Most licence reviews die in the first hour because every username comes back as a hash. Here is the whole job - measuring usage properly, when you can actually reduce seats, and what happens to the data.
Most Microsoft 365 licence reviews die in the first hour, and usually for the same reason: someone runs the usage report, every username comes back as a meaningless hash, and the exercise gets parked. That is a tenant setting, it is on by default, and clearing it takes about two minutes. What follows is the rest of the job - how to measure usage properly, when you are actually allowed to reduce seat counts, what happens to the data when you take a licence away, and which waste patterns are genuinely worth chasing.
Prices in this article are UK list, ex-VAT, observed in July 2026. Microsoft repriced most of the estate on 1 July 2026, so anything you read that was written in 2025 is now wrong. Its own UK pages were still catching up when we checked, so verify against a live CSP quote before you build a business case on a number.
In the Microsoft 365 admin centre there is a checkbox with a genuinely confusing name: "Display Concealed user, group, and site names in all reports". Some Microsoft documentation renders the same setting as "Conceal user, group, and site names in all reports". Either way, ticked means concealed.
It has been on by default since 1 September 2021, and Microsoft's rationale is reasonable: "By default, all reports hide user information such as usernames, display names, groups, and sites to help companies support local privacy laws."
The critical point for anyone scripting against Graph is that this is a single tenant-wide flag and it affects the API exactly as it affects the admin centre. A reclamation script will return hashed UPNs and be completely useless until someone clears it. This is the number-one reason M365 licence audits never get off the ground.
Via the admin centre: Settings › Org Settings › Services › Reports, then untick the box and save. It needs a Global Administrator and takes a few minutes to apply. Be warned that Microsoft's own instructions on that page say "select the checkbox" under a heading about showing details, which is the wrong way round - to show real names you untick.
Or do it properly, in code:
Connect-MgGraph -Scopes "ReportSettings.ReadWrite.All"
Get-MgAdminReportSetting # displayConcealedNames : True
Update-MgAdminReportSetting -BodyParameter @{ displayConcealedNames = $false }Do have the privacy conversation before you flip it, though - particularly if you are an MSP acting in a client tenant. Per-user activity data is personal data, and "we needed it for a licence review" is a purpose you should be able to point at in writing.
The single most useful call for reclamation is getOffice365ActiveUserDetail, because it returns, per user, which workload licences they hold and the last activity date for each - in one place:
GET https://graph.microsoft.com/v1.0/reports
/getOffice365ActiveUserDetail(period='D90')Around it sit the per-workload reports you will want for corroboration:
| Endpoint | What it gives you |
|---|---|
getOffice365ActiveUserDetail | Per-user licence flags, per-workload last activity date, licence assign dates, assigned products |
getTeamsUserActivityUserDetail | Chat and channel messages, calls, meetings organised and attended, audio/video/screen-share seconds |
getEmailActivityUserDetail | Send, receive and read counts; last activity date |
getMailboxUsageDetail | Storage used against quota, archive presence, last activity |
getOneDriveActivityUserDetail / getOneDriveUsageAccountDetail | Per-user file activity and per-account storage |
getSharePointActivityUserDetail | Files viewed or edited, synced, shared |
getM365AppUserDetail | 39 columns of per-user usage across Outlook, Word, Excel, PowerPoint, OneNote and Teams, split by Windows, Mac, mobile and web |
Three practical notes that save an afternoon each:
Reports.Read.All. For delegated calls you also need an Entra role - and here is the catch: Global Reader and Usage Summary Reports Reader return tenant-level data only, with no per-user detail. Reports Reader is the least-privileged role that actually returns what reclamation needs. App-only calls carry no role requirement at all, which is the sensible automation route.date parameter window is 28 rather than 30 days on the Teams device usage and email activity reports. Set period or date, never both.Location header pointing at a short-lived pre-authenticated URL that needs no Authorization header. HTTP clients that auto-follow redirects and helpfully forward the auth header will fail. Strip it on the redirect hop.getYammerActivityUserDetail and friends. Only the branding in the descriptions changed; there is no getVivaEngage* replacement and no deprecation notice./copilot path rather than /reports, and only returns data for users who hold a Copilot licence.This is the section that separates a defensible reclamation exercise from an angry ticket queue.
