How the Retatrutide Calculator Works: Formulas and the mg-to-Units Table

 

How to Perform a Microsoft 365 License Audit (And Actually Stop Overpaying)

If your organization runs on Microsoft 365, there's a good chance you're paying for more than you use. Licenses pile up quietly — a disabled account here, an unused seat there — and before long a meaningful slice of the IT budget is going toward nothing. A license audit is how you find that waste and claw it back.

This guide walks through what a Microsoft 365 license audit actually is, who should run one, how often, and the concrete steps for finding the five most common sources of licensing waste. It's built for IT admins, sysadmins, and anyone responsible for keeping a Microsoft 365 tenant lean.

What Is a Microsoft 365 License Audit?

A Microsoft 365 license audit is a structured review of every license assigned across your tenant, done to confirm each one is actually needed and correctly sized. Audits generally serve two purposes: cutting unnecessary spend, and surfacing compliance gaps you didn't know existed. Most organizations run them primarily for the cost savings, since licensing waste tends to be far larger than people expect.

Before removing any license, it's worth understanding the steps involved in properly offboarding an account — disabling sign-in, converting the mailbox, and retaining the data — since skipping that sequence is how audits turn into data-loss incidents instead of savings.

The Five Places Licensing Waste Hides

Nearly every dollar of Microsoft 365 waste falls into one of five buckets. Each needs to be checked separately, and each has its own quirks.

1. Licenses still attached to disabled accounts
2. Licenses still attached to inactive (dormant) accounts
3. Users who are over-licensed for how they actually work
4. Unassigned licenses the organization is still being billed for
5. License terms and billing frequency that don't match reality

1. Disabled Accounts That Still Have a License

Accounts get disabled for all kinds of reasons — an employee leaves, a contractor's engagement ends — but the license attached to that account doesn't automatically go away. A disabled account almost never needs an active license. The safe pattern is to convert the mailbox to a shared mailbox, apply a retention policy, and only then remove the license.

In the Microsoft 365 admin center, this data lives under Users → Active Users → Export. Once exported, filtering the spreadsheet by the "Licensed" and "Block credential" columns will surface every disabled account that's still consuming a paid seat. For teams comfortable with PowerShell, the same list can be pulled with the Microsoft Graph module by querying users where AccountEnabled is false but AssignedLicenses is not empty.

2. Inactive Accounts Nobody Remembered to Disable

This is arguably the most common form of waste, and the most overlooked. An account can go dormant — no logins for weeks or months — while remaining fully enabled and fully licensed. Beyond the cost, this is a real security gap: an unused, unmonitored account with an active license is exactly the kind of target attackers look for.

Finding these accounts requires visibility into last sign-in activity. If your tenant has a Microsoft Entra P1 license, you can pull "Last interactive sign-in time" directly from the Entra admin center or via PowerShell using the AuditLog.Read.All scope. Without a P1 license, that sign-in data isn't exposed the same way, which is where third-party reporting tools tend to come in.

3. Over-Licensed Users

This one is trickier than it sounds. It's common practice to assign every employee in the same role an identical license bundle — it's simple and avoids the awkwardness of one person feeling shortchanged compared to a peer. But usage patterns vary wildly even within the same role, and Microsoft doesn't provide a single unified report showing every app and service a user actually touches.

The safer approach is cross-referencing usage reports for email, OneDrive, SharePoint, Teams, and Microsoft 365 Apps before downgrading anyone. It's also worth checking less obvious dependencies — Planner boards, shared Forms, retention or conditional access policies — that a usage report won't flag but that will break if a license is pulled. A quick heads-up email to the user before any downgrade avoids a lot of confused support tickets later.

4. Unassigned Licenses Still Being Billed

This is the sneaky one. Removing a license from a user does not stop billing for it — the license itself has to be removed from the tenant's overall subscription count. It's easy for a license to sit "available" for months after someone leaves, especially if the role gets backfilled by promoting an existing (already-licensed) employee instead of a new hire.

In the admin center, Billing → Licenses shows an "Available Licenses" column for each SKU. Any number above zero there is typically a candidate for removal — with two caveats worth knowing. First, licenses tied to certain third-party apps may show as "available" even though they're actively in use outside the native admin center. Second, consumption-based licenses (like extra SharePoint storage) will show similarly but removing them can cause real disruption, so they need a closer look before cutting.

5. License Terms That Don't Match Your Actual Commitment

Since Microsoft rolled out its New Commerce Experience pricing model, the same license can cost meaningfully different amounts depending on whether it's billed monthly or annually, and whether it's paid monthly or upfront. Monthly billing on a monthly term typically carries a real premium — often in the range of 15–20% — compared to an annual commitment.

Most organizations don't need every seat on the same billing term. A practical approach is estimating what share of your workforce is stable for the next 12 months, moving that portion to annual billing, and leaving the rest — new hires, seasonal roles, anyone likely to churn — on a monthly term. Mixing terms this way can meaningfully reduce the total bill without changing what anyone has access to.

