The Microsoft audit you run yourself, before the worksheet runs you
A Microsoft license audit is the gap between three numbers: what the agreement says you bought, what is assigned in the admin center, and what people actually sign into and use. The vendor true up worksheet starts from entitlements and headcount, which buries the idle seats no one questions, and across our audits, the estate carried licenses nobody had reconciled to actual sign in and feature usage.
Prepared by Redress Compliance · August 8, 2026 · Microsoft advisory. Based on 30 to 45 Microsoft license audits run 2024 to 2025.
Executive summary
The idle tail is the largest and fastest recovery, and the tenant average hides it. Around 12 to 22 percent of assigned M365 licenses showed no active usage in the trailing 90 days, an 18 percent median across our audits, sitting in dormant accounts, leavers never deprovisioned.
And licenses paid but never assigned.
A 70 percent tenant average can hide a third of seats at near zero use, which is why the audit reads sign in and feature activity at the individual user level, never the tenant summary.
The E5 premium goes unused in a quarter to a third of the seats carrying it. Between one in four and one in three E5 seats never used the security or compliance features that justify the premium, 30 percent in the engagement median: the second largest leak after idle seats.
And the fix is a step down to E3 for every user whose measured activity never touches the E5 feature set.
The signal table is short: no sign in for 90 days means reclaim, E5 with no security use means step down, and a paid tool overlapping M365 means retire the duplicate.
More than half the estates paid twice for capabilities already in the plan.
Third party tools duplicating security, compliance, or telephony already inside the M365 subscription are pure waste, and more than half the estates paid for at least one: the plan contents compared against the published plan matrix is the checklist.
And every retired duplicate is saving that needs no negotiation at all.
The audit runs from three sources reconciled against each other, entitlements from the agreement, assignments from the admin center, usage from the reports, and never from the vendor worksheet.
The true up is a reconciliation you run months early, or an invoice you receive at the anniversary.
The true up bills the gap between entitlements and deployment on the anniversary date, so the buyer reconciles on their own clock: deployment mapped against entitlement by SKU, idle seats reclaimed and SKUs stepped down before the date rather than after.
And the next term sized on reconciled usage plus a documented growth band. The vendor worksheet is not an audit, it is an invoice waiting to happen, because it starts from entitlements and headcount and buries the 12 to 22 percent the usage data would surface.
The audit signals, and the move each triggers
| Signal | What it means | The buyer move |
|---|---|---|
| No sign in for 90 days | A dormant or leaver account | Reclaim the license |
| E5 with no security or compliance use | An over assigned SKU | Step down to E3 |
| A paid tool overlapping M365 | Duplicate spend | Retire the duplicate |
| Licenses purchased but unassigned | Shelfware at full price | Cut at the next true up |
| Deployment above entitlement | A true up charge building | Fix before the anniversary, on your clock |
Work the four savings pools in order of size and speed, not difficulty.
Idle and unassigned seats first, the largest and fastest recovery; over assigned SKUs second, the E5 on users who only ever touch E3 features; duplicate tooling third, the paid overlap with security, compliance, and telephony already in the plan.
And leaver accounts throughout, because deprovisioning discipline is what keeps the first pool from refilling.
Each pool converts directly into renewal leverage, since every reclaimed seat is a smaller baseline to negotiate from.
The method, three sources and a user level read
- Export the three sources: entitlements by SKU and quantity from the agreement, assignments from the Microsoft 365 admin center, and usage from the reports.
- Reconcile them against each other, never against the vendor worksheet, because the audit is the gap between bought, assigned, and used.
- Read usage at the user level: the tenant average hides the idle tail where the recovery lives, and a healthy looking 70 percent can conceal a third of seats at near zero.
- Flag every license with no active sign in over 90 days, the reclaim list that funds the rest of the program.
- Compare plan contents against the published plan matrix, the duplicate tool checklist more than half of estates fail.
The Microsoft EA renewal playbook
The reconciled position brought into the renewal: the seven levers, the twelve month calendar, and the population mix worked end to end.
Get the white paper →The true up, reconciled early or paid late
The anniversary bills the gap between entitlements and deployment, and the surprise is optional: map deployment against entitlement by SKU months ahead, reclaim the idle seats and step down the over assigned SKUs before the date rather than after it.
And size the next term on reconciled usage plus a documented growth band instead of the account team's forecast.
The common advice, wait for the renewal and let Microsoft run the true up worksheet, is how the 12 to 22 percent stays buried, because the worksheet starts from entitlements and headcount and never asks whether anyone signed in.
The reconciled position then feeds the bigger negotiations: the SKU mix arithmetic in the license types comparison, the E5 step decision in the F3 versus E3 analysis, and the renewal strategy in the EA negotiation guide.
- Percentile standing for your exact deal size and industry, from real closed transactions
- Scenario simulation before the call: test alternative terms and see the financial impact of each
- A negotiation playbook, talking points, and a two page executive brief on day one
What we saw across license audits, 2024 to 2025
Across roughly 30 to 45 Microsoft license audits Fredrik Filipsson ran in 2024 and 2025, the estate carried licenses no one had reconciled to actual sign in and feature usage:
Of assigned seats showing no activity, the fastest recovery in every estate.
Seats never opening the security or compliance features that priced the step up.
The documentation is the second dividend: a clean inventory of entitlements, assignments.
And usage is renewal leverage on the way in and audit defense on the way out, because the position that answers Microsoft's true up worksheet from its own reconciled data negotiates the anniversary, while the position that accepts the worksheet pays it.
The audit is not a one time project either, the idle tail refills with every leaver and every project that ends, so the 90 day sign in sweep runs quarterly and the reclaimed licenses cover growth before any new purchase does.
Your first five moves
- Export entitlements, assignments, and usage and reconcile the three against each other, never the vendor worksheet.
- Reclaim every license with no sign in over 90 days, the 12 to 22 percent that funds everything else.
- Step down E5 seats with no security or compliance use to E3, the quarter to a third paying an unused premium.
- Retire the third party tools duplicating plan capabilities, the overlap more than half of estates pay twice for.
- Reconcile before the anniversary, on your clock, and bring the position to the renewal. The Microsoft practice runs the audit with you.
Frequently asked questions
How do you audit Microsoft license usage?
From three sources reconciled against each other: entitlements by SKU from the agreement, assignments from the Microsoft 365 admin center, and usage from the reports, read at the individual user level because the tenant average hides the idle tail.
The audit is the gap between what you bought, what you assigned, and what people actually use, and it never starts from the vendor's true up worksheet.
How many Microsoft licenses sit unused?
Around 12 to 22 percent of assigned M365 licenses showed no active usage in the trailing 90 days across our audits, with an 18 percent median, sitting in dormant accounts, unreturned leaver licenses, and purchased but unassigned seats.
The idle tail is the largest and fastest recovery in most estates, and it converts directly into renewal leverage.
Are E5 licenses worth it?
Only for users who consume the step up: between one in four and one in three E5 seats never used the security or compliance features that justify the premium, and the fix is measuring feature activity per user and stepping the inactive population down to E3.
The E5 case is real where the security stack is deployed and consumed, and pure premium where it is not.
What Microsoft 365 features duplicate third party tools?
Security, compliance, and telephony capabilities inside the plan overlap with standalone tools in more than half the estates we audited: the check is comparing your plan contents against the published plan matrix and retiring the paid duplicates.
Every retirement is saving that requires no negotiation, only an inventory nobody had run.
How do you avoid a Microsoft true up surprise?
Reconcile on your own clock, months before the anniversary: map deployment against entitlement by SKU, reclaim idle seats and step down over assigned SKUs before the date, and size the next term on reconciled usage plus a documented growth band.
The true up bills the gap at the anniversary, so the buyer who closes the gap early has nothing to be surprised by.
Why not use Microsoft's true up worksheet?
Because it starts from entitlements and headcount, not usage, which buried the 12 to 22 percent of idle seats in our audits: the worksheet is not an audit, it is an invoice waiting to happen.
The buyer side audit runs from sign in and feature data months ahead, reclaims and right sizes first, and brings a reconciled position to the renewal instead of receiving one.