The data is 24 to 72 hours behind, sometimes more. Microsoft's wording: "The reports typically become available within 24 to 72 hours, but might sometimes take several days to become available." Every export carries a Report Refresh Date column - read it rather than assuming it means today. The M365 Apps usage report is slower still, covering "up to the last two days" and refreshing with minor corrections every six days. Teams goes further and backfills retroactively: it validates the past three days and fills detected gaps, so historical Teams figures can legitimately change after you have exported them.
"Activity" means intentional activity. Microsoft defines last activity date as the most recent date a user performed "any intentional activity within the app". Presence is not activity. Having Teams running in the tray, being signed in, or showing green generates no signal at all.
That produces one very specific and very common false negative. The Teams report has an "Other activity" category, described as the user being active but doing things the report does not expose - Microsoft's own examples include changing a status message, or opening a channel post without replying. A user who reads Teams all day but never posts, calls or joins a meeting can show as low or zero activity. Reclaim on that alone and you will be wrong, publicly.
Other documented gaps worth knowing before you act:
A defensible method, given all that. Assess on D90 or D180, never D7. Require at least two independent signals to agree - for example the last activity date from getOffice365ActiveUserDetail plus lastSuccessfulSignInDateTime from Entra. Never reclaim on one workload's silence. And treat read-only Teams consumers, shared-computer users, integration-driven accounts, external collaborators and anyone on long-term leave as needing a human check.
Microsoft's own suggested threshold for inactive accounts, for what it is worth, is "between 90 and 180 days". Note that Entra sign-in activity reporting needs Entra ID P1 or P2.
This is where good analysis meets commercial reality, and where most articles get it wrong. Under new commerce, the rule is seven calendar days - 168 hours - on any term, annual and monthly alike, with a refund prorated daily.
The nuance that matters most:
"The number of licenses on a subscription can be decreased only within the first seven days of when the licenses were added to the subscription... This rule applies whether the licenses were added at the initial purchase, on renewal, or at midterm."
So the clock runs from when those specific licences were added - not from the original subscription date. Seats added mid-term carry their own fresh seven-day reduction window. Miss it, and "the license count can't be decreased until the next cancellation window at renewal".
Increases, by contrast, can happen at any time and are co-termed to the subscription end date. The asymmetry is deliberate.
That leaves two routes for anything you find outside the window:
One more thing to avoid: a mid-term change of billing term does not open a cancellation window, and will leave you unable to reduce seats until the renewal date. If you are planning a reclamation, do the analysis first and the billing housekeeping second.
There are three separate 30-day clocks here and they get conflated constantly:
| Action | Mechanism | Window |
|---|---|---|
| Remove licence, account remains | Exchange holds the mailbox data | 30 days, then unrecoverable |
| Delete the user account | Entra ID soft-delete | 30 days, fully restorable |
| Delete the mailbox | Exchange soft-deleted retention | 30 days |
An important correction to how the first row usually gets described: it is not 30 days of continued access. Microsoft is explicit that once the licence is removed, "the user's mailbox is no longer searchable by using an eDiscovery tool such as Content Search or eDiscovery (Premium)". eDiscovery visibility is lost immediately. The 30 days is a recovery window, not a service window.
Two operational rules follow. Remove any holds before you remove the licence - Exchange will throw an error if a hold exists, because it cannot disconnect a mailbox whose content must be retained. And if you want to keep a leaver's mailbox cheaply, convert it to a shared mailbox first, then unassign the licence - the mailbox needs a licence at the moment of conversion, and must be under 50 GB. Do not delete the old user account afterwards; it anchors the shared mailbox.
