How to Audit Your Microsoft 365 Licences Before the Renewal Bill Arrives

A Microsoft 365 licence audit reconciles three numbers, and all three sit in the Microsoft 365 admin centre. How many licences your subscription is billing for. How many of those are assigned to a person. How many of those people have shown any activity at all in the last ninety days. The gap between the first number and the third is what you are paying for and nobody is using, and the reason to close it before your subscription renews is that Microsoft ties your ability to reduce the count to the renewal date.

If nobody has done this at your place, that is not negligence. It is a job that belongs to nobody. Finance owns the invoice and cannot see inside the tenant. The provider can see inside the tenant and does not own the invoice. So the seat count drifts upward one starter and one leaver at a time, and the only moment anyone looks at the total is the moment it renews for another year.

The reality is that the window to act on what you find is narrower than people expect, and it depends on how you bought the subscription in the first place. Microsoft documents that for a Microsoft Customer Agreement billing account you can only remove licences within seven days of buying or renewing, and only while recurring billing is turned on. Miss that, and the reduction does not show up until the first invoice after the next renewal date. Same work, twelve months later in the bank account.

Below are thirteen steps in four phases: the two dates to establish first, the three screens to pull, the four findings worth chasing, and the access work that rides along with all of it. Every path and every rule comes from Microsoft's own documentation, and the one piece of Australian guidance is the Australian Signals Directorate's, not a vendor's.

TL;DR: What to check before you renew

• ✅ Find your renewal date and your billing account type first. On a Microsoft Customer Agreement account, licences can only be removed within seven days of a purchase or a renewal.
• ✅ Three screens do the whole job: Billing then Licenses, Users then Active users, and Reports then Usage then Microsoft 365 apps. The last one exports to a spreadsheet.
• ✅ Four findings pay for the exercise: unassigned licences, assigned licences with no activity behind them, mailboxes that may never have needed one, and people carrying two plans that do the same job.
• ✅ An unassigned licence is only money. An assigned licence with nobody behind it is money and a live account, which is why this is a security job wearing a finance job's clothes.

Contents

• First, find the two dates that decide whether this is worth doing
• Pull the three screens and put them side by side
• Now find the seats that should not be there
• The half your licensing bill will not show you
• Licence questions finance teams ask before a renewal

First, find the two dates that decide whether this is worth doing

Start here, because these two facts decide whether the rest of the exercise saves money this financial year or the next one. One is your renewal date. The other is the type of billing account the subscription sits on, which is the thing that governs what you are allowed to do and when. Microsoft's own instructions for changing a licence count open by telling you to find that out first, which tells you how much rides on it.

1. Find the renewal date and the billing account type

Both live under Billing in the Microsoft 365 admin centre. Open Your products, select the subscription, and read the renewal date off the subscription details page. Then check which billing account type you are on, because the removal rule differs. On a Microsoft Customer Agreement account, Microsoft states that licences can only be removed within seven days of buying or renewing the subscription. Write the renewal date on the calendar of whoever approves the spend, not just on the IT person's.

2. Check recurring billing, the purchase channel and who holds the role

Three things can quietly stop you acting on what you find. Licences can only be removed while recurring billing is turned on. A prepaid subscription, the kind activated with a product key, cannot have licences removed at all, and reducing it means renewing with a smaller key. And if the purchase channel says Reseller, the buttons are unavailable to you because the change is made by the Cloud Solution Provider partner who sold it.

That last one is worth a plain word, because plenty of Australian small and medium businesses buy their Microsoft licences through their IT provider rather than direct, and there is nothing wrong with it. inSUPPORT sells it that way, on the live support pricing page, as an extra that uses its Microsoft Cloud Services accreditation to unlock additional discounts. What it means for this exercise is that the reduction is a phone call rather than a button, so allow time for it and ask for the change in writing.

It also puts you under a different rule, and this is the one more likely to apply to you than the direct one. Under Microsoft's new commerce terms for partners, the number of licences on a subscription can be decreased only within the first seven days of when those licences were added, and that applies whether they were added at the initial purchase, on renewal, or midterm. After that, Microsoft's documentation is blunt: the count cannot be decreased until the next cancellation window at renewal. So the two paths have the same shape and different plumbing, and you need to know which one you are on before you plan anything.

Then check who can actually do the work, because two different sets of permissions are involved and people conflate them. Changing the number of licences on the subscription is governed by your billing account type: on a Microsoft Customer Agreement you need to be a billing account owner or contributor, or a billing profile owner or contributor, and on a Microsoft Online Subscription Agreement you need at least a Billing Administrator. Assigning and unassigning licences to people is separate, and sits with the global, licence and user admin roles. Hold only one half of that and you will reach the end of the analysis unable to execute it.

