Microsoft 365 License Harvesting: The Systematic Approach to Reclaiming Unused Licences

What Licence Harvesting Is and Why It Matters at True-Up

Licence harvesting is the systematic process of identifying Microsoft 365 licences that have been assigned to users who are no longer actively using them — and reclaiming those licences before the annual true-up window closes. In an Enterprise Agreement context, the true-up date is the moment at which your organisation declares its actual user count and pays for any net additions above the baseline. Licences that are assigned but not in active use inflate that count and increase your true-up cost unnecessarily.

The problem is endemic. Enterprise Microsoft 365 deployments typically carry 15–22% shelfware across the M365 user base at any given time. The sources of this waste are consistent: employees who have left but whose accounts were not promptly deprovisioned; contractors or temporary workers whose licences remained active past their engagement end date; departmental restructurings that left licences assigned to reorganised roles; and projects that spun up Microsoft 365 Copilot, Power BI Premium, or security add-on licences that were never operationally deployed. Every one of these categories represents money that leaves your organisation at the next true-up without delivering corresponding value.

Harvesting is not simply a matter of deleting user accounts. The process requires identifying which licences can safely be reclaimed without disrupting active users, documenting the decisions for compliance purposes, and executing the reclamation in a way that is reflected in your true-up submission. Done correctly, a harvesting programme run in the 60–90 days before an anniversary true-up can reduce the true-up count significantly — and that reduction compounds over subsequent agreement years.

The Eight Primary Sources of Unused M365 Licences

Effective harvesting begins with knowing where waste accumulates. The eight categories that consistently produce the highest volume of harvestable licences in enterprise environments are:

1. Leaver Accounts Not Promptly Deprovisioned

The most common source. When an employee leaves, their Active Directory account is typically disabled within days — but the M365 licence assignment is not always removed simultaneously. If your HR-to-IT offboarding process does not include an M365 licence reclamation step, these licences accumulate across every billing period. In a 2,000-seat organisation with 15% annual staff turnover, this can mean 300 accounts per year not properly harvested — a sustained annual cost of £108,000 at E3 pricing.

2. Shared Mailboxes Licensed as User Accounts

Microsoft's licensing rules permit shared mailboxes (those accessed by multiple users via delegation rather than direct login) to operate without a user licence, provided they remain under 50GB and are not given a direct login. Many organisations have converted shared mailboxes to user accounts unnecessarily, or have user-licensed shared mailboxes that could be converted to unlicensed shared accounts. This is a straightforward technical remediation with immediate commercial impact.

3. Copilot and Premium Add-On Licences Not Deployed

M365 Copilot pilots that did not convert to full deployment frequently leave active licence assignments for users who participated in a proof of concept but never received the enabled service. Similarly, Power BI Premium Per User, Microsoft Defender add-ons, and Purview compliance add-ons assigned during evaluation projects may remain active long after the evaluation concluded. These premium SKUs carry the highest per-licence cost and are consequently the highest-value harvesting targets. The M365 Copilot licensing guide covers the specific indicators of inactive Copilot licences.

4. Contractor and Guest Accounts

External contractors working in your M365 tenant may have been provisioned with full E3 or E5 licences where a guest access policy or a lower-tier licence would have sufficed. After the engagement ends, these accounts are often left in a disabled state with the licence still assigned. A systematic audit of external user accounts is a reliable source of harvestable licences in organisations that routinely use contractors.

5. Departmental Overprovision at Original Deployment

Many M365 deployments were sized to the headcount at the time of original licence purchase, then renewed at the same count without adjustment for organisational changes. Departments that have shrunk through restructuring, automation, or business unit sales may be running significantly fewer active users than the licence count the department is billed against. The M365 enterprise licensing guide explains how to map department-level licence usage against actual headcount.

6. Duplicate Licensing Across SKUs

Users who have been granted both an M365 E3 and a standalone Exchange Online Plan 2 licence — when Exchange Online is already included in E3 — are being double-licensed for a capability they have once. This is surprisingly common in organisations that have added standalone services without auditing for included entitlements in their base SKU. A SKU overlap analysis will typically surface several hundred duplicate assignments in any mature M365 deployment.

7. Inactive Accounts in Shared Tenants

Organisations that have migrated from one tenant to another — typically post-acquisition — may have residual active accounts in the source tenant that continue to be billed. If the licence reconciliation at tenant migration was incomplete, both tenants may be billing for the same effective user population. A cross-tenant licence audit is essential whenever a tenant migration has occurred.

8. Test and Development Accounts

IT teams provisioning test accounts for new deployments, security evaluations, or infrastructure testing often forget to remove those accounts after the test is complete. These accounts appear indistinguishable from regular user accounts in basic licence reports but produce no productive usage. Usage signal analysis (described below) is the most reliable method for identifying them.