The old, widely-repeated answer was that only deleting the user starts OneDrive cleanup - "no other action causes the cleanup process to occur, including blocking the user from signing in or removing the user's license". Remove the licence, keep the account, and the OneDrive sat there indefinitely. That was a genuinely useful parking spot, and it is no longer safe.
A separate enforcement track for unlicensed OneDrive accounts now applies: each account is put into read-only mode on the 60th unlicensed day and archived or moved to the recycle bin on the 93rd. Microsoft adds that while these accounts stay visible to admins, "neither admins nor end users have access to their content".
Long retention settings do not save you - Microsoft states accounts are archived at day 93 even where the retention period is longer. Re-licensing reactivates within 24 to 48 hours at no charge, and there is no opt-out.
In fairness, Microsoft's own documentation currently contradicts itself on this - the older pages still say licence removal does not trigger deletion, while the unlicensed-accounts page describes the day 60 and day 93 behaviour. Plan for the stricter of the two.
On the user-deletion path the arithmetic is 30 + 93 = 123 days: the retention period defaults to 30 days and is configurable from 30 to 3,650 in the SharePoint admin centre, after which the OneDrive moves to the site collection recycle bin for 93 days, from where restoring it requires PowerShell. Also worth checking: by default the deleted user's manager automatically gets access, and if no manager or secondary owner is set, nobody is given access and nobody is warned. You get two emails - one at deletion, one seven days before expiry.
The compliant answer is an inactive mailbox, and the order of operations is everything: "Making a mailbox inactive requires a hold on the mailbox, and then deleting the mailbox or corresponding user account." Hold first, then delete.
Both halves of the licensing answer matter, because they are routinely conflated. "Inactive mailboxes do not require a usage license" - but you need the licence before deletion in order to apply the hold, and it is freed afterwards: "After the user account is deleted, any Exchange Online license associated with the user account will be available to assign to a new user."
Three traps that catch UK admins regularly:
And one figure worth correcting, because much of the web still has it wrong: once the last hold is removed, an inactive mailbox remains for 30 days, not 183. Separately, eDiscovery case holds give no grace at all - if the hold is released or the case closed, the inactive mailbox is permanently deleted. Note too that a mailbox with auto-expanding archive enabled cannot be recovered or restored as an inactive mailbox, which makes that a one-way door worth thinking about before you enable it.
This is the most reliably recoverable money in almost any tenant. Microsoft's own guidance is that a mailbox used to send email over SMTP - line-of-business applications, scanners, on-premises appliances - does need a subscription, but that the subscription "can be Exchange Online Kiosk or Exchange Online Plan 1 or Plan 2". Not E3. Not E5.
And it depends entirely on how the thing sends:
| Method | Licence needed | Limits |
|---|---|---|
| SMTP AUTH client submission | A licensed mailbox | 10,000 recipients/day, 30 messages/minute |
| SMTP relay via connector | No licensed mailbox | "Reasonable limits" |
| Direct send | No licensed cloud mailbox | Standard anonymous throttling |
For genuinely high volume there is also High Volume Email, which needs no M365 licence and is billed pay-as-you-go at roughly $42 per million recipients, internal only. An estate with E3 on every multifunction device and LOB application is burning money for no functional benefit.
While you are in there: room and equipment mailboxes are free, and Microsoft explicitly frames a licensed shared mailbox as paying for something you do not need. A shared mailbox holds 50 GB unlicensed; it needs Exchange Online Plan 2 only if it exceeds that, needs Litigation Hold, or needs a larger in-place archive. Anything created before July 2018 is grandfathered at 100 GB.
One deadline to note while you are auditing service accounts. Basic authentication for SMTP AUTH is unchanged through December 2026, at which point it will be disabled by default for existing tenants, with a final removal date to be announced in the second half of 2027. If you find accounts using SMTP AUTH with basic auth, that is your window. Ignore any source still saying March 2026 - that timeline was superseded in January 2026.
