Chapter 11 of 14

License Management Best Practices

Master the day-to-day operations of managing Microsoft 365 licenses — from group-based assignment and self-service controls to offboarding automation and invoice reconciliation.

15 min read read 3 quiz questions

Key Facts

Group-based licensing in Entra ID reduces admin overhead by up to 80% compared to manual per-user assignment.
Shared mailboxes (up to 50 GB) do not require a paid license — convert departed employee mailboxes to save costs.
Inactive license detection saves an average of $12,000/year for a 500-user organization.
The M365 Admin Center usage reports show last activity date per user per workload — run these monthly.
Self-service purchase for Power Platform and Copilot can be disabled tenant-wide via PowerShell (Set-MSCommerceProductPolicy).
CSP invoice reconciliation should be done quarterly at minimum — discrepancies of 5–10% are common.
OneDrive data for deleted users is retained for 30 days by default, but this can be extended up to 3,650 days (10 years) in SharePoint Admin Center.
Third-party tools like CoreView and AvePoint provide cross-tenant license views, automated workflows, and cost optimization dashboards that go beyond the native Admin Center.

The M365 Admin Center — Your License Command Center

Everything starts at admin.microsoft.com. The Billing → Licenses section shows every subscription you own, how many are assigned vs. available, and when they renew. If you are not checking this dashboard monthly, you are likely overspending. This is especially true right after a Microsoft 365 migration — teams often over-provision during rollout and forget to reclaim trial or temporary licenses afterwards.

Individual vs. Group-Based Assignment

Individual Assignment

Suitable for very small organizations (<25 users). Go to Users → Active users → select user → Licenses and apps → toggle licenses on/off. Simple but does not scale.

Group-Based Licensing (Recommended)

Create security groups in Entra ID matching your license tiers
Assign license plans to groups: Entra ID → Groups → select group → Licenses → Assignments
Users inherit licenses from group membership — add to group, get license; remove from group, lose license
Dynamic group rules can auto-assign based on department, job title, location, or custom attributes
Requires at least Entra ID P1 (included in E3/E5/Business Premium)

Monitoring License Usage

The Admin Center provides several reports to find unused or underutilized licenses:

Reports → Usage → Microsoft 365 activation: Shows how many users have activated desktop apps
Reports → Usage → Active users: Shows daily/weekly/monthly active users across services
Per-service reports: Exchange, OneDrive, SharePoint, Teams — each shows individual user activity
Look for users with no activity in 90+ days. These are candidates for license reclamation.
Export reports to Excel for deeper analysis and trending over time

Offboarding: Reclaiming Licenses

When an employee leaves, follow this sequence to properly reclaim their license. Note that during a tenant-to-tenant migration, the offboarding process in the source tenant is particularly time-sensitive — you want to decommission source licenses as soon as each batch completes to avoid double-billing:

1. Convert mailbox to shared mailbox (free — no license required to retain email data)
2. Set up email forwarding to manager or team if needed
3. Transfer OneDrive files to manager (Admin Center → Users → Delete user → gives 30-day access to manager)
4. Remove from all Entra ID groups (automatically reclaims group-based licenses)
5. Block sign-in first, then delete user account after data retention period
6. Wait for license to appear as available (may take up to 24 hours)
Pro tip: Shared mailboxes can hold up to 50 GB of email data at no licensing cost

Pro Tip

Automate offboarding with Power Automate or an HR-integrated identity governance flow. When your HR system marks someone as terminated, trigger automatic license reclamation. This alone can save organizations $5,000-$50,000/year depending on size and turnover rate.

Self-Service Purchase Controls

By default, Microsoft allows users to self-purchase Power Platform and Copilot licenses using their corporate credit card. This can lead to shadow IT spending and license sprawl.

Disable self-service: Use the MSCommerce PowerShell module to turn off self-service purchases
Command: Update-MSCommerceProductPolicy -PolicyId AllowSelfServicePurchase -Enabled $false
Or selectively disable for specific products while allowing others
Review existing self-service purchases in Admin Center → Billing → Your products → filter by self-service

Did You Know?

Group-based licensing in Entra ID reduces admin overhead by up to 80% compared to manual per-user assignment.

Test Your Knowledge

Question 1 of 3

What is the primary benefit of Entra ID (Azure AD) group-based licensing over manual assignment?

Chapter Summary

1The Microsoft 365 Admin Center is your central hub for license operations — monitor assigned vs. consumed licenses and export usage reports monthly to flag inactive users.
2Group-based licensing (requires Entra ID P1, included in E3/E5/Business Premium) automates license assignment and reclamation based on security group membership, reducing admin overhead by up to 80%.
3Disable self-service purchase for Power Platform and Copilot tenant-wide via PowerShell to prevent shadow IT and billing chaos.
4Automate offboarding: block sign-in, convert mailbox to shared, remove from license groups, and notify the manager — target license reclamation within 24 hours of departure.
5Reconcile CSP invoices against assigned licenses quarterly to catch paid-but-unassigned licenses and eliminate 5–10% billing discrepancies.
6Third-party tools (CoreView, AvePoint, Quadrotech) deliver cross-tenant visibility, automated optimization, and ROI within 3–6 months for organizations with $200K+ annual M365 spend.
7Set calendar reminders 60 days before annual renewal to review usage, right-size quantities, and negotiate multi-year commitments for additional 5–10% savings.