For a complete walkthrough, check out the Microsoft 365 License Audit guide on Gitbit which covers everything step by step.
For a complete, step-by-step guide to the entire audit process, you can refer to the comprehensive resource at What Is a Microsoft 365 License Audit? (Step-by-Step Optimization Guide). This article provides a detailed checklist to identify unused, duplicate, and overpaid licenses, structured to guide IT administrators, managed service providers (MSPs), and finance teams through the entire optimization process. Phase 1: Preparation and Policy Definition Before diving into the technical details of your tenant, a successful audit requires laying the groundwork. This phase is about defining the rules of engagement and establishing clear success criteria, which is crucial for consistent enforcement and stakeholder buy-in. 1.1. Assemble Your Cross-Functional Team Microsoft 365 licensing touches IT, HR, procurement, and finance. Effective optimization requires collaboration. Your audit team should include: IT Administration: Responsible for technical discovery, PowerShell scripting, and execution of license changes. HR Operations: Provides crucial data on employee status, terminations, and departmental changes. Departures are the single largest source of redundant assignments. Procurement/Finance: Validates budget, understands contract terms (EA, CSP), and quantifies savings. Their involvement ensures that optimizations are correctly applied to the bottom line. Department Heads: Validate user roles and needs. They can identify false positives (e.g., a key executive who works offline but requires immediate access) and build operational buy-in for the process. 1.2. Define "Inactive" and Optimization Policies You cannot manage what you do not measure. Establish concrete policies for identifying waste. Inactivity thresholds are not one-size-fits-all. Define Inactivity Windows: Standard Users: 30 days of no sign-in or workload activity (Exchange, Teams, SharePoint). Contractors/Temporary Staff: A stricter window of 7-14 days to reflect their shorter engagement cycles. Seasonal or Executive Roles: A longer window of 60-90 days. Identify Protected Categories: Document exceptions to the policy. This includes users on legal hold, service accounts, and key executive roles. Define Action Triggers: What happens when a user is flagged? Remove License: For fully departed or inactive users. Downgrade SKU: For active users who do not consume premium features. Move to a Review Group: For users who require additional human validation before action. Phase 2: Data Collection and Discovery This is the most critical technical phase. You will gather comprehensive usage data to form a baseline of your current license position. This audit relies on hard data, not gut feelings. The Check out this Microsoft 365 License Audit guide on Gitbit for detailed instructions provides several methods for this, including using the Microsoft 365 admin center, PowerShell, and third-party tools. 2.1. Core Data Sources and Tools Check out this Microsoft 365 License Audit guide on Gitbit for detailed instructions Admin Center & Usage Analytics: The primary source for last activity dates, including last sign-in, mailbox activity, OneDrive sync, and Teams usage. The 90-day threshold is a standard, but your policy may differ. Entra ID (Azure AD) Sign-In Logs: Export sign-in audit logs (e.g., for the past 180 days) and filter on the Office 365 application. Cross-reference with your HR termination log to identify departed or disabled users who still have access. As detailed in the Microsoft 365 license audit guide, you need a Microsoft Entra P1 license to access this data via the admin center. PowerShell with Microsoft Graph API: The most powerful tool for a granular, automated audit. The guide provides specific commands to install the MG Graph module, connect to your tenant, and export user data, including sign-in activity and assigned licenses. 2.2. The Audit Checklist: What to Look For 🔍 Unused Licenses and Accounts Departed Employees: The most common source of waste. Users who have left the organization but still have an active license. Disabled Accounts: Active Directory accounts that are blocked or disabled but still have an M365 license assignment. The guide shows you how to filter for these by looking for accounts with Block credential set to TRUE but still having a license. Inactive Users: Active employees who have not logged in or used M365 services for a period that exceeds your defined policy (e.g., 30-90 days). Unactivated Licenses: Licenses assigned to users who have never logged in or activated their services. Orphaned Service Accounts: Service accounts or test accounts assigned a full M365 license when they only require basic mailbox or library access. 🔄 Duplicate and Overlapping Licenses Overlapping Plans: A user assigned an E5 license plus an add-on (e.g., Power BI Pro, Defender for Office) that is already included in the E5 suite. Unused Add-Ons: Licenses for services like Power BI, Visio, Project, or Copilot that have been assigned but are not being actively used. 💸 Over-Provisioned Licenses (The SKU Mix) Misaligned E5 Licenses: The most significant area of savings. Many organizations default to purchasing E5 for all users, but typically only 15-25% of a knowledge-worker base truly benefits from its advanced security, compliance, and analytics features. E3 vs. F3 Misuse: Employees in front-line or low-intensity roles often receive E3 licenses, while an F3 license (with its 2GB mailbox limit) is more appropriate and significantly cheaper. Unused Features: Users assigned E5 who never use Defender, eDiscovery Premium, or Power BI Pro are clear candidates for downgrade to E3 plus targeted add-ons. Phase 3: Analysis and Action With your data centralized, you can now analyze the findings and create an optimization plan. 3.1. Building the License Utilization Summary Consolidate your findings into a master spreadsheet or report. Your report should include: User Principal Name (UPN) Display Name & Department Assigned SKU(s) Last Sign-In Date Workload Usage (Exchange, Teams, OneDrive) Account Status (Active/Disabled) Recommended Action (Reclaim, Downgrade, Reassign, Maintain) 