Your Microsoft 365 License Bill Is Probably Wrong. Here's Where the Money Hides.

Pull up your Microsoft 365 admin center. Look at the assigned-licenses count. Now look at the active-users count for the last 30 days. Subtract. The number you just got is the floor of your license waste, not the ceiling.

The dashboard tells you what's assigned. It doesn't tell you what's actually being used, what's misaligned to the wrong tier, or what's still billing for someone who left in February. Most license bills have three categories of leakage running simultaneously, and they compound. Here's where they live.

Why this matters more in 2026 than it did a year ago

Three things changed in the last twelve months, and most companies are still adjusting.

First, Microsoft raised commercial prices across the M365 lineup in mid-2025 and again at the start of 2026. The waste that was a $200/month annoyance in 2024 is a $400/month annoyance now. Same waste, twice the bleed.

Second, Copilot licensing complicated the picture. Copilot for Microsoft 365 is a $30/user/month add-on with its own seat math, and it stacks on top of E3 or E5. Tenants that rolled it out broadly in early 2025 now have a year of usage data. Most of them are paying for licenses that nobody opened past month two.

Third, cyber insurance audits started checking license posture. Carriers want to see that user count matches license count, that offboarding actually deactivates accounts, and that shared-login situations are documented. Sloppy license hygiene now affects renewal pricing on the policy, not just the M365 invoice.

The fix isn't more vigilance from your IT team. The fix is fewer leak points, audited quarterly.

The three leak categories

Every wasted M365 dollar I have seen at a customer falls into one of three buckets. They are independent, which means most companies are bleeding from all three at once.

1. Wrong tier per user. The classic version is E5 across the board for a 50-person company where 35 of them only use Outlook, Word, and Teams. Those 35 should be on Business Premium or E3. The premium-feature spread between E3 and E5 (Defender for Office 365 P2, Audit Premium, Insider Risk Management, Customer Lockbox, Information Protection scanner) is real and worth paying for, but it is not worth paying for on every receptionist. The inverse mistake also happens: putting everyone on a low tier and then buying point-product add-ons (Defender, Intune, AIP) that re-create most of E5 at higher total cost. Map roles to tiers, then resize.

2. Hygiene gaps. Three sub-leaks in this bucket. (a) Offboarding doesn't reclaim licenses -- the marketing manager who quit in February still shows up in your assigned-license count in November because nobody removed her seat. (b) Role changes don't trigger re-licensing -- the designer who moved to operations still has a Project Plan 5 license she hasn't opened since the transition. (c) Temporary licenses for a one-off contractor or seasonal project never get reclaimed when the project ends. Each individual leak is small. Compound them across a year and a 100-user tenant is paying for 8-15 ghost seats by Q4.

3. Reactive procurement. This one is structural. When new projects need licenses immediately, somebody buys whatever's quickest at full retail price. When the renewal email arrives 14 days before expiration, somebody clicks accept rather than negotiate. Both of these are 10-30% more expensive than the same purchase planned 60-90 days out, where you can compare add-on bundles, true up properly, and use a Pax8 or CSP partner to get partner-tier pricing on the right SKUs. The waste here is a procurement-process problem dressed up as a licensing problem.

If you have a license-optimization platform (CoreView, Octiga, Argon, etc.), it surfaces #1 and #2 automatically. If you don't, the manual fix is a quarterly review. Either way, ignoring all three buckets is the most common state I find when auditing a tenant for the first time.

Where the audit actually lives

The fastest way to estimate your total leak is a forty-five-minute spreadsheet exercise. Pull three things and put them side by side.

Column 1: Active users last 30 days. From the Microsoft 365 admin center -> Reports -> Usage -> Active users. Filter to people who logged into a service in the last month. This is your real headcount in M365 terms.

Column 2: Assigned licenses. From Billing -> Licenses. Count of seats per SKU.

Column 3: Last sign-in per user. From Microsoft Entra (Azure AD) -> Users -> filter by last interactive sign-in. Anyone with no sign-in in 60 days is suspicious. Anyone with no sign-in in 90 days is almost certainly a candidate for license removal.

Subtract Column 1 from Column 2. That is your minimum waste in seats. Multiply by your per-seat cost. That is the floor of what you are spending on nothing. Most tenants land on something between 6% and 15% of their total M365 spend showing up here.

The exercise also surfaces the inverse: people who are signing in heavily but have a tier that limits their tools, which is usually a productivity drag worth a tier upgrade for those specific people.

The trade-offs nobody wants to talk about

Three real trade-offs come up every time we run this exercise with a customer.

E3 + add-ons vs. E5. The break-even is around 200 users for most security-conscious tenants. Below that, E3 + the Information Protection and Governance add-on + Defender P1 often pencils out cheaper than E5 across the board. Above that, E5 starts winning because of the bundled extras. Run the math on your actual headcount, not the marketing chart.

License-optimization platform vs. quarterly manual review. Platforms cost $1-3 per user per month. A quarterly manual review costs your IT lead about a day per quarter. For a 50-user tenant, the platform is hard to justify. For a 250-user tenant, the platform pays for itself in the first quarter. The cutoff is usually around 100-150 users, depending on how messy the existing license assignment is.

MSP-managed vs. in-house. This one is honest: a managed services provider with a real M365 practice will absorb licensing audit and optimization as part of their normal work, AND get you partner pricing on the SKUs themselves. In-house is fine if you have a dedicated IT lead with bandwidth for the quarterly review. It tends to fall apart when the same person is also putting out fires.

Skai would point out that none of this matters if the people doing the work don't know what their license actually entitles them to. She is, as usual, right. A surprising amount of "we need to buy a thing" turns out to be "we already own that thing and didn't know."

What to check this quarter

If you do nothing else from this article, do the spreadsheet exercise above on the next rainy Friday. The columns are sitting in your admin center, waiting. Forty-five minutes of work usually surfaces a five-figure annual leak in tenants over fifty users.

The license dashboard says everything is fine. The dashboard is wrong. The auditor is going to find what you did