At roughly £23 per user per month, this is usually the highest-value single target in a tenant. There is a first-party report for it - the Microsoft 365 Copilot usage report shows Enabled against Active with a per-user last activity date, over a 180-day window. A blank last activity date is an unused seat. Copilot is a paid add-on and is not included in E3 or E5; only the new E7 SKU bundles it.
The anchor fact: Microsoft 365 E5 = Office 365 E5 + Enterprise Mobility and Security E5 + Windows E5. Conflating Microsoft 365 E5 with Office 365 E5 is the single most common error in articles on this subject, and it leads to real mistakes in both directions.
| Add-on | In Microsoft 365 E5? | In Office 365 E5? |
|---|---|---|
| Entra ID P2 | Yes (M365 E3 gets P1 only) | No - Entra ID Free only |
| Defender for Office 365 P1 and P2 | Yes | Yes |
| Defender for Endpoint P2 | Yes, via Windows E5 | No |
| Defender for Identity / Cloud Apps | Yes, via EMS E5 | No |
| Intune Plan 1 | Yes | No |
| Microsoft 365 Copilot | No - paid add-on | No |
The cleanest example of pure waste, in Microsoft's own words: "In the case where any Microsoft 365 E5 license is used, it isn't necessary to also assign the stand-alone Microsoft Teams Phone Standard license." Do check the reverse trap though - Teams Phone in E5 is the PBX entitlement only, with no PSTN minutes. A Calling Plan, Operator Connect or Direct Routing is a legitimate separate purchase, not waste.
And date-stamp your findings, because the July 2026 packaging changes moved the line. Defender for Office 365 P1 bought on top of E3 flips from legitimate to waste as that rollout completes, and Intune Plan 2, Remote Help and Advanced Analytics moved into E3 and E5 - so standalone purchases of those are now worth re-checking.
This one is counter-intuitive and expensive. Following the 2023 EEA and 2024 worldwide unbundling, no-Teams enterprise suites are cheaper - but standalone Teams Enterprise costs roughly the same as the discount. Putting E5 (no Teams) together with Teams Enterprise generally costs as much as or more than the Teams-inclusive suite, and gives you a second SKU to administer and a second licence to reclaim when someone leaves.
Two follow-ons. First, you can buy Teams-inclusive enterprise suites again - that changed on 1 November 2025, and anyone still repeating "you can no longer buy E3 with Teams" is a year out of date. Second, customers on the original E3 or E5 SKUs will need to move to the equivalent unified SKU at their next renewal, which makes 2026 a natural audit trigger. And for completeness: Microsoft 365 E5 (no Teams) still includes Phone System.
The mechanics are above; the process point is the sequence. Removing the licence alone does not stop a leaver sending mail, because the mailbox still exists during the 30-day window. Microsoft's order is: block sign-in, reset the password, then remove the licence.
On guests, the headline is that they are usually free: "Guest access can be used with all Microsoft 365 Business Standard, Microsoft 365 Enterprise, and Microsoft 365 Education subscriptions. No extra Microsoft 365 license is necessary." External ID billing is by monthly active users with the first 50,000 free. Guests do need a licence for specific things - OneDrive storage, Power Automate flows, desktop Office apps, Power BI Pro workspace content - so the waste pattern is guests holding paid suite licences they never needed. Incidentally, if you find the old 1:5 guest ratio in a policy document, treat it as legacy; current Microsoft documentation describes guest usage under MAU billing instead.
UK list, GBP, ex-VAT, annual commitment paid yearly, as observed in July 2026:
| SKU | With Teams | No Teams |
|---|---|---|
| Microsoft 365 E3 | £33.50 | £27.00 |
| Microsoft 365 E5 | £51.60 | £45.00 |
| Microsoft 365 E7 (new for 2026) | £81.60 | £75.00 |
| Office 365 E1 | £7.70 | £5.20 |
| Office 365 E3 | £23.30 | £16.70 |
| Office 365 E5 | £36.80 | £30.20 |
| Microsoft 365 F1 / F3 | £2.30 / £7.70 | £1.92 / £6.90 |
| Business Basic / Standard / Premium | £5.40 / £10.80 / £16.90 | — |
The 1 July 2026 increase was announced in December 2025 and ran roughly 5 to 14% on enterprise SKUs and 25 to 33% on frontline - F1 rose by a third, F3 by a quarter, while Business Premium held flat. Existing customers stay on their current pricing until renewal, with at least 30 days' Message Center notice. Consumer and education pricing did not change.
