Microsoft License Utilisation Analytics: Complete Enterprise Framework

In our most recent analysis of 50 enterprise Microsoft EA engagements, the median organisation had 17.3% of its M365 licences assigned to users who had not performed a single measurable activity in the preceding 90 days. At $32/user/month for M365 E3, that represents $594,000 per year in wasted spend for a 3,000-user organisation — before any analysis of users who are active but licensed at the wrong tier. Licence utilisation analytics is the highest-return investment in Microsoft cost management, with a typical payback period of 30–90 days from analytics to licence reduction to savings realised.

The Two Dimensions of Utilisation Analysis

Licence utilisation analytics operates across two dimensions that must be analysed independently. Seat utilisation measures whether licensed users are actively using any feature of the product — the binary question of "are they using it at all?" Feature utilisation measures which specific features licensed users are actually using — the tier-appropriateness question of "are they using features that justify their licence tier?"

An organisation with 95% seat utilisation for M365 E5 might appear to be efficiently licensed — almost every E5 licence is assigned to an active user. But if 60% of those E5 users have zero activity in E5-exclusive features (Defender for Endpoint P2, Purview eDiscovery Premium, Teams Audio Conferencing, Power BI Pro included in E5), those users are paying $57/month for E5 when $36/month E3 would fully serve their needs. Feature utilisation analysis is where the highest-value savings opportunities hide.

Data Extraction: Getting the Utilisation Numbers

Microsoft 365 Admin Centre Usage Reports

The M365 Admin Centre provides built-in usage reports for all M365 workloads under Reports > Usage. Available reports: Microsoft 365 Apps usage (per-application activity by user), Exchange Online activity (email sent/received counts), Teams activity (meetings, calls, messages), SharePoint activity (files viewed/edited), OneDrive activity (files synced/shared), Yammer activity, and Microsoft Forms activity. All reports support four time windows: 7, 30, 90, and 180 days.

Critical technical note: since October 2021, Microsoft anonymises user-level usage data by default in new tenants under GDPR privacy controls. The Reports > Settings section allows Global Admins to re-enable identified reporting (showing actual usernames rather than anonymised IDs). Without re-enabling identified reporting, user-level utilisation analysis — necessary for licence harvesting — is not possible through the native portal. The Microsoft Graph API (Reports endpoint) also respects this setting, so programmatic extraction does not circumvent the anonymisation.

Azure Active Directory Sign-In Logs

Azure AD (now Entra ID) sign-in logs provide the simplest utilisation proxy: last sign-in date for every licensed account. Users who have not signed in to any Microsoft service in 90+ days are the highest-confidence harvest candidates — they are inactive across the entire Microsoft stack, not just specific workloads. Sign-in logs are available under Entra admin centre > Monitoring > Sign-in logs, exportable to Azure Monitor, Log Analytics, or directly via the Microsoft Graph API (auditLogs/signIns endpoint). Important caveat: service accounts, shared mailboxes, and conference room accounts have no interactive sign-in but may have legitimate licence assignments — filter these out before calculating active user rates.

Microsoft Graph API for Programmatic Extraction

For organisations managing 2,000+ users, manual portal reporting is operationally impractical for monthly utilisation tracking. Microsoft Graph API provides REST endpoints for all M365 usage reports, enabling automated monthly extraction into data warehouses, Power BI datasets, or Excel models. The primary endpoints are: /reports/getOffice365ActiveUsersDetail (all workload activity per user), /reports/getMicrosoft365AppsUserDetail (app-level usage), /reports/getTeamsUserActivityUserDetail (Teams activity), /reports/getSharePointActivityUserDetail (SharePoint). Authentication requires an app registration with Reports.Read.All permission. Build time for a basic automated extract-and-model process: 2–5 days for a competent developer.

The Four Utilisation Buckets and Optimisation Actions

E5 Feature Utilisation: The High-Value Downgrade Analysis

Microsoft 365 E5 costs $57/month per user at list price — $21/month more than E3 at $36. That premium buys access to: Defender for Endpoint P2 (advanced endpoint security), Purview eDiscovery Premium (AI-assisted legal holds), Purview Compliance Manager Premium (compliance score with guided actions), Teams Audio Conferencing (PSTN dial-in for meetings), Power BI Pro (included in E5), Microsoft Phone System (calling via Teams), and Entra ID P2 (Privileged Identity Management, Identity Protection). If a licensed E5 user has no activity in any of these E5-exclusive features over 90 days, they should be an E3 user.

Measuring E5-Exclusive Feature Activity

E5 feature utilisation measurement requires cross-referencing multiple data sources. Defender for Endpoint P2 activity: available via Defender portal > Reports > Device reports. Users whose devices are enrolled and have active P2 policies are legitimate E5 users from a security perspective. Teams Audio Conferencing activity: available in Teams Admin Centre > Analytics & Reports > Usage reports. Users who have never dialled into a Teams meeting via PSTN have no audio conferencing utilisation. Power BI Pro activity: available in Power BI Admin Portal > Usage Metrics. Users who have never viewed or created a Power BI report included in E5 have zero Power BI value from their E5 licence. Purview eDiscovery Premium: available in Microsoft Purview compliance portal > eDiscovery. This is a specialist function — expect fewer than 10% of a licensed population to be active eDiscovery users in any given quarter.

For a comprehensive M365 E5 vs E3 analysis, see the E3 vs E5 Cost Comparison Guide.