Pull the three screens and put them side by side

The whole reconciliation is three exports and one spreadsheet. Microsoft describes the point of its usage reports in words a finance team would not think to expect from a licensing vendor: you can see who uses a service to the fullest extent, and who barely uses it and might not need a Microsoft 365 licence. The data is sitting there. Almost nobody opens it between renewals.

3. Take the licence count

Billing, then Licenses. This is the number the invoice is built from, and it shows you assigned and unassigned licences for each subscription you hold. Note them per product, not as one total, because the finding you are hunting often sits inside one plan while the others are tidy. If the unassigned column has anything in it at all, you have already found money.

4. Take the people list

Users, then Active users. This tells you who in your directory is licensed, who is unlicensed and who is a guest. It is the human side of the same question, and it is where names that should have gone months ago tend to surface. Read it with your payroll list open beside it, because that comparison takes ten minutes and answers a question no report can answer on its own.

5. Take the usage export

Reports, then Usage, then Microsoft 365 apps, then the Active users tab. This is the one that does the real work, and Microsoft says plainly that it exists to help identify underutilised products. Run it over 90 or 180 days rather than 7 or 30, because a fortnight of leave is not evidence of a dormant account. Then select Export and take the lot into a spreadsheet.

What comes back is a row per person with the last active date for Exchange, OneDrive, SharePoint, Teams and Viva Engage, whether a licence for each is assigned, and the date each licence was assigned. Two columns in that export do most of the arguing for you. A licence assigned eighteen months ago with a blank last active date is not a judgement call. Worth knowing before you panic at a gap: the reports usually become available within 24 to 72 hours, so a seat created this week will look emptier than it is.

6. Decide about names before you unconceal them

By default these reports hide usernames, display names, groups and sites. That is not an obstacle Microsoft forgot to remove. Its documentation says the concealment is there to help organisations support local privacy laws, a global administrator can switch it off under Settings, Org Settings, Services, Reports, and switching it off is itself a logged event in the Microsoft Purview audit log.

So treat it as a decision rather than a step. Name who asked for the identifiable view, why, and for how long, and turn the concealment back on when the exercise is done. On a business whose whole argument to its customers is that it handles personal information properly, doing a cost exercise by quietly unmasking every employee's activity history is a poor look, and it is the kind of detail a board remembers.

Now find the seats that should not be there

Four categories account for almost every difference between a headcount and a licence count. None of them requires technical judgement to spot. All of them require somebody to look, which is the part that has not been happening.

7. Licences attached to nobody

Unassigned licences are the simplest finding and the most common. They are seats bought for a hiring plan that changed, or left behind when somebody was deleted rather than replaced. You are billed for them exactly as if a person were using them. Before you cut them, ask one question: is anyone starting in the next month, because a small buffer on purpose is a different thing from a buffer nobody chose.

8. Licences attached to somebody who is not there

These are the rows with a licence assigned and no activity behind them across the whole period. Some are departures nobody closed off. Some are real people who genuinely do not use the product they are licensed for. The two need different handling, and the difference matters more than the money, which is the subject of the last phase below.

Microsoft's documentation carries a warning that catches people who tidy up first and check later: when you delete a user account, that user's usage data is deleted within 30 days. Run and keep your export before you start deleting accounts, or you will lose the evidence that justified the decision.

9. Mailboxes that may never have needed a licence

A shared mailbox can store up to 50 GB of data without a licence assigned to it, and room and resource mailboxes work the same way. Accounts and orders@ and the boardroom calendar frequently end up holding a full user licence because that is how somebody set them up years ago and nobody revisited it. This is often the quickest win on the list.

Check the exceptions before you strip anything, because Microsoft lists several and only one of them is about size. Going past 50 GB needs an Exchange Online Plan 2 licence. In-place archiving needs Plan 2, or Plan 1 with an Exchange Online Archiving add-on. Putting a shared mailbox on litigation hold needs the same. Advanced features such as Microsoft Defender for Office 365, Microsoft Purview eDiscovery Premium or retention policies may require licences of their own. A 12 GB mailbox sitting on litigation hold is licensed for a reason, and pulling that licence to save a line on the bill is a far more expensive mistake than the licence was.

One more thing worth doing while you are in there, and it costs nothing. Microsoft's guidance is that a shared mailbox is not intended for direct sign-in using its own account, and that you should always block sign-in for that account and keep it blocked. Check that it is blocked. A mailbox account nobody watches is exactly the kind of thing this exercise is good at finding.

10. People carrying two plans that do the same job

Licences can be assigned across more than one subscription, which is useful and is also how duplicate cover happens. A standalone product bought for one team, a plan added during a project, a suite that already included the thing the standalone was bought for. Sort your export by person and look for anyone carrying two.