Three commercial mechanics that quietly add to the bill:
One forward-looking note for budgeting: from FY27, Microsoft moved to annual local-currency updates each January. The next GBP movement is due 1 January 2027, independent of any dollar change.
You will have seen the claim that around a quarter to a third of software licences go unused, attributed to Gartner. We tried to source it properly. It traces to a Gartner analyst blog post from May 2020 on "shelfware", and that post no longer exists - the URL now redirects to a generic insights page. Every downstream citation we followed attributed a percentage to Gartner or Forrester without naming a report.
So we are not going to print one, and neither should anyone building a business case that has to survive scrutiny. What is citable:
There is no published UK-specific M365 licence waste figure from any credible publisher. If you need a number for a board, the honest options are to derive it from your own tenant or to say that none exists.
getOffice365ActiveUserDetail at D90 or D180 and join it to Entra sign-in activity. Read the Report Refresh Date.Done in that order, most tenants give up a meaningful saving in the first pass without a single difficult conversation - because the largest single line is almost always service accounts and mailboxes that never needed a full suite in the first place.
Because of a tenant-wide setting in the Microsoft 365 admin centre, on by default since 1 September 2021, which conceals user, group and site names in all reports. It affects the Microsoft Graph reporting API exactly as it affects the admin centre, so scripts return hashed UPNs until it is cleared. Untick it under Settings, Org Settings, Services, Reports - it requires a Global Administrator.
getOffice365ActiveUserDetail is the most useful single call, because it returns per-user licence flags alongside the last activity date for each workload. It needs the Reports.Read.All permission. For delegated calls, note that Global Reader and Usage Summary Reports Reader return tenant-level data only - Reports Reader is the least-privileged role that returns per-user detail.
The reporting periods are D7, D30, D90 and D180. D180 is the maximum; there is no D365. Data is typically 24 to 72 hours behind and can take several days, so read the Report Refresh Date column rather than assuming the export is current.
No. Under new commerce, licence counts can only be decreased within seven days - 168 hours - of when those specific licences were added, whether they were added at initial purchase, on renewal, or mid-term. After that, the next opportunity is the cancellation window at renewal, or a scheduled change made before renewal. Increases can be made at any time.
Exchange Online holds the data for 30 days, after which it is deleted and cannot be recovered. It is not 30 days of continued access - eDiscovery visibility is lost immediately. Any holds must be removed before the licence, or Exchange returns an error. To keep the mailbox cheaply, convert it to a shared mailbox first and then unassign the licence, and do not delete the user account.
Effectively yes, now. Unlicensed OneDrive accounts are put into read-only mode on the 60th unlicensed day and archived or moved to the recycle bin on the 93rd, with neither admins nor users able to access the content. Longer retention settings do not prevent this. Re-licensing reactivates the account within 24 to 48 hours at no charge.
Not usually. A shared mailbox holds up to 50 GB without a licence. It needs Exchange Online Plan 2 if it exceeds 50 GB, if it needs Litigation Hold or In-Place Hold, or if it needs a larger in-place archive. Room and equipment mailboxes are free. Shared mailboxes created before July 2018 are grandfathered at 100 GB.
Exchange Online Kiosk, if the account uses SMTP AUTH client submission. If it sends via an SMTP relay connector or direct send, no licensed mailbox is required at all. For high volume, High Volume Email needs no Microsoft 365 licence and is billed pay-as-you-go for internal recipients.
APaaS Assure joins Microsoft 365 usage to real device and application telemetry, so reclaim candidates come with corroborating evidence rather than a single silent workload.
Book a demo