The Licence Harvesting Process

Licence harvesting is the operational execution of utilisation analysis findings — the process of removing licences from inactive or over-tiered users and recovering the associated cost. The process involves five steps that must be completed in order to avoid business disruption and ensure compliance with Microsoft licensing terms.

Step 1 is the inactive user report: generate a list of users with no M365 activity in 90+ days, cross-referenced with Entra ID last sign-in data. Remove known exclusions: service accounts, room/equipment mailboxes, shared mailboxes, accounts on documented leave. Step 2 is manager validation: for the remaining inactive list, send a structured survey to line managers asking them to confirm: (a) is this user still employed, (b) do they have a documented business reason for inactivity, (c) should their licence be retained. This step prevents 15–20% of the inactive list from being incorrectly harvested. Step 3 is the pre-harvest notification: send a 14-day notice to inactive users that their Microsoft licence will be removed unless they log activity or provide business justification. This protects against inadvertent removal of users who are active via mobile apps that do not register in desktop usage reports. Step 4 is licence removal: at the specified date, remove licences for all validated inactive users. For M365 users, removing the licence preserves mailbox data for 30 days in a disconnected state — data recovery is possible if the harvest was incorrect. Step 5 is the renewal reduction: document the harvested licence count and translate it into a licence reduction request at the next True-Up or EA amendment. Harvesting without reducing committed seat counts does not realise cost savings — the critical last step is converting inactive licence removal into a reduction in your EA commitment.

Utilisation Analytics Case Study: 4,200-User M365 E5 Deployment

A professional services firm with 4,200 M365 E5 users at $56/user/month (negotiated rate) engaged us for a utilisation review 14 months into their three-year EA. Annual E5 spend: $2.82M. Utilisation analysis findings: 380 fully inactive accounts (9% — no activity in 90+ days), 720 E5 users with zero E5-exclusive feature activity (17% — active on email and Teams but no Defender, Purview, or Audio Conferencing activity), 240 E5 users using only Teams Audio Conferencing as their E5-exclusive feature (6% — conferencing users only).

Recommendation: remove 380 inactive licences ($255,360/year saving), downgrade 720 over-tiered users to E3 at renewal ($15.1M → E3 $38/user/month negotiated, saving $18/user/month × 720 × 12 = $155,520/year), maintain 240 Audio Conferencing users on E5 (Audio Conferencing add-on would cost $6/user/month × 240 × 12 = $17,280 more than the E5 downgrade saving — E5 remains the better value for this group). Total first-year saving: $410,880. Achieved through a mid-term EA amendment for inactive licence reduction (approved at month 15) and tier restructuring at renewal.

Utilisation Data and Negotiation Leverage

Utilisation data creates negotiation leverage in two specific ways. First, it justifies volume reduction: when you approach Microsoft to reduce your committed seat count, utilisation data is the evidence. Without it, Microsoft will argue that your contracted volume represents your organisation's strategic commitment. With 90+ days of utilisation data showing sustained inactivity, you have an objective basis for the reduction that is difficult to dispute. Second, it identifies over-tiering at scale: an organisation that can demonstrate 25% of its E5 population has never used an E5-exclusive feature has a compelling argument for a partial E5 → E3 conversion at renewal, which Microsoft's account team will want to propose alternatives to — creating the negotiating dynamic that drives price concessions on the retained E5 seats.

See the full Microsoft Licensing Analytics & Benchmarking Guide and the KPIs & Dashboards framework for the complete analytics-to-negotiation framework.

Frequently Asked Questions

How do I extract Microsoft licence utilisation data?

Microsoft 365 utilisation data is available from the M365 Admin Centre under Reports > Usage. It provides 7, 30, 90, and 180-day activity windows for all M365 workloads at tenant and user level. For programmatic extraction, Microsoft Graph API provides REST endpoints for all usage reports. Azure Active Directory sign-in logs provide last-sign-in dates for all licensed accounts, identifying zero-activity users.

What counts as an 'active user' in Microsoft 365?

Microsoft defines 'active user' differently by workload. Exchange: sent or received at least one email. Teams: attended a meeting, made a call, sent a message, or used Teams chat. SharePoint: viewed, edited, or synced a file. OneDrive: viewed, edited, shared, or synced a file. Product-level activity measurement is more useful than the aggregate 'active M365 user' count.

How much can you save by harvesting unused Microsoft licences?

Typical finding: 8–22% of licensed M365 seats are inactive over 90 days. For a 3,000-user M365 E3 deployment, a 15% inactive rate equals 450 licences × $32/month × 12 = $172,800/year. E5 harvesting is higher-value: 450 E5 licences at $57/month = $307,800/year. Harvesting is the fastest-return Microsoft optimisation — results in 30–60 days.

How long should I observe before harvesting a licence?

The minimum observation window is 90 days. A 30-day window creates false positives — users on leave or extended projects may appear inactive but have legitimate needs. For senior executives and regulated roles (finance, legal, compliance), use 180-day windows and stakeholder sign-off before harvest.

What is a normal utilisation rate for Microsoft 365 E5?

E5 utilisation analysis should measure at two levels: seat utilisation (active E5 users vs total E5 licences — target 85%+) and feature utilisation (E5-exclusive features actively used — target 60%+ of E5 features). Low feature utilisation even with high seat utilisation indicates tier misalignment — users are licensed for E5 but only using E3-level features.