Reduce Microsoft 365 licence costs: stop paying for accounts nobody uses

An unused account is not always a redundant account. So look at both activity and the current HR data.

You have three sources, and you need all three: what you have bought, who uses something, and when someone last signed in.

1. 1What you have: Billing > Licenses in the Microsoft 365 admin center shows per product how many licences you have and how many are assigned. You pay for the difference without anyone using it.
2. 2Who uses it: Reports > Usage shows the activity per service over 7, 30, 90 or 180 days. The Active Users report gives the last activity per user in Exchange, OneDrive, SharePoint and Teams. By default you see codes there instead of names; a Global Administrator changes that via Settings > Org Settings > Services > Reports. That change is recorded in the audit log.
3. 3When someone signed in: in the Entra admin center, add the Last interactive sign-in time column under Users and filter on a date. Through Microsoft Graph this is signInActivity on the user object.

Connect-MgGraph -Scopes "Reports.Read.All"

Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/reports/getOffice365ActiveUserDetail(period='D90')" -OutputFilePath ".\actieve-gebruikers-90d.csv"

Import-Csv ".\actieve-gebruikers-90d.csv" |
  Where-Object { $_."Has Exchange License" -eq "True" -and -not $_."Exchange Last Activity Date" -and -not $_."Teams Last Activity Date" } |
  Select-Object "User Principal Name", "Assigned Products"

Connect-MgGraph -Scopes "User.Read.All","AuditLog.Read.All"

$grens = (Get-Date).AddDays(-90)

Get-MgUser -All -Filter "userType eq 'Member'" -Property DisplayName, UserPrincipalName, AssignedLicenses, SignInActivity |
  Where-Object { $_.AssignedLicenses.Count -gt 0 -and $_.SignInActivity.LastSuccessfulSignInDateTime -lt $grens } |
  Select-Object DisplayName, UserPrincipalName, @{ n = "Laatst"; e = { $_.SignInActivity.LastSuccessfulSignInDateTime } }

This is the quickest win, because there is no debate about it: an account that cannot sign in does not use the licence. Do watch the exceptions. A converted shared mailbox over 50 GB, or with a hold, needs the licence. The same goes for a mailbox you keep with litigation hold. Before you remove the licence from an employee who has left, read what happens to the mailbox and OneDrive in removing licences when employees leave.

Connect-MgGraph -Scopes "User.Read.All","Organization.Read.All"

$skus = Get-MgSubscribedSku -All

Get-MgUser -All -Filter "accountEnabled eq false" -Property DisplayName, UserPrincipalName, AssignedLicenses |
  Where-Object { $_.AssignedLicenses.Count -gt 0 } |
  Select-Object DisplayName, UserPrincipalName,
    @{ n = "Licenties"; e = { ($_.AssignedLicenses | ForEach-Object { $id = $_.SkuId; ($skus | Where-Object SkuId -eq $id).SkuPartNumber }) -join ", " } }

A colleague in the office works differently from someone on the shop floor. The right licence follows the work, not a standard package for everyone.

The second saving is in the type of licence. Microsoft 365 has roughly three families, and you may mix them in one tenant. What matters is that you choose per type of employee, and that the choice moves along when someone changes role.

A few rules of thumb that work in practice. Do not give everyone the same licence because that is easy in the onboarding form. Before a move to F3, check in the Microsoft 365 Apps usage report whether someone really uses the desktop apps. And record the choice against the role, not the person; otherwise you forget it at the next change of role.

With seasonal work and agency staff the leak is in two places. The first is freeing up licences: at the end of the season twenty people leave at once, and the clean-up gets pushed back until there is time. The second is the subscription itself. Removing a licence from a user frees it up for the next person, but does not lower the bill. For that, you have to reduce the number of licences in the subscription.

• You cannot reduce while all licences are assigned. Remove them first, then lower the number.
• Reducing is not always possible. Under a Microsoft Customer Agreement you can only remove licences within seven days of buying or renewing; after that the change only takes effect on the renewal date. If you buy through a partner, the arrangements with that partner apply.
• So plan around the renewal date. If you know the season ends in October, make sure the licences have been removed by then and that the number in the subscription matches.

How an agricultural services company with seasonal work solved this, you can read in the agricultural services company's customer story.

If you put all licences right today, they can be wrong again in three months. New employees, changes of role and leavers keep changing things.

Everything above looks back. A report shows which licences went unused over the last 90 days; you have already paid for those 90 days. After a clean-up it builds up again, because the cause is not in Microsoft 365: leavers and changes of role reach IT late or not at all, and the choice between F3 and E3 hangs on a person instead of on a role. The saving that lasts is therefore in the moment of assigning and removing. For MSPs who do this for several customers, the approach is in Microsoft 365 licences for MSPs.