The Harvesting Methodology: Tools and Process

A reliable harvesting programme uses three data sources in combination: Microsoft 365 Admin Centre usage reports, Microsoft Entra ID (formerly Azure Active Directory) sign-in logs, and your HR system's active employee records. No single source is sufficient alone.

Step 1: Pull the 90-Day Activity Report

In the Microsoft 365 Admin Centre, navigate to Reports → Usage → Microsoft 365 Usage. Pull the 90-day version of the Active Users report, the Email Activity report, and — if applicable — the Teams Activity report. Export all to CSV. The key column is "Last Activity Date" — any user with no activity in the last 90 days is a primary harvesting candidate.

Use 90 days, not 30. Some legitimate users — field workers, executives on sabbatical, staff on parental leave — may have genuine activity gaps within 30 days. Ninety days is the threshold that balances false positive avoidance with meaningful waste identification. For Copilot and premium add-on licences, reduce this window to 30 days: these premium licences should be in active use within a month of assignment or they are not being deployed.

Step 2: Cross-Reference Against HR Data

Export your HR system's active headcount as of the harvest date. Compare it against the active M365 account list. Any account that exists in M365 but not in your active HR roster is a definitive harvest candidate — there is no legitimate reason for a departed employee's account to retain an active, paid M365 licence (converted to a shared mailbox for email retention purposes is the one exception, but that account should not carry a user licence). This step alone typically surfaces 5–8% of total assigned licences.

Step 3: Analyse Sign-In Logs for Stale Accounts

Entra ID sign-in logs retain 30 days of data by default; with a Log Analytics workspace connected, they retain up to 90 days. Pull the sign-in log for all user accounts and identify those with no successful interactive sign-in in the analysis period. Cross-reference with the activity report. Accounts that appear inactive on both signals are high-confidence harvest candidates. Accounts that appear inactive in usage reports but show recent sign-ins may be service accounts or accounts used for authentication without direct application activity — these should not be harvested.

Step 4: SKU Overlap Analysis

Export the licence assignment report (available via PowerShell: Get-MsolUser -All | Select UserPrincipalName, Licenses). Identify users assigned multiple SKUs where one SKU's entitlements are a subset of another. Common overlaps to look for: E3 + Exchange Online Plan 2; E5 + Defender for Endpoint Plan 2 (included in E5); M365 Business Premium + Teams Essentials (Teams is included in Business Premium). Remove the redundant assignments. The E3 vs E5 comparison documents which capabilities are included in each tier to help identify overlaps.

Step 5: Document and Execute with an Audit Trail

Before reclaiming any licence, create a documented record of the reclamation decision — the account, the licence type, the activity data that justified reclamation, the approver, and the reclamation date. This documentation serves two purposes: it protects against disputes at true-up if Microsoft questions your reported user count, and it creates an audit trail for your own compliance records. Execute reclamations in batches with a 48-hour delay between notification (where a user may still be on extended leave) and final reclamation.

How Harvesting Affects Your True-Up Calculation

Under a standard Enterprise Agreement, the true-up process requires you to report the maximum user count at any point during the true-up period, not the count at the moment of reporting. This is the single most important constraint on harvesting strategy. If your true-up period runs from 1 January to 31 December, and you had 1,200 users assigned at any point during that period — even briefly in February — you owe Microsoft for 1,200 users regardless of the fact that you harvested down to 1,050 by year-end.

This means harvesting must begin at the start of the true-up period, not the end. Licences reclaimed before the anniversary date of the previous year do not count toward the current year's true-up. Licences reclaimed after the anniversary but before the true-up reporting date only reduce the count from the reclamation date forward — they cannot retroactively reduce the high-water mark.

The practical implication is that a well-run harvesting programme is continuous, not a pre-true-up scramble. Monthly licence reviews — pulling the 30-day inactive report, cross-referencing HR data, reclaiming confirmable leavers — prevent the high-water mark from accumulating unnecessarily throughout the year. See the M365 true-up guide for the complete mechanics of the true-up calculation and reporting process.

Harvesting Through SKU Downgrade

Harvesting does not only mean removing licences entirely. It also means identifying users who have been assigned a premium SKU when a lower-tier SKU would meet their actual needs. Common downgrade scenarios include: knowledge workers on M365 E5 who do not use the advanced security capabilities and could be on E3 with targeted security add-ons; field or frontline workers assigned E3 who have no productivity workload beyond email and Teams and could be on F3; and project-based workers who need M365 for defined periods and could be managed on annual subscriptions rather than perpetual seat assignments.

SKU downgrade requires a user-need analysis, not just an activity analysis. A user who logs into Teams every day but never uses Advanced Threat Protection may look like an E5 activity-justified user — but a review of their actual workload may reveal that E3 fully covers their needs. The E3 vs E5 cost comparison provides the decision framework for this analysis. The M365 optimisation service includes a full SKU right-sizing review as a standard component.