Who Should Run the Audit, and How Often

Running a license audit typically requires Global Reader or Global Admin permissions in the tenant. A Global Reader can pull most of the necessary reporting; a Global Admin is usually needed for the pieces that touch billing directly.

As for who should run it: audits are often requested top-down by directors or finance, but there's a strong case for IT engineers running them proactively. Surfacing real savings without being asked is one of the more visible ways a technical team demonstrates value.

On cadence, quarterly is a reasonable baseline for most organizations, with monthly checks recommended for teams with high turnover. It's also worth scheduling a review after predictable staffing swings — seasonal hires wrapping up, for instance — and a follow-up about 30 days later in case an account wasn't fully offboarded the first time around.

Small Teams Aren't Exempt

There's a common assumption that license audits are only worth doing at scale — that a company with 50 or fewer users doesn't have enough licensing surface area for it to matter. That assumption doesn't hold up. Waste tends to scale proportionally rather than disappear at small headcounts, which means even a 10-person organization can be carrying a meaningful percentage of unnecessary licensing cost.

Which Tools You'll Actually Need

There are three practical ways to gather the data behind an audit: the Microsoft 365 admin center through a browser, PowerShell via the Microsoft Graph module, and third-party reporting tools. None of them is strictly required — which one makes sense depends on your comfort level with scripting and whether you want the process automated going forward.

The admin center is the most approachable starting point for a one-off review. PowerShell is worth the setup time if you plan to repeat this process regularly, since the reporting can be scripted and scheduled. Third-party tools tend to close the gaps — particularly around historical sign-in data — that the native admin center doesn't expose without additional licensing.

The Security Angle People Forget

It's easy to frame a license audit purely as a cost exercise, but there's a security dimension that deserves equal attention. An inactive account that still has an active license is also an account that still has an active sign-in path into your environment. If that account belonged to a former employee or contractor, it's a live credential nobody is watching — exactly the kind of gap that shows up in breach post-mortems.

Treating the audit as a joint IT-and-security exercise, rather than a finance-driven cost cut, tends to produce better outcomes. It also gives the process more institutional weight, since "we found a lingering admin credential from a contractor who left eight months ago" tends to get budget approval faster than "we could save a few hundred dollars a month."

Common Mistakes That Undo the Savings

A few patterns show up repeatedly in audits that don't stick:

• Removing a license without checking dependencies. Planner boards, shared Forms, and retention policies can all break silently when a license disappears, and the resulting support tickets can outweigh the savings.
• Skipping the retention step. Converting a mailbox to shared without first confirming a retention policy is active risks losing data the business still needs.
• Downgrading without a heads-up. Even a well-justified downgrade causes friction if the user finds out by losing access unexpectedly instead of hearing about it in advance.
• Treating it as a one-time project. Licensing waste re-accumulates continuously as people join, leave, and change roles, so a single audit only produces savings until the next hiring cycle.

Avoiding these isn't complicated, but it does require treating the audit as a process with steps in a specific order, rather than a quick pass through a spreadsheet.

Frequently Asked Questions

Does a license audit require downtime? No. Everything described here is read-only reporting until you actually choose to remove or change a license, and even then the recommended sequence (retain data, then convert mailbox, then remove license) is designed to avoid any disruption.

Can this be automated? Largely, yes. Once the PowerShell scripts are in place, the reporting steps can be scheduled to run on a recurring basis, turning a quarterly manual project into something closer to a standing dashboard.

What if we don't have a Microsoft Entra P1 license? Some sign-in activity data — particularly historical last-login timestamps — isn't exposed through the free tier of Entra ID. In that case, a third-party reporting tool is usually the fastest way to fill the gap without purchasing additional licensing just to run the audit.

Putting It Together

None of these five areas is complicated in isolation, but the combined effect of checking all five, consistently, on a schedule, is where the real savings come from. Independent research on this has found that businesses routinely leave a significant chunk of their Microsoft 365 spend — often somewhere around a fifth of the total budget — sitting in unused or underused licenses. That's a large enough number that a single quarterly audit can easily pay for the time it takes.

If you want the fully detailed, step-by-step version of this process — including the exact PowerShell scripts, admin center screenshots, and a walkthrough of the third-party audit tooling — Gitbit's original guide is the most complete resource I've come across on the topic, and it's what this article is based on. You can read the full guide here: Microsoft 365 License Audit: Step-by-Step Optimization Guide.

Final Thoughts

A Microsoft 365 license audit isn't a one-time cleanup project — it's a recurring habit that keeps licensing costs proportional to actual usage instead of historical headcount. Start with the disabled and inactive accounts, since those are the easiest wins with the lowest risk. Then work through over-licensing, unassigned seats, and billing terms once you have a rhythm going. None of it requires exotic tooling, just a consistent schedule and a willingness to check the numbers instead of assuming everything's fine.