MICROSOFT
Licensing drift: how Microsoft 365 spend grows quietly
5 min read
Microsoft 365 overspend is rarely a purchasing error; it accumulates from licences that stayed assigned after the reason for assigning them ended, which is why the useful review compares bought against assigned against actually used.
Licence spend is one of the few IT costs that grows without a decision. No one approves an increase. The renewal is simply larger than last year's and the explanation is that headcount went up, which is true and incomplete.
The rest of the increase comes from drift: licences that outlived their reason. They are easy to find once you look, and the looking is the part that never gets scheduled.
Three numbers, not one
A licence review needs three figures per SKU and most reviews only produce the first.
- Bought — the subscription count on the bill
- Assigned — the count attached to accounts in the tenant
- Used — the count attached to accounts that actually signed in recently
Where the gaps come from
Bought minus assigned is the simplest gap: licences paid for and attached to nobody. These usually appear after a restructure or a contract renewal that was sized against a headcount forecast rather than the current directory.
Assigned minus used is the more interesting one. These are licences on accounts that exist but are not active — leavers whose accounts were disabled but not stripped, seasonal staff out of season, pilot participants after the pilot ended, test accounts created for a project three years ago.
The tier that was bought for one feature
A recurring pattern: someone needs a single capability, finds it is only in a higher tier, and the whole organisation is upgraded. The capability is then rolled out to one department, or not at all, and the higher tier becomes the new baseline nobody revisits.
This is worth checking specifically, because it is the largest single item in most reviews and the easiest to misjudge. Before downgrading, confirm which features of the higher tier are actually in use — not which were intended to be.
Why downgrades need care
A tier change that looks free on a spreadsheet can remove something load-bearing. Retention policies, archiving, device management, advanced threat protection and data loss prevention all sit at specific tiers, and all of them are invisible until they stop working.
So the sequence is: identify the candidate, list what the higher tier provides that the lower one does not, check each of those against actual configuration and usage, then change a small group first and wait before doing the rest. A downgrade applied to everyone at once is very hard to unpick.
Making the review repeat
A one-off review recovers whatever has accumulated and then the drift starts again. The durable version is a quarterly reconciliation of the three numbers, plus a leaver process that strips the licence rather than only disabling the account.
Neither takes long once the first review has established the baseline. The first one is the slow one, because it is also an inventory of everything nobody has looked at since the tenant was created.
Questions we get asked
How much does a typical licensing review recover?
It varies far too much to quote a figure honestly. What is consistent is where it comes from: unassigned subscriptions, licences on inactive accounts, and a tier bought for a feature that was never rolled out. The size depends on how long it has been since anyone last checked.
When is the best time to review licences?
Well before renewal, not at it. Reviewing under renewal pressure tends to produce a decision about the subscription count rather than about what people actually need, and the usage data takes a few weeks to be worth reading.
Do disabled accounts still consume licences?
Yes. Disabling an account blocks sign-in but does not release the licence, which is why the leaver process should remove the licence explicitly. It is the most common single source of assigned-but-unused licences.