What this check looks at
Finds disabled accounts that still hold paid licences.
Blocking sign-in on a Microsoft 365 account (disabling it) does not remove its licences. The licence stays assigned, keeps a seat occupied and is billed every month, although nobody can use it. Many leaver processes stop at disabling the account, so the licences are never reclaimed.
This check finds disabled accounts that still hold a paid licence (free and trial licences are ignored) and prices them at indicative UK list prices. The check fails when more than three disabled accounts hold paid licences, and warns when one to three do.
Removing the licence is skipped because it is not a one-click decision: when an Exchange Online licence is removed, the mailbox is deleted after 30 days unless it has been converted to a shared mailbox or placed on hold, and an unlicensed OneDrive falls under Microsoft’s rules for unlicensed accounts. The safe order is to keep what is needed first, then remove the licence.
Why it matters
A disabled account cannot use its licence, but the licence is still invoiced. This is usually the residue of a leaver process that stops at "disable" and never reaches "reclaim".
A typical case: a 120-person company disables leavers promptly but never removes their licences. Two years on, 18 disabled accounts hold Microsoft 365 Business Premium and two hold E5: several thousand pounds a year at list price for accounts nobody can sign in to.
Reclaiming them is a recurring saving with no effect on current staff, and converting a leaver’s mailbox to shared keeps their mail available to colleagues without a licence, as long as it is under 50 GB with no archive or litigation hold.
ISO 27001 A.5.11 (return of assets) covers reclaiming what a leaver held. CIS Controls v8 safeguard 2.1, the NCSC 10 Steps asset management guidance and the NCSC CAF asset management outcome expect licences to be tracked against use.
How to fix it
Where: Microsoft 365 admin centre → Users → Active users
Before you start
- For each account, decide whether the mailbox or OneDrive must be kept; convert mailboxes to shared first (under 50 GB, no licence needed).
- Check for litigation hold, which needs a licence to be kept.
Step by step
- List the accounts and what they hold. In the Microsoft 365 admin centre go to Users > Active users, filter on Sign-in blocked (or use the evidence list) and show the Licences column. For each account, note the licences and whether its mailbox or OneDrive still holds anything colleagues need.
- Check for holds and large mailboxes. In the Exchange admin centre (admin.exchange.microsoft.com), Recipients > Mailboxes, open each mailbox and check its size and whether litigation hold or an archive is on. A shared mailbox over 50 GB, with an archive, or on litigation hold still needs an Exchange Online licence, so keep that licence or move the content first.
- Convert mailboxes that must be kept. In the Exchange admin centre, Recipients > Mailboxes, select the mailbox and choose Convert to shared mailbox, then give colleagues access under Delegation (Read and manage). In Exchange Online PowerShell the same is Set-Mailbox -Identity <upn> -Type Shared, then Add-MailboxPermission -Identity <upn> -User <colleague> -AccessRights FullAccess.
- Keep OneDrive content that is needed. In the Microsoft 365 admin centre, open the user, select the OneDrive tab and use the option to create a link to their files for the manager. Move anything the business needs to a SharePoint site before the licence goes.
- Remove the licences. Open each account in Users > Active users > Licences and apps, untick the paid licences and Save. If a licence comes from group-based licensing, remove the account from that group instead. In Microsoft Graph PowerShell: Set-MgUserLicense -UserId <upn> -AddLicenses @() -RemoveLicenses @("<sku id>").
- Make it part of the leaver process. Add “convert the mailbox, secure OneDrive, remove licences” to the client’s leaver checklist with an owner and a deadline, for example within 14 days of the leaving date.
- Confirm and bank the saving. Filter Users > Active users on Sign-in blocked again: no account should show a paid licence. Then reduce the subscription quantity (see the unassigned licences finding) to turn the freed seats into a saving. The finding clears at the next assessment.
With PowerShell
Set-Mailbox -Identity <upn> -Type Shared
What users will notice
None; the accounts are disabled.
How to confirm it worked
The disabled accounts in the evidence hold no licences at the next assessment.
Frameworks and controls
This check maps to controls in 5 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | A3.a Asset management |
| ISO 27001:2022 | A.5.11 Return of assets |
| CIS Controls v8.1 | 2.1 Establish and maintain a software inventory (IG1) |
| NIST CSF 2.0 | ID