Microsoft 365 spend has a peculiar property: it grows automatically and shrinks only on purpose. Licenses get added with every hire and rarely removed with every departure; tiers get upgraded for one feature somebody needed once; and the subscription renews annually with all the scrutiny of a utility bill. Meanwhile — the stranger half of the problem — most organizations aren't using half of what the licenses they do need already include.
The waste side: licenses without humans
The first audit pass is simple arithmetic: active licenses versus active employees. The gap is reliably larger than anyone expects — departed staff whose accounts were disabled but never unlicensed, shared mailboxes consuming full licenses when free shared-mailbox options exist, service accounts on premium tiers, and duplicate assignments from a migration nobody cleaned up. At $22–57 per user per month depending on tier, a 150-seat organization carrying 20 ghost licenses is donating five figures a year to Redmond for nothing.
The mismatch side: tiers nobody chose deliberately
The second pass is tier alignment: who has which license, and does their work justify it? The common pattern is uniformity by default — everyone got E3 (or everyone got Business Standard) because that's what the first order was, not because roles were mapped to needs. Frontline workers, kiosk users, and light-email roles often fit dramatically cheaper tiers; a handful of power users may genuinely need more. Deliberate mixing routinely trims 15–25% off the bill without anyone losing a feature they use. (Copilot seats deserve their own version of this audit — we've written that one separately.)
The stranger finding: value you're already paying for
Here's the audit result that surprises people most: the features going unused are frequently the most valuable ones in the license. Business Premium and E3/E5 tiers include serious security tooling — device management, conditional access, advanced threat protection — that sits dormant because nobody was tasked with turning it on. Companies buy third-party point products to solve problems their existing license already covers. Before you add a single vendor, know what you own; the security half of this story is big enough that we gave it its own article.
What a real audit produces
Ninety minutes of tenant analysis yields four artifacts: a reclaim list (licenses to remove, with the annual savings priced), a remap list (roles matched to right-sized tiers), an enablement list (paid-for features worth turning on, in priority order), and a governance rule so the sprawl doesn't regrow — licensing decisions attached to onboarding and offboarding checklists, reviewed quarterly. The audit typically pays for itself before the next renewal, which makes it one of the rare IT projects a CFO requests twice.
License optimization is standing work inside our Cloud & Microsoft 365 practice — fixed scope, tenant-wide, findings you keep either way. If your renewal is inside the next two quarters, that's the right time to look.