Then check plan fit against your size, which is a different question from plan fit against your needs. Microsoft documents Microsoft 365 Business Premium as being for businesses with up to 300 users, and that ceiling is the same band a lot of Australian managed IT is built around: roughly 30 to 300 people. If you are approaching it, that is a conversation to have before a renewal rather than during one. And do not downgrade on price alone. The security capability inside the higher plans is what a good deal of remediation work actually runs on, so cutting a plan tier to save a line on the bill can quietly remove a control you were relying on.

The half your licensing bill will not show you

Everything above is a cost exercise. It is also, without changing a single step, an access review, and that is the half a licensing invoice is structurally incapable of showing you. Be precise about which finding does that work, because the two look alike on a spreadsheet and are not alike at all. An unassigned licence is money and nothing else: no person, no account, nothing to sign in to. An assigned licence with no activity behind it has a user account underneath it, and unless somebody blocked sign-in when that person left, it still exists, still authenticates and still reaches whatever it reached the day it was set up.

11. Read the dormant list as an access list

Australian guidance puts numbers on this. The Australian Signals Directorate's Essential Eight maturity model requires, at Maturity Level Two, that privileged access to systems and applications is disabled after 45 days of inactivity, and that privileged access to systems, applications and data repositories is disabled after 12 months unless it is revalidated. Your list of assigned licences with no activity behind them is the closest thing to a free first draft of that review, and you already have it open. Keep it somewhere you can find it, too, because the same list is the first thing worth checking before you switch on an assistant like Microsoft 365 Copilot: an assistant inherits whatever access the person using it already has, so an account nobody has looked at in a year becomes a great deal more interesting the day it can be asked questions.

Two boundaries, stated plainly. The Essential Eight is a minimum set of preventative measures, organisations choose a target maturity level suited to their own environment, and ASD is explicit that there is no requirement to have an implementation certified by an independent party. It is a baseline you work to, not a certificate you hold.

Framework guidance moves, and a contract written against a stale version is worse than no contract at all. ASD updates the maturity model regularly, and it has consulted on evolving the Essential Eight into a broader Essentials series, with that consultation closing on 12 July 2026. No changed requirement has been published, so the current maturity model still governs and ASD's own position is that existing controls and investments align with the proposed direction. Check the current version before you write a requirement into a contract. This article was accurate at its publication date.

12. Unassign before you try to remove

Microsoft's rule is sequential and people hit it in the wrong order. You cannot reduce the number of licences on a subscription while every licence is assigned to a user. Unassign first, from the users you have decided on, and then remove the licences from the subscription. Doing it the other way around produces a greyed-out button and a support ticket.

13. Make the change inside the window, or schedule it

Now the dates from phase one earn their place. If you are inside the seven days after a purchase or a renewal on a Microsoft Customer Agreement account, make the reduction now. If you are outside it, Microsoft's documentation says the change appears on the first invoice you receive after the subscription renewal date, and with recurring billing turned on you can choose to schedule the change to happen when the subscription renews rather than trying to remember in eleven months.

If you buy through a partner, there is a specific thing to ask for at this point rather than a general one. Microsoft's partner portal gives them a View licenses to reduce screen that returns how many licences can be reduced on a subscription and the deadline by which the reduction has to happen. Ask for that screen rather than asking whether anything can be done, because it has a date in the answer.

Then write down what you decided not to cut and why. A buffer you chose is a budget decision. A buffer nobody chose is just a bill. That written record is also the thing that makes next year's version of this exercise take an afternoon instead of a fortnight, and it is one of the twelve questions worth asking at a provider renewal: can you show me our documentation right now, without preparing it first.

One last framing, because the Microsoft numbers a provider puts in front of a board have a habit of being mistaken for a verdict. A clean licence position is not a security position, in the same way that what Microsoft Secure Score does and does not tell you is not a measure of how likely you are to be breached. Both are worth knowing. Neither reaches the unsupported server in the back office. If you want the licensing work handled alongside the rest, Microsoft 365 licensing and optimisation is listed on the services page as one of the things that runs inside the same model, next to the support fee itself, which starts at $68 per user per month for business hours, with insurance, backup and security awareness quoted as separate line items.

Licence questions finance teams ask before a renewal

How often should we run a Microsoft 365 licence audit?

Twice a year, and anchor it to the renewal rather than to the calendar. Doing the full reconciliation six to eight weeks before the subscription renews leaves time to unassign, argue about the borderline cases and get a reseller to action the change. In between, a one-minute look at the unassigned count under Billing, then Licenses catches most of the drift. The rest is just keeping the leaver process honest.

Should our IT provider be doing this for us?

Most of it, yes, and it is fair to ask why it is not already happening. Worth understanding the incentive before you judge the answer: if your provider resells your Microsoft licences, a smaller seat count is a smaller margin for them, so the exercise is one they have to choose to run. A good provider runs it anyway and brings you the list. What you should not accept is a monthly report that shows usage going up and never shows what is sitting idle.

