The Microsoft 365 licences you are paying for and nobody is using

Three numbers should match. In most small businesses, they don't.

The first is how many Microsoft 365 licences your invoice charges you for. The second is how many are assigned to an actual person. The third is how many of those people have opened anything at all in the last month. Nobody checks the third one, because the screen that shows it arrives with every name blanked out.

Start with the invoice, not the admin centre

Open the bill first. Not the dashboard, the bill. You want the line items, the quantity on each one, and the renewal date, because everything else in this job depends on that date.

Then go to Billing, then Your products. Each subscription gets its own row, with what it costs and how many licences it carries. Add the quantities up and compare them against the invoice. If those two disagree, stop and work out why before you touch anything else.

What people usually find at this stage is not fraud or a billing error. It is history. Somebody bought five licences for a project in 2023. Two of them were never used. A second subscription got added later for a team that needed a different plan, and the original never got trimmed. Nobody was careless. There just was not a moment where anyone was responsible for asking.

The Licences page quietly adds things together

Billing, then Licenses, is the screen that shows assigned against available. It is also the screen with a trap in it, and Microsoft documents the trap themselves.

That page can show you an aggregate total for every subscription with the same product name. Their own worked example: one subscription with five licences of Microsoft 365 Business Premium, another with eight, and the Licenses page says you have thirteen. One number, two contracts, two separate renewal dates, and quite possibly two different prices per seat. Your products is the page that splits them apart again.

One more thing that hides people. Where a licence is assigned through a group rather than to a person, the list shows the group name, not the members. You have to go to Teams and groups, then Active teams and groups, to see who is actually receiving it. A group with an old dynamic rule on it will happily hand licences to people nobody has thought about in two years.

The report that knows who never logs in, and won't tell you

This is the useful one. Reports, then Usage, then Microsoft 365 apps, then the Active users tab.

The per-user table carries a last active date for Exchange, OneDrive, SharePoint and Teams, and separately the date each licence was assigned. Those two columns together are the whole audit. A licence assigned in March with no activity since is not a training problem. It is a subscription you are renting for nobody.

You can look back over 7, 30, 90 or 180 days, and there's an Export button that drops the lot into a spreadsheet, which is where this work actually gets done. Two caveats from Microsoft's own page: the data runs up to the last 24 to 48 hours rather than being live, and if you click into a specific day the table shows up to 28 days from today rather than from the day you clicked.

Now the part that stops most people. By default, user-specific information like usernames, display names, groups and sites is hidden in usage reports. Every row is anonymised. You can see that four people have not touched anything since spring, and you cannot see which four.

A global admin can turn the names on in the admin centre's org settings. Before you do, have the conversation with whoever owns data protection in your business, because you are enabling a screen that names staff and reports what they did and did not open. There is a legitimate business reason for it, that reason is licence management rather than performance monitoring, and it is worth being able to say so out loud. We are an IT company, not a law firm, and we won't pretend to sign that decision off for you.

Seven days, and then the door shuts

Here's where the money goes. You have found four dead licences. You go to remove them. You cannot.

On a Microsoft Customer Agreement billing account, Microsoft's documentation says you can only remove licences from a subscription within seven days of buying or renewing it. After that, the reduction lands on the first invoice following your renewal date. Seven days out of 365. Buy extra licences mid-term and the same seven-day clock runs from the day you bought them.

The related trap is the one people argue with us about most: paying monthly is not the same as committing monthly. Microsoft's cancellation page says that if you have an annual subscription and are paying monthly, you are charged each month for the remainder of the term. Monthly payments, annual commitment.

Four smaller rules worth knowing before you try:

• You cannot reduce the licence count while every licence is assigned to somebody. Unassign first, then remove.
• Removing licences only works while recurring billing is switched on.
• A prepaid subscription, the kind activated with a 25-character product key, cannot have licences removed at all. Your only route down is renewing with a key for fewer.
• If you bought through a reseller or a Cloud Solution Provider, the buttons are greyed out by design. That change goes through your partner.

None of this means the audit was wasted. It means the audit has a deadline. Find your renewal date, work backwards, and do this in the fortnight before it rather than the week after.

