The True-Up Shock: Why It Keeps Happening

The Microsoft 365 true-up is an annual event under the Enterprise Agreement in which you reconcile actual licence deployment against your committed quantity and pay for any over-deployment. In principle, it is a straightforward inventory reconciliation. In practice, it consistently generates surprise charges — ranging from £150,000 to £800,000+ in the engagements we advise on — because the true-up captures complexity that most organisations' internal governance does not anticipate.

The shock is not usually a single large number from one source. It is the accumulation of multiple smaller exposures — each manageable in isolation — that compounds into a significant unexpected invoice. An organisation that over-deployed E3 by 400 users during the year (£131,520 exposure), failed to harvest 180 inactive accounts (£55,296 recoverable shelfware credit, not applicable at true-up), added Copilot to 200 users without tracking (£59,280), and had 500 users with Teams Phone enabled beyond the licence pool (£54,000) faces a combined true-up exposure of approximately £244,800 before negotiation.

None of these are catastrophic individually. Together they create a budget surprise that was entirely avoidable with a basic quarterly licence governance process. This guide explains the mechanics, maps the four categories of M365 true-up exposure, and provides a governance framework that eliminates surprise at true-up time. For the broader EA true-up context, see our EA true-up clauses guide.

£244K
Representative composite true-up surprise from a 3,000-seat enterprise — four separate exposure categories compounding into a single unexpected invoice. Each category is individually manageable with quarterly governance.

How M365 True-Up Works: The Mechanics

Under a standard Microsoft EA, your M365 licences are purchased at an annual committed quantity. This is the number of users you agreed to licence at the start of the term (or at the last true-up). The true-up — which occurs annually on the EA anniversary date — requires you to report the highest deployed quantity for each product during the preceding 12 months.

The key phrase is "highest deployed quantity." This is not the current headcount, not the average headcount, and not the end-of-year headcount. It is the peak — the maximum number of active licences assigned at any point during the year. An organisation that grew from 2,800 to 3,400 users during the year and then reduced to 3,100 through a restructuring reports 3,400 at true-up, not 3,100. The true-up captures the peak, and any peak above the committed quantity generates an additional charge.

Conversely — and this is important — the true-up does not generate a credit for under-deployment. If you committed to 3,000 E3 licences and deployed only 2,600, you have paid for 400 licences you did not use. Those 400 unused licences represent shelfware cost. You can seek to reduce the committed quantity at renewal (not at true-up), but the sunk cost of the current year's over-commitment is not recoverable. This asymmetry — you pay for over-deployment, you do not recover credit for under-deployment — is the foundational commercial dynamic of M365 EA licensing.

Critical Mechanic

The true-up is based on peak deployment, not year-end deployment. Organisations that experience growth in H1 followed by headcount reduction in H2 often assume their reduced year-end headcount is the true-up baseline. It is not. The true-up captures the H1 peak. Always track and document peak deployment quarterly — this is the number that will appear in your true-up statement.

The Four Categories of M365 True-Up Exposure

In our experience across 500+ EA engagements, M365 true-up surprises fall into four primary categories. Understanding each category enables targeted prevention.

Category 1: Untracked Licence Assignments

The most common source of true-up surprise. M365 licences are assigned through the Microsoft 365 admin portal, Azure Active Directory (now Entra ID), or group-based licensing policies. When IT teams provision new starters, they often assign licences without logging the addition in the organisation's licence management system. When departments self-service licence assignments through group-based licensing, the central procurement team may not see additions until the true-up report arrives.

The fix is a monthly licence count reconciliation between the M365 admin portal's active licence count and the organisation's committed quantity. This takes 15 minutes per month and eliminates almost all Category 1 surprises. Export the "Active users" report from the M365 admin portal; compare to the committed quantities in your EA portal (VLSC or Microsoft 365 Admin Center); flag any product category where deployed exceeds committed by more than 5%.

Category 2: Add-On Product Creep

Teams Phone, Teams Audio Conferencing, Copilot, Power BI Pro, Project Plans, Visio Plans — the M365 catalogue contains numerous add-on products that sit outside the core E3/E5 commitment. Add-ons are frequently enabled by IT operations teams during the year without being reflected in the EA committed quantity. At true-up, each add-on is reconciled separately, and over-deployment in add-on products generates charges at their respective list prices (often without the EA discount that applies to the core M365 products).

Teams Phone is the most common add-on surprise. It is trivial to enable in the Teams admin centre, can be assigned by departmental IT administrators without central oversight, and carries a per-user cost of approximately £8.00/month. An organisation that enables Teams Phone for 300 users above the committed pool generates a £28,800 true-up charge for the year — entirely avoidable with monthly add-on tracking.

Category 3: Copilot Tracking Failures

Since 2024, Copilot has become its own true-up category. Copilot licences are assigned through a separate add-on SKU and tracked independently in the true-up. Organisations that piloted Copilot mid-year, expanded informally, or enabled Copilot through group-based licensing rules without central tracking regularly encounter Copilot true-up charges they did not budget for. At £24.70/user/month, 200 untracked Copilot deployments generate a £59,280 annual true-up charge. For Copilot commercial details, see our Copilot licensing guide.