How long does it take, and what is a realistic result?

The exports take an hour. The arguing takes longer, because deciding whether a quiet licence belongs to a departed staff member, a light user or a genuine need is a business question rather than a technical one. Be careful about what you expect: the saving is whatever your own numbers say it is, and anyone quoting you a percentage before they have opened your tenant is guessing. The more reliable result is that you stop paying for a headcount you no longer have.

Where do we start if nobody has ever done this?

Start with the two dates, because they decide whether this month or next month is the right month. Then pull the three screens in the order above and get the usage export into a spreadsheet before you change anything, since deleting accounts first destroys the evidence. If the environment is large enough that a spreadsheet stops being the right tool, that is the point to get somebody to look at the whole environment rather than just the bill.

Sources

• "Buy or remove licenses for a Microsoft business subscription", Microsoft Learn. The source for the seven day removal window on a Microsoft Customer Agreement billing account, the requirement that recurring billing be turned on, the rule that you cannot reduce a count while every licence is assigned, the reseller and prepaid exceptions, and the statement that a later reduction appears on the first invoice after the renewal date. Read 18 September 2026. learn.microsoft.com
• "Microsoft 365 admin centre usage reports", Microsoft Learn. Where the usage reports live, the 7, 30, 90 and 180 day periods, the 24 to 72 hour availability lag, the Billing then Licenses and Users then Active users paths, the default concealment of user names to support local privacy laws and the fact that revealing them is logged in the Purview audit log, and the 30 day deletion of a deleted user's usage data. Read 18 September 2026. learn.microsoft.com
• "Microsoft 365 apps Active users report", Microsoft Learn. The report path, its stated purpose of identifying underutilised products, the per-user columns for last active date and licence assign date across Exchange, OneDrive, SharePoint, Teams and Viva Engage, and the CSV export. Read 18 September 2026. learn.microsoft.com
• "Understand subscriptions and licenses in Microsoft 365 for business", Microsoft Learn. The ability to assign licences across more than one subscription, which is how duplicate cover happens, and the table of which admin roles can assign and unassign a licence. Read 18 September 2026. learn.microsoft.com
• "About shared mailboxes in Microsoft 365", Microsoft Learn. The 50 GB unlicensed storage allowance for a shared mailbox and the full set of scenarios that need a licence anyway: going past 50 GB, in-place archiving, litigation hold, and advanced features such as Defender for Office 365, Purview eDiscovery Premium and retention policies. Also the instruction to block sign-in on the shared mailbox account and keep it blocked. Read 18 September 2026. learn.microsoft.com
• "Create customer subscriptions", Microsoft Learn, Cloud Solution Provider partner documentation. The rule for licences bought through a partner: the number of licences on a subscription can be decreased only within the first seven days of when they were added, at initial purchase, renewal or midterm, and after that the count cannot be decreased until the next cancellation window at renewal. Also the View licenses to reduce screen, which returns the number that can be reduced and the deadline. Read 18 September 2026. learn.microsoft.com
• "Microsoft 365 Business Premium resources", Microsoft Learn. States the plan is for businesses with up to 300 users, which is the seat ceiling referred to above. Read 18 September 2026. learn.microsoft.com
• "Essential Eight maturity model", Australian Signals Directorate. The Maturity Level Two requirements that privileged access is disabled after 45 days of inactivity and after 12 months unless revalidated, the position that the Essential Eight is a minimum set of preventative measures with a target maturity level chosen per environment, and that no independent certification is required. First published June 2017 and updated regularly. Read 18 September 2026. cyber.gov.au
• "Consultation on evolution of Essential Eight", Australian Signals Directorate. ASD's consultation on evolving the Essential Eight into a broader Essentials series, open via the ASD Cyber Security Partnership Program portal and run until 12 July 2026, with the position that organisations already using the Essential Eight can expect strong alignment with their existing controls and investments. Page first published and last updated 15 June 2026. Read 18 September 2026. cyber.gov.au

Related Reading

• IT Support Pricing
• Twelve Questions to Ask Your IT Provider Before You Renew
• What Microsoft Secure Score Does and Does Not Tell You
• Do Not Roll Out Copilot Until You Have Checked Who Can See What
• Managed IT Services

Content reviewed by Probably Genius for accuracy and relevance.

inSUPPORT provides managed IT and cyber security services. It is not an insurer, insurance broker or underwriter and does not hold an Australian Financial Services Licence. Where cyber insurance forms part of a plan, it is arranged through licensed insurance partners and underwritten by the insurer. Cover is subject to the insurer's assessment, the policy terms and the Product Disclosure Statement and Target Market Determination. This article is general information about IT and security practice, not financial product advice, and it does not take account of your objectives, financial situation or needs.