The Microsoft 365 License Audit That Happens After Renewal Is Already Late

Microsoft 365 administrators are good at finding licensing problems.

They can identify inactive accounts, unassigned seats, conflicting service plans and users with overlapping assignments. The problem is that many organizations perform this work immediately after receiving a renewal invoice.

At that point, the technical finding may be correct and the financial opportunity may already be locked into another term.

Under Microsoft’s new commerce model, subscription timing is part of license architecture. A useful audit must connect tenant data with renewal data before anyone changes a group or removes a license.

The three datasets you need

Do not begin with one enormous report. Start with three small datasets that answer different questions.

1. Tenant inventory

This shows which SKUs exist and how many units are enabled and consumed.

Connect-MgGraph -Scopes "Organization.Read.All","User.Read.All"

$skus = Get-MgSubscribedSku -All | Select-Object `
    SkuId,
    SkuPartNumber,
    ConsumedUnits,
    @{Name='EnabledUnits';Expression={$_.PrepaidUnits.Enabled}}

$skus | Export-Csv .\TenantSkuInventory.csv -NoTypeInformation

2. Assignment inventory

This shows who holds licenses and whether the account is enabled.

$users = Get-MgUser -All -Property `
    DisplayName,UserPrincipalName,AccountEnabled,AssignedLicenses

$assignments = foreach ($user in $users) {
    foreach ($license in $user.AssignedLicenses) {
        [PSCustomObject]@{
            DisplayName       = $user.DisplayName
            UserPrincipalName = $user.UserPrincipalName
            AccountEnabled    = $user.AccountEnabled
            SkuId             = $license.SkuId
        }
    }
}

$assignments | Export-Csv .\UserLicenseAssignments.csv -NoTypeInformation

3. Commercial calendar

This is the dataset most technical audits omit.

For every subscription, record:

• renewal date;
• commitment term;
• billing frequency;
• current quantity;
• auto-renew status;
• scheduled change, if any;
• provider or purchasing channel.

Microsoft Graph directory data alone does not give you the complete commercial picture. The calendar may need information from Partner Center, the Microsoft 365 admin center, your provider or procurement records.

That is fine. The goal is not to force everything through one API. The goal is to make the decision before the deadline.

Why renewal timing changes the result

Suppose the audit finds 80 seats that the organization no longer needs.

Technically, administrators can remove assignments. Commercially, the organization may still be committed to the purchased quantity until the next eligible reduction point.

Microsoft documents a seven-day cancellation window for new commerce license-based subscriptions at the beginning of a term. Quantity reductions are similarly limited outside the applicable window and can be scheduled for renewal.

This creates three distinct dates:

1. The date the unnecessary assignment is discovered.
2. The date access can safely be changed.
3. The date the purchased quantity can be reduced.

Those dates are not automatically the same.

Build a renewal queue

Once you have the commercial calendar, create a queue ordered by the next actionable date.

Each entry should contain the subscription name, renewal date, current quantity, proposed quantity and review status. For example, a Microsoft 365 E3 subscription could remain under role validation, an F3 reduction could require manager confirmation, and a Power BI Pro reduction could already have complete usage evidence.

The useful part is the operating model:

• start the review well before renewal;
• freeze the proposed quantity after business validation;
• schedule the commercial change;
• coordinate technical assignments separately;
• verify both billing and user access afterward.

Do not use last sign-in as a delete button

Sign-in activity is evidence, not a decision.

An account with no recent interactive sign-in might belong to a person on leave, an integration, a shared operational process or a workload with different activity signals. Before removing access, combine directory data with HR status, application ownership and manager confirmation.

The audit should classify findings:

• safe to remove;
• safe to downgrade;
• requires business confirmation;
• technical dependency present;
• commercially committed until renewal;
• exception approved.

This is slower than deleting every inactive account. It is also much less likely to cause an outage.

Keep assignment changes separate from purchasing changes

This distinction prevents many avoidable mistakes.

Removing a user from a licensing group changes their entitlement. It does not automatically reduce the number of seats purchased from Microsoft or a CSP.

Reducing a subscription quantity changes commercial capacity. It does not automatically redesign your Entra ID groups or validate that remaining users have the right service plans.

Treat them as two linked workstreams. The technical workstream covers users, groups and service plans. The commercial workstream covers quantities, terms and renewal instructions. Once both are complete, validate user access, licensing errors, the invoice and the audit record.

One owner can coordinate the process, but the steps should remain explicit.

A practical review sequence

For teams building this process for the first time, use the following order:

1. Export subscriptions and assignments.
2. Add renewal and commitment data.
3. Identify unassigned capacity and inactive accounts.
4. Map active users to real service requirements.
5. Check group-based and direct assignment paths.
6. Validate dependencies and exceptions.
7. Approve target quantities.
8. Schedule commercial changes.
9. Apply technical changes in a controlled window.
10. Verify access, licensing errors and the next invoice.

This Microsoft 365 renewal checklist provides a compact version that procurement, finance and IT can use together.

The real output

The output of a license audit should not be a spreadsheet showing that 80 seats look unnecessary.

It should be an approved statement saying:

• which seats will change;
• why the change is safe;
• who owns the decision;
• when access will change;
• when the financial reduction becomes effective;
• how the result will be verified.

That is the difference between discovering waste and actually removing it.