The fastest savings in Microsoft 365 come from licenses that nobody uses. They get billed month after month without anyone benefiting from them. The trick is to spot them reliably — without accidentally locking out someone who was simply on vacation.
What "unused" really means
A license can burn money in three ways:
- Unassigned – purchased, but not allocated to any user. Pure buffer that you pay for in full.
- Assigned but inactive – the user never signs in or uses none of the services being paid for.
- Assigned and active, but oversized – the user is working, but only needs a fraction of the plan.
This guide focuses on the first two. For the third case, see E3 vs. E5.
The signals that matter
Microsoft provides the raw data through the usage reports in the Microsoft 365 Admin Center – you just need to bring it together. The most telling signals:
- Last sign-in. The single most important indicator. For inactive accounts in Entra ID, Microsoft recommends a window of 90 to 180 days without a sign-in. Anyone who hasn't signed in for that long is a strong candidate.
- Service usage per workload. Exchange (last mailbox activity), Teams (last activity), SharePoint/OneDrive (last access). A user who shows no signal across any service isn't working from that account.
- Account status. Disabled ("blocked") accounts that still have a license assigned are almost always clear cancellation candidates.
- Available vs. purchased seats. The gap between purchased and assigned licenses reveals the unused buffer immediately.
No single signal is enough on its own. Only the combination separates "truly inactive" from "just briefly away."
Avoiding false positives
Before you remove a license, check for the common exceptions:
- Shared mailboxes need no license up to 50 GB – but they sometimes show up wrongly as an "inactive user."
- Service and function accounts never sign in interactively, yet they're productive (for example, for scanners or applications).
- Seasonal or leave-taking employees (parental leave, sabbatical) are inactive but haven't left the company.
- Newly created accounts that haven't appeared in the usage reports yet.
That's why the order is always: flag → verify → decide, never "delete automatically."
How to proceed
- Pull an inventory – all users with their assigned licenses.
- Overlay activity reports – sign-in and service usage per user.
- Set a threshold – for example, "no activity for 90 days." Start conservative, then tighten.
- Filter out exceptions – service accounts, employees on leave, shared mailboxes.
- Hand the candidate list to the business units – they know who has actually left.
- Remove the license – after approval, documented in a traceable way.
What happens when you remove a license
Removing a license is not the same as deleting the account:
- The account remains, but loses access to the licensed services.
- Mailbox and OneDrive data are kept for a retention period, depending on your configuration.
- If a mailbox needs to keep running (for example, to handle inquiries directed at someone who has left), convert it to a shared mailbox first – this preserves all emails and calendar data, and the license can be removed afterward.
This reversibility makes cleanup low-risk – provided you've verified beforehand.
Manual or with a tool?
Up to ~100 seats, the Microsoft usage reports and an export to Excel are workable. Beyond that, manually merging sign-in, Exchange, Teams, and SharePoint data becomes error-prone and time-consuming – and this is exactly where the overlooked candidates slip through.
License Lens automates precisely this reconciliation: connect your tenant in read-only mode, and for each license assignment you immediately see the combined activity signal and whether it can be saved. No changes are made and no employee data is stored.
The next logical step is a clean, repeatable audit → Microsoft 365 License Audit: Step by Step.