3.2. The 6-Step Harvesting Process License harvesting is the methodical recovery of redundant licenses. It should be executed in waves to prevent business disruption. Export & Cross-Reference: Create the master list of all license assignments and last activity, then join it with HR termination data. Identify SKU Downgrade Candidates: Segment users by role and SKU. For example, identify users with E5 who do not use Defender or Power BI, making them candidates for E3. The Gitbit resource strongly recommends following up with HR and the employee's manager before removing licenses, as they may be on extended leave. Department Validation: Present the list of candidates to department heads for sign-off. This step is critical for catching false positives and ensuring business continuity. Recover Licenses in Waves: Execute the removals and downgrades in small cohorts. Start with departed users (lowest risk), then over-provisioned SKUs, then inactive accounts. Apply a "72-Hour Undo" Window: For each wave of changes, implement a short grace period to roll back any changes that cause unexpected issues. Log Every Action: Maintain a "License Cleanup Register" logging every action taken, including timestamp, operator, user, SKUs before and after, and a reason code. This is vital for audits and proving savings. 3.3. Optimizing the SKU Mix: A Practical Strategy Microsoft 365 E3: The baseline for the majority of knowledge workers. It provides core productivity, identity, and device management (Intune) features. Microsoft 365 E5: Reserve this for the 15-25% of users who are security, compliance, or analytics power users. The cost premium is justified by its advanced features. Add-Ons Instead of Mass E5: For E3 users, add specific licenses like Power BI Pro or Defender for Office Plan 1 only where needed, rather than upgrading the entire user to E5. Frontline F1/F3 Licenses: Use F1 for shared-device frontline staff who do not need a mailbox, and F3 for those who need a limited (2GB) mailbox. Do not default to E3 for these roles. Copilot: Treat as a measured pilot, not a mass rollout. Start with 200-500 users for 12 weeks, and measure ROI before any broad commitment. 3.4. A Critical Note on Downgrading Finding over-licensed users is difficult because Microsoft doesn't provide comprehensive reporting on all apps and services a user is using. As emphasized in the Gitbit Check out this Microsoft 365 License Audit guide on Gitbit for detailed instructions guide, "a Microsoft 365 account is tied into a LOT of apps, tools, and services. Downgrading a license can cause a user to stop functioning." For example, a user might only use email but also rely on Microsoft Planner or Microsoft Lists that are shared with a team. The guide recommends two things: hire an expert who has done this before, and inform users before the downgrade so they know how to request an upgrade if needed. Phase 4: Translate Findings Into Business Language Technical reports are useless if they do not lead to action. For your recommendations to be approved, you must translate technical metrics into clear financial and operational impacts. 4.1. Financial Impact Hard Savings: Quantify the cost of waste. For example, a Gitbit study found that businesses waste an average of 22% of their M365 budget, a figure that holds true for organizations with as few as 10 users. Benchmarking: Show how your optimizations align with industry best practices, such as optimizing the SKU mix. License Terms: Don't forget to analyze your billing terms. As the guide points out, Microsoft charges different rates based on subscription length and billing frequency. For instance, switching a Microsoft 365 Business Premium license from a monthly to an annual subscription saves about 9%. The guide recommends mixing and matching: put 80% of your users on a yearly subscription and keep 20% on a monthly term for flexibility. 4.2. Operational and Security Benefits Reduced Sprawl: Framing cleanup as a governance improvement: "Archiving three inactive Teams and SharePoint sites simplifies collaboration and reduces employee confusion." Reduced Security Risk: Positioning inactive accounts as vulnerabilities: "Removing five unused accounts reduces the potential attack surface for our organization." 4.3. Deliverables Create a client-ready report or presentation that includes: A plain-language summary of issues. A clear quantification of savings opportunities. A bulleted list of actionable recommendations and a proposed timeline for implementation. Phase 5: Implement Preventative Governance The audit is not the end; it's the beginning of a continuous cycle of optimization. Prevent future sprawl by integrating these practices into your daily operations. Transition to Group-Based Licensing: Assign licenses to Entra ID groups based on role or department, rather than assigning them to users individually. This ensures that as employees change roles, their licenses automatically adjust. Automate Offboarding: Add a license-removal step to the offboarding checklist to ensure licenses are reclaimed immediately when an employee departs. Schedule Regular Reviews: As an industry best practice, conduct a Microsoft 365 license audit at least once per quarter, or monthly for high-turnover environments, to actively prevent licensing bloat. For specific instructions on using the admin center, PowerShell, or third-party tools for these recurring reviews, the Microsoft 365 License Audit guide is an excellent resource. Conclusion: The Renewal is the Destination The ultimate goal of a Microsoft 365 license audit is to arrive at your next contract renewal or true-up with a defensible, data-backed position. By identifying and reclaiming unused, duplicate, and overpaid licenses, organizations can typically save 15-20% of their M365 spend. This is not about pinching pennies but about strategically reallocating budget to drive growth, innovation, and stronger security. Using this checklist, and leveraging resources like the comprehensive Gitbit guide for the technical steps, you can move from a reactive stance of paying for waste to a proactive, data-driven approach that ensures your Microsoft 365 investment is perfectly aligned with your business needs.