Why Over-Licensing Is the Norm, Not the Exception
The default trajectory of a Microsoft Enterprise Agreement is upward. True-up mechanisms add licences when deployment exceeds the committed count. User growth adds more. Product upgrades increase per-seat cost. Over three years, the total commitment expands. At renewal, Microsoft's opening position is anchored to the highest-deployed-count during the term — often significantly higher than actual current need.
The result: most enterprise organisations renewing an EA are over-licensed relative to genuine need. Studies across our engagements consistently show 15–25% licence surplus — seats committed and paid for that are either undeployed, duplicated across products, or assigned to users who left the organisation. At an average M365 E3 cost of €30+ per user per month, a 500-seat surplus on a 5,000-seat EA represents over €1.8M wasted across a three-year renewal cycle.
Reducing that surplus requires three things: accurate evidence of actual deployment, a methodologically defensible count that Microsoft's account team cannot easily dispute, and a negotiation strategy that deploys this evidence at the right moment in the renewal process. This article provides the practical framework for all three. For context on the full EA renewal process, see our complete guide to Microsoft EA negotiation.
Avg surplus vs. active users
Avg surplus vs. active deployments
Avg surplus vs. active licensed users
Building the Evidence Base: Deployment Analysis
Microsoft Entra ID (formerly Azure AD) is the authoritative source for active user data. A user is actively assigned a licence if they appear in Entra ID with the licence assignment active and have authenticated within a defined activity window — typically 90 days. Users outside that window are inactive and represent recovery candidates. Microsoft 365 Admin Centre provides usage reports at the individual user and product level, showing which licences are assigned, which applications within each licence are actively used, and last activity dates.
The key data points to extract for each product category: total licences assigned, licences assigned to active users (authenticated within 90 days), licences assigned to inactive users, licences assigned to service accounts or non-human identities, and licences assigned but with zero product-level usage (assigned but never activated). Each of these categories represents a different type of over-assignment with different recovery paths.
Inactive User Licences
Users who have not authenticated for 90+ days are genuine recovery candidates. In most enterprise environments, this includes leavers whose accounts were not promptly de-provisioned, contractors whose engagement ended without licence recovery, and shared-role users whose functions were consolidated. Recovering these licences before renewal reduces the count Microsoft is anchoring to.
The process: run an Entra ID report on last sign-in dates, filter for users with licences assigned and last sign-in older than 90 days, cross-reference against HR records to confirm employment status, and de-provision licences for confirmed leavers. This process should be completed 4–6 months before renewal, not in the final month. Last-minute de-provisioning before a renewal raises account team suspicion and may not flow through to the official count by the time the true-up is calculated.
Duplicate Licence Coverage
In M365 environments, duplicate coverage is common. A user might have M365 E5 (which includes Teams Phone, Defender, and advanced compliance) plus a separately purchased Defender for Endpoint P1 licence (already included in E5). Or a user might have E3 plus a standalone Teams Essentials licence (redundant because E3 includes full Teams). These duplications arise from product additions made without removing superseded individual licences. The recovery requires a licence audit mapping all assigned licences by user to identify where multiple licences provide overlapping entitlements.
SKU Right-Sizing: E5 vs. E3 Analysis
The most significant licence count reduction opportunity is often not absolute count reduction but SKU right-sizing — identifying users who are assigned E5 licences but do not use the features that justify the E5 premium. If 40% of your E5 users have never activated Defender, Sentinel, or the advanced compliance tools that differentiate E5 from E3, those users could be served by E3 at roughly 40% lower per-user cost. This is not about removing licences from the count — it is about reducing the per-unit cost through accurate tier assignment. Our E3 vs E5 cost comparison guide provides the full analytical framework for this assessment.
Methodology: Making Your Count Defensible
Microsoft's account team will scrutinise any significant proposed reduction in licence count. Their standard objection: "Your deployment data shows X users active, but our records show Y licences assigned — the difference is your true-up liability, not recoverable licences." Defending a licence reduction requires methodology that addresses this objection directly.
The methodology must establish: the data source used for the active user count (Entra ID, HR system), the activity threshold applied (90-day window is the standard; Microsoft uses this same threshold in its own usage reporting), the date the analysis was run (should be current, within 30 days of the renewal proposal), and the treatment of service accounts, room accounts, and shared mailboxes (which are typically excluded from per-user licence requirements under specific conditions).
Your licence count proposal must reference the same data sources Microsoft uses internally. If your count is based on Entra ID active user data and the 90-day activity window that Microsoft's own admin centre uses for usage reporting, it is methodologically equivalent to Microsoft's reporting and difficult to dispute on purely technical grounds. Counts derived from HR systems alone, or from informal desktop surveys, are less defensible.
Timing the Count Reduction: When to Present Your Analysis
The timing of your licence count reduction proposal within the EA renewal negotiation is critical. Presenting it too early — before headline pricing is established — allows Microsoft to absorb the reduction and anchor the remaining pricing conversation at a higher unit rate to compensate for lower volume. Presenting it too late — after commercial terms are essentially agreed — means the account team treats it as a breach of the implicit volume commitment they were working with.
The optimal timing: present your licence count analysis formally, in writing, as a component of your overall renewal proposal, at the point where Microsoft has provided its first commercial offer. Your proposal says, in effect: "We have conducted a deployment analysis. Our current active deployment is X. Our renewal commitment should be based on X, not on the prior term's peak deployment. Here is the methodology and data supporting this position." This forces Microsoft to engage with the data directly rather than treating it as a pre-negotiation skirmish.
This timing also allows you to use the licence reduction as a negotiating variable. If Microsoft resists the full reduction, you have room to trade: accept a smaller reduction in exchange for improved per-unit pricing, or accept the full reduction in exchange for a true-up pricing provision (overage licences priced at locked rates). The licence count and the per-unit price are separate variables — treat them as such. Our guide on EA price lock vs. flexibility explains the full range of variables available in renewal negotiations.
The Six-Step Licence Reduction Process
Extract the full licence assignment inventory
Pull every licence assignment from Microsoft 365 Admin Centre and Entra ID. This includes all active, suspended, and grace period accounts. Export by user with last sign-in date, assigned products, and product-level usage. This is your baseline dataset — run it at least 4 months before renewal.
Categorise accounts by activity and purpose
Segment every licenced account into: active human users (sign-in within 90 days), inactive human users (no sign-in for 90+ days), service accounts, room/resource accounts, shared mailboxes, and external users. Each category has different licence recovery rules.
Cross-reference inactive accounts against HR records
For inactive human user accounts, validate employment status against HR records. Accounts confirmed as leavers should have licences de-provisioned immediately. Accounts that appear inactive but are current employees require investigation — they may be on leave, or may have switched to a lower-licence account. Do not remove licences for current employees without verification.
Identify duplicate coverage and SKU mis-assignments
For each active user, map all assigned licences and identify duplicate coverage (licences that include features already provided by another assigned licence) and SKU over-assignment (users on E5 who only use E3-level features). Produce a recommended right-sized licence assignment for each user category.
Implement changes 3 months before renewal
Execute the licence de-provisioning and right-sizing changes no later than 3 months before your EA renewal date. This allows the changes to be reflected in Microsoft's system before the true-up calculation window opens. Changes made within 30 days of renewal may not be recognised in the true-up count, leaving you paying for licences you've already removed.
Document and present the analysis with your renewal proposal
Compile the complete deployment analysis — baseline count, recovery categories, methodology, and resulting proposed commitment — into a formal document. Present this to Microsoft's account team as a component of your written renewal proposal, explicitly stating that your renewal commitment is based on this documented active deployment count, not on the prior term's peak.
Handling Microsoft's Standard Objections to Count Reductions
Microsoft's account team will typically deploy three objections to a significant licence reduction proposal. The first: "Your true-up count from last year shows X — you can't reduce below that." Counter: the true-up count reflects the peak deployment during the last 30 days of the prior term. It does not reflect current need, especially if organisational changes have occurred. Your renewal commitment is a forward-looking commitment, and forward commitments should be based on current and projected need, not historical peaks.
The second objection: "Reducing your commitment will move you out of the discount tier." Counter: the discount is a variable you are actively negotiating — it is not a fixed constraint. If reducing your licence count reduces the discount tier, the correct commercial response is to negotiate the discount independently of the count, not to inflate the count to maintain a discount tier. The two variables should be decoupled.
The third objection: "Your active user count analysis doesn't account for growth." Counter: growth is incorporated into the true-up mechanism. The renewal commitment represents your current need. Projected growth is paid for at true-up, in the next term, not pre-committed three years in advance. This is the purpose of the true-up mechanism — it exists precisely to account for deployment growth beyond the commitment. For organisations where growth is certain, negotiating a lower renewal commitment with a true-up pricing protection (overage licences at locked rates) is the correct structure, as we explain in our price lock and flexibility guide.
Making Licence Recovery a Renewal Habit
Licence count analysis should not be a one-time renewal activity. The organisations that consistently renew their EAs at optimal counts are those that conduct quarterly licence hygiene reviews — removing leavers promptly, reviewing inactive accounts, assessing SKU fitness for new joiners as they are onboarded. The quarterly review process reduces the size of the recovery task at renewal and prevents the three-year licence drift that produces large surplus counts.
For the EA renewal itself, integrating the licence count reduction analysis into the preparation process that begins 12 months before expiry — as described in our EA renewal preparation guide — gives you maximum time to implement changes, build the evidence base, and position the reduction as a principled, data-driven proposal rather than a last-minute challenge to Microsoft's count. The organisations that achieve 20%+ licence reductions at renewal are those that start the process early, document everything, and present their analysis as fact rather than negotiating position.
If you are approaching a renewal and need support with the deployment analysis, licence recovery process, or negotiation of a count reduction, our M365 optimisation service and EA negotiation service provide both the technical analysis and the commercial advisory to achieve the right-sized commitment.