The licences your staff bought without asking

Most owners have no idea this is possible. A member of staff can buy certain Microsoft subscriptions on their own card, inside your tenant, with no admin approval at any point.

They show up under Billing, Your products, with the filter set to Self-service. Microsoft's admin guidance is direct about what you can and cannot do with them: an admin cannot assign or unassign licences for a subscription a user bought. You have to use Take control of this subscription first. From there you either move those people onto licences you already own and cancel the original, or cancel it outright and take the licences off.

Turning the behaviour off is fiddlier than it should be, and the documentation admits it. Self-service purchases and trials cannot be completely switched off at tenant level with a single command. The policy is per product, every new product ships with self-service allowed by default, and a change can take up to 72 hours to apply. There's an Org settings page for it and a PowerShell module if you have a long list.

Worth knowing what happens if nobody notices: a self-service purchase requires a payment method at sign-up and renews automatically. Some trials convert straight to paid when they end. The person's card keeps paying until somebody looks.

What actually breaks when you strip a licence

Say you have found a genuinely unused licence and you can remove it. Careful with the order.

Take the licence off a user and the Exchange Online data on that account is held for 30 days, then deleted for good. OneDrive behaves differently: those files stay until the user account itself is deleted. And the one that catches compliance people out, straight from Microsoft's page on unassigning licences: once the licence is removed, that mailbox is no longer searchable using an eDiscovery tool such as Content Search. If you might need to search it for a dispute, an insurance claim or a subject access request, deal with that before the licence comes off, not after.

Deleting the user account, by contrast, frees the licence immediately for someone else. That is the fast route when the person has genuinely gone and their data is already handled. It is the wrong route when nobody has checked what was in their OneDrive.

Leave the licence off an account whose owner still uses the desktop apps and they will get activation errors in Word and Outlook. Obvious in hindsight. Less obvious at four o'clock on a Friday when you were tidying a spreadsheet.

Leavers are where the waste starts

Almost every dead licence we find traces back to somebody who left. The account got disabled, which felt like the job was done, and the subscription kept billing because disabling an account and releasing its licence are two unrelated actions.

There is a proper sequence for this and we wrote it up separately in what has to be switched off when someone leaves. The licence step belongs at the end of it, after the mailbox has been dealt with, not at the start when it is cheapest to remember.

If you are choosing between plans rather than counting them, Standard versus Premium covers what the extra money buys. And if you are moving into Microsoft 365 in the first place, what actually moves is the one to read before you book a date.

Cancelling the whole thing has its own rules

Sometimes the answer is not fewer licences but no subscription. Two details from Microsoft's cancellation page that people hit at the worst moment.

A subscription with more than 25 licences cannot be cancelled online at all until you reduce it to 25 or fewer, which drops you straight back into the seven-day problem above.

And the data timing is sharper than most people expect. Customer data left behind might be deleted after 30 days, and is deleted no later than 180 days after cancellation. Worse, if you explicitly delete a subscription rather than letting it expire, it skips the Expired and Disabled states entirely and SharePoint and OneDrive content goes immediately. Get the data out first. There is no undo on that one.

What we charge for this, and what we don't

Licence management sits inside our managed IT plans, which are 50, 77 and 108 pounds per user per month excluding VAT. Off a plan, an audit is hourly: 126 pounds an hour with no contract, 86 for contract clients. Related project work has published rates on the pricing page as well, including 77 per mailbox for a Microsoft 365 migration and 162 per server per month for server management.

What we do not do is take a cut of your licences. They are supplied at list price and managed on your behalf, with no markup, which is set out on our cloud and Microsoft 365 page. That arrangement is the reason we can tell you to cancel four seats without checking our own numbers first.

An hour's work, in order

Do it in this sequence and it really is about an hour for a business of twenty people.

Find your renewal date on the invoice. Export the Active users report over 90 days, with the names switched on. Line the export up against Billing, Your products, subscription by subscription rather than in one lump. Filter Your products to Self-service and see what turns up. Mark every licence with no activity since it was assigned, check whether the mailbox behind it needs preserving, and only then unassign and remove, inside the seven days around renewal.

If the renewal is months away, do the audit anyway and put a reminder in the diary two weeks before. The finding does not expire. The chance to act on it does.