricing?

The main lesson is straightforward: Microsoft 365 cost management is not primarily about finding one cheaper SKU. It is about maintaining a license structure that still reflects how people actually work.

That structure changes continuously. The licensing model should change with it.

DEV Community: Christof Gunt