The three places Microsoft 365 spend leaks

01 / 05

A reclaimed licence is a seat, not a saving

Every licence review ends with a list of seats you can take back. What almost nobody mentions is when taking them back turns into money.

For subscriptions billed through a Microsoft Customer Agreement, Microsoft is explicit: you can only remove licenses from your subscription if it's within seven days of buying or renewing your subscription. Partner-bought subscriptions under the New Commerce Experience work the same way — Partner Center doesn't allow license reductions outside that seven-day window, and the window only reopens when the subscription renews into a new term. On an annual commitment paid monthly, you're charged each month for the remainder of your subscription term.

So a seat you free up in month four keeps being billed until renewal. The work still matters: a freed seat can go to your next hire instead of a new purchase. But if the goal is a smaller invoice, the review has to be finished before the renewal window opens, not whenever someone gets round to it. One caveat: Microsoft's instructions for the older MOSA billing account type state no such window, so check which kind of account you are on before planning around it.

02 / 05

Leak one: people who left, but kept their licence

Microsoft's own offboarding guide treats blocking sign-in and removing the licence as two separate steps — step one and step six of seven, with four other jobs in between. Step six is the one that frees the seat: When you remove a license, you can assign it to someone else.

Our reading of that sequence, since Microsoft does not put it in one sentence: blocking an account stops the person, not the bill. When someone leaves in a hurry, step one gets done the same afternoon and step six waits for a quiet week that never comes. Deleting the account does release the licence, but deleted users stay restorable for 30 days — and a restored user gets their licences back even if there are none available.

03 / 05

Leak two: mailboxes paying for a seat they do not need

The usual reason a leaver keeps a licence is their mailbox: somebody still needs the email. Microsoft documents the cheaper route. A shared mailbox can store up to 50 GB of data without assigning a license to it, and its offboarding guide says converting is a less expensive way to go.

There are real exceptions, so check before converting. A shared mailbox over 50 GB needs a licence, and so does one placed on litigation hold — that takes Exchange Online Plan 2, or Plan 1 with the Exchange Online Archiving add-on. If a mailbox is kept for legal reasons, the licence may be the correct cost rather than waste.

04 / 05

Leak three: accounts nobody signs into

The quietest leak is the licensed account with no one behind it: a former contractor, a test user, a shared login from a project that ended. Microsoft records each user's last sign-in, but reading the most useful field, the last successful sign-in, through Microsoft Graph requires a Microsoft Entra ID P1 or P2 license, and the stored value might take up to 24 hours to update.

The admin center's usage reports help, with one surprise: By default, all reports hide user information such as usernames, so a report can tell you twelve people never opened Outlook without telling you which twelve. The setting sits under Settings, Org settings, Services, Reports. Change it only if your privacy obligations allow it.

A fourth suspect, people on a bigger suite than their work needs, is where Microsoft helps least. Its apps usage report shows whether someone uses Word, Excel, Outlook or Teams; it does not show which features of their licence they use. Treat that one as a judgement call, not a report.

05 / 05

Where to start

Find your renewal date first and put the review on the calendar a month ahead of it — that month is our suggestion, not Microsoft's, but it leaves room to convert mailboxes and confirm with managers before the seven-day window. Then work the three leaks in order: leavers still licensed, mailboxes that could be shared, accounts with no recent sign-in.

Disclosure: this is work our service does. Avalon CloudSec maps every licence to a person and their last activity, lists disabled-but-licensed and long-inactive accounts against a 30, 60, 90 or 180-day window, and labels every dollar estimate with its pricing source — Microsoft list price or your own negotiated rate. It is read-only, so it tells you which seats to reclaim and your team reclaims them. If you want that list before your next renewal, email support@awservices.org.

Microsoft, Microsoft 365, Entra and Exchange are trademarks of the Microsoft group of companies. Avalon CloudSec is an independent service and is not endorsed by Microsoft.