Category 4: Entity and Geography Complications

For multinational enterprises, the true-up consolidates M365 deployments across all entities covered by the EA. Users at recently acquired subsidiaries, temporary contract workers provisioned by subsidiary IT teams, and users at entities added to the EA mid-year all count against the consolidated committed quantity. The most common surprise in this category is the acquisition — a subsidiary acquired in Q2 brings 500 M365 users that were licensed under a separate agreement; those users are migrated to the parent EA by Q3; at true-up, the EA committed quantity does not reflect the 500 new users. The true-up captures the peak including the new users; the billing is calculated at the parent EA's negotiated unit prices (which may be different from the acquired company's prior pricing).

True-up approaching? Get ahead of it.
We run pre-true-up exposure assessments — identifying and quantifying your true-up risk before Microsoft runs their reconciliation, with a remediation plan to reduce the charge.
Pre-True-Up Review

The Quarterly M365 Licence Governance Framework

True-up surprises are a governance failure, not a licensing mechanics failure. The organisations that avoid true-up surprises are those with a quarterly licence governance cadence that takes less than 4 hours per quarter to execute. The framework has three components:

Monthly Licence Count Check (15 minutes)

Export the M365 admin portal's licence report for all active products. Compare each product's deployed count against the EA committed quantity. For any product where deployment is within 10% of committed, flag for quarterly review. For any product where deployment exceeds committed, escalate immediately — this is a current true-up exposure that should be addressed proactively, not discovered at true-up.

The M365 admin portal provides these reports under Reports > Microsoft 365 Usage or through the Billing > Licences section. For organisations using Entra ID group-based licensing, run the group membership report alongside the licence report to catch assignments that may not appear in the standard licence count immediately.

Quarterly Licence Reconciliation (2 hours)

Once per quarter: (1) Run the full M365 admin licence inventory by product and user; (2) Identify users with licences assigned who have not logged in for 90+ days (potential inactive accounts); (3) Reconcile add-on products (Teams Phone, Copilot, Power BI Pro) against committed quantities; (4) Update the true-up exposure forecast — a rolling estimate of what the true-up will cost if behaviour continues at the current trajectory; (5) Review any new entity additions, contractor provisioning, or acquisition impacts that have occurred in the quarter.

The output is a quarterly licence position summary: committed quantities by product, current deployed quantities, peak deployed quantities year-to-date, and the current estimated true-up exposure. This document is the foundation of the pre-true-up negotiation discussion with Microsoft. For inactive account harvesting methodology, see our M365 licence harvesting guide.

Pre-True-Up Remediation (6–8 weeks before anniversary date)

Six weeks before the EA anniversary date, run the full true-up exposure assessment and execute remediation where possible. Remediation options at this stage are limited by the "peak deployment" rule — you cannot reduce what has already occurred — but there are specific actions that can reduce the charge:

  • Deactivate unused add-ons: If Teams Phone or Copilot deployments above committed quantities occurred in Q3 and Q4 but not Q1/Q2, the peak for those products may be the Q3/Q4 figure. Confirm your peak month from admin reports — if the peak occurred recently, deactivating before the anniversary date does not change the peak, but it prevents the situation from worsening.
  • Negotiate true-up price terms: For over-deployment above committed quantities, Microsoft bills at the EA unit price for the period of over-deployment (prorated from the date of excess). Before accepting the true-up invoice at face value, negotiate: (a) the per-unit price applied to the over-deployment (seek your EA negotiated rate, not list); (b) whether the over-deployment can be retroactively covered by an in-term upsize amendment at contracted rates rather than true-up rates; (c) whether any truly inadvertent provisioning errors can be recategorised.
  • Document any over-deployment that was outside your control: M365 licence deployments driven by Microsoft-initiated changes (automatic feature enablements, licence migrations by Microsoft support teams, group policy changes by Microsoft partners) are contestable. Document the source of over-deployment before the true-up discussion.

True-Up vs. Microsoft Audit: Understanding the Difference

The M365 true-up and a Microsoft software audit are distinct — but the distinction matters commercially. A true-up is a contractually scheduled reconciliation under the EA — you self-report your deployment, and Microsoft invoices for over-deployment. An audit is a formal examination of your licence deployment, typically triggered by Microsoft's compliance team, which may examine on-premises Microsoft software (Office, SQL Server, Windows Server) as well as cloud services.

M365 cloud services are generally not the primary target of Microsoft software audits — cloud subscription licences are continuously visible to Microsoft through the admin portal, and formal audit is less necessary. However, organisations that are under-compliant on M365 (deploying more than committed) and simultaneously have on-premises software complexity may find that an audit examines the combined position. For a detailed analysis of audit risk and defence strategy, see our True-Up and Compliance topic hub and the Microsoft Audit Defence Playbook.

Using True-Up Data at Renewal

The true-up data you collect over the EA term is not just compliance documentation — it is negotiation intelligence. Your year-on-year peak deployment data shows the trajectory of your M365 consumption: growing, flat, or declining. This trajectory directly informs your renewal commitment quantity and is your primary evidence base for the following renewal negotiation discussions:

If your peak deployment has consistently been 5–12% above your committed quantity, you have been over-deploying. At renewal, right-size your committed quantity to your actual peak rather than your original commitment. Do not allow Microsoft to renew on the same committed base if the true-up data shows systematic over-deployment — this locks in continued over-exposure.

If your peak deployment has been below your committed quantity for 2+ years, you have shelfware. At renewal, negotiate a reduction in the committed quantity to match the actual utilisation level. Microsoft will resist this — the account team has revenue targets tied to maintaining committed quantities — but the true-up data makes the case incontrovertibly. See our M365 cost reduction at renewal guide for the full renewal optimisation framework and our M365 Enterprise Licensing Guide for the broader context.