GuidesOctober 28, 2026 · 6 min read

Microsoft 365 license clean-up before true-up or renewal

The weeks before a Microsoft renewal are when a license clean-up turns most directly into a lower bill. At other times, removing licenses mostly frees them for reuse. Close to renewal, every license you can show is unused can come off the next term, and before an Enterprise Agreement true-up, a clean count means you are not ordering licenses to cover accounts that should not have them. This checklist covers what to count, what to fix, and when the reduction has to be made for each way of buying.

Renewal coming up?

Sentsai’s free, read-only scan covers most of this checklist: paid licenses nobody holds, licenses on disabled accounts, accounts idle for 180 days or more, accounts that never signed in, and add-ons your suite already includes. The free scan shows the savings total; the itemized report is paid.

Start your free scan See a sample report

Needs a one-time approval of read-only access from an administrator who can approve apps. Not an admin? Email this to yours.

1. Put the dates in the calendar

Find the renewal or anniversary date for each subscription. In the Microsoft 365 admin center, Billing, then Your products shows direct and partner subscriptions one row each. For an Enterprise Agreement, the dates are in your enrollment.
Enterprise Agreement: Microsoft’s EA guidance says the true-up order must be received between 60 and 30 days before the enrollment anniversary. Start the clean-up about 90 days out so the numbers are settled before that window opens.
Cloud Solution Provider (new commerce) and direct Microsoft Customer Agreement subscriptions: license counts can only be lowered in the seven days after purchase or renewal. Outside that week a reduction waits for the renewal date, so agree the target quantity before renewal, not after.

2. Count licenses nobody holds

Purchased but unassigned licenses are the cleanest saving, because nobody loses anything. Billing, then Licenses compares assigned and available for each product. In Microsoft Graph PowerShell, compare prepaidUnits.enabled with consumedUnits, and ignore units in warning or suspended status, which belong to subscriptions that are already expiring or canceled. Keep a small buffer for known hires; the rest is your reduction target.

Microsoft Graph PowerShell

Get-MgSubscribedSku -All | Where-Object { $_.PrepaidUnits.Enabled -gt $_.ConsumedUnits } | Select-Object SkuPartNumber, @{n="Spare"; e={$_.PrepaidUnits.Enabled - $_.ConsumedUnits}}

3. Disabled accounts that still hold licenses

Blocking sign-in does not remove licenses, so leavers pile up here. This query lists every disabled account with at least one license; it is an advanced query, so the ConsistencyLevel and count parameters are required. Licenses inherited from a group cannot be removed per user, so take those accounts out of the group instead. The full procedure is in our guide to removing licenses from disabled users with PowerShell.

Microsoft Graph PowerShell

Get-MgUser -Filter "accountEnabled eq false and assignedLicenses/`$count ne 0" -ConsistencyLevel eventual -CountVariable disabledCount -All -Property DisplayName, UserPrincipalName, AssignedLicenses

4. Inactive users

These are enabled, licensed accounts that nobody signs in with. Read signInActivity through Microsoft Graph, which needs Microsoft Entra ID P1 or P2 and the AuditLog.Read.All permission, and judge on lastSuccessfulSignInDateTime, which records the last successful sign-in of any kind. lastSignInDateTime also counts failed attempts, so it can make an abandoned account look alive. Microsoft suggests a window of 90 to 180 days. Send the list to managers before renewal: leave, secondments and seasonal staff look the same as leavers in the data.

5. Add-ons your suite already includes

Standalone subscriptions bought before a suite rollout tend to outlive it. Microsoft’s product names and service plan identifiers reference shows, for example, that Microsoft 365 E3 includes Microsoft Intune Plan 1 and Microsoft Entra ID P1, and that Microsoft 365 E5 includes Power BI Pro, the Phone System service behind Teams Phone, Audio Conferencing, Microsoft Entra ID P2, and Microsoft Defender for Office 365 Plans 1 and 2. A user holding the suite plus a standalone copy of one of those is paying twice. Match each user’s licenses against the service plans in their suite, and confirm the standalone seats are not covering people without the suite before you drop them.

6. Shared mailboxes

A shared mailbox can store up to 50 GB without a license, and the people who open it need their own licensed mailbox, not a license on the shared one. Mailboxes converted from a leaver’s account often keep the E3 or E5 they had. Under Microsoft’s current rules, a shared mailbox needs a license only when:

It needs more than 50 GB: an Exchange Online Plan 2 license raises the limit to 100 GB.
Its archive needs to grow, or auto-expanding archiving is wanted: Exchange Online Plan 2, or Exchange Online Plan 1 with the Exchange Online Archiving add-on.
It is on litigation hold: Exchange Online Plan 2, or Plan 1 with Exchange Online Archiving.
It uses advanced features such as Microsoft Defender for Office 365, eDiscovery (Premium) or retention policies, where Microsoft says licenses might be required.

Anything else is a candidate for removal. Keep sign-in blocked on every shared mailbox while you are there: Microsoft says shared mailboxes are not meant for direct sign-in.

7. Turn freed licenses into a lower quantity

Every step above frees licenses. None of them lowers the bill by itself, because you pay for the subscription quantity, not for assignments. Microsoft’s own steps for reducing a subscription start by unassigning licenses and only then removing them from the subscription. So the last item is to carry the new number into the renewal:

Direct subscriptions: reduce the quantity under Billing, Your products, either within seven days of the renewal or set to take effect at renewal.
Cloud Solution Provider: give your partner the target quantity so they can schedule the reduction for the renewal date.
Enterprise Agreement: Microsoft notes that the EA Subscription Enrollment lets you increase or decrease subscription counts once a year. What can be reduced under your enrollment, and by when, is a question for your licensing partner, asked early.

Most of this list, read-only, in minutes

Sentsai runs most of this checklist for Microsoft 365, read-only: paid licenses nobody holds, licenses on disabled accounts and disabled guests, accounts idle for 180 days or more, E3 and E5 seats idle for 30 to 179 days as review candidates, accounts that never signed in, and add-ons a suite already includes. It does not check shared mailbox licensing, because Microsoft does not expose the mailbox type to the delegated, read-only access Sentsai uses, so do step 6 by hand. The free scan shows the total annual savings it identified, how many users it checked and how many compliance gaps it found. The itemized list, with every named account and license, costs 5% of the identified annual savings, with a $99 minimum, so you can take named findings into the renewal conversation.

Check your tenant before the renewal

Read-only, for Microsoft 365, in minutes. The free scan shows the total annual savings and the headline counts; the itemized, named list costs 5% of identified annual savings, $99 minimum.

Start your free scan See a sample report first