Assigned vs. active
Compare licensed accounts against currently employed, active users-not just enabled accounts in the directory.
Independent IT security review
Know whether a paid seat still belongs to someone who needs it.
Licence entitlement drifts quietly: seats stay assigned to disabled, departed, or duplicate accounts long after the reason for them ended. This review reads assignment against actual use, not just the subscription total.
- Before any access
- Written question and scope
- Agreed evidence method
- No automatic tenant changes
Read assignment against people, not against the invoice.
A licence count that matches the invoice does not mean every seat matches an active person who needs it.
Duplicate and legacy seats
Find users holding more than one overlapping licence tier, often left over from a plan change or migration nobody finished.
Service and shared accounts
Check whether shared mailboxes, service accounts, and test accounts hold a paid seat they do not actually require.
Connect entitlement waste back to the process that created it.
A seat still assigned to a departed employee is rarely a licensing problem on its own; it is usually where the offboarding process actually broke.
Departed-employee seats
Identify licences still assigned to accounts belonging to people who no longer work at the organization.
Disabled but licensed accounts
Find accounts already disabled in the directory that still hold-and still bill for-an active licence.
Root-cause ownership
Attach each finding to whether the gap is a one-time cleanup or a recurring break in the account lifecycle process.
Check what each seat is actually entitled to use.
Two users on the same nominal plan can end up with different real capability if add-ons, trials, or grandfathered plans are mixed in.
Plan mix
Identify how many distinct licence combinations exist across the organization and whether that variation is intentional.
Unused capability
Note where a higher-cost licence’s security or compliance features sit unused because nothing was configured to use them.
Trial and promotional dependency
Flag seats depending on a trial or promotional add-on that will change price or disappear on a specific date.
Turn the finding into a decision, not just a smaller invoice.
The useful output is not “cancel these seats.” It is a decision about each one, with the next process check attached.
Reclaim, downgrade, or keep
Decide per account whether to remove the licence, move it to a lower tier, or keep it with a documented reason.
Sequence the change safely
Check for mailbox, archive, or application dependencies before removing a licence, since some changes are not easily reversed.
Prevent the next drift
Tie the fix to a recurring reconciliation between HR records, directory status, and licence assignment-not a one-time count.
Next step
Define the review before sharing evidence.
Start with the trigger, decision, and known boundaries. Do not send passwords, recovery codes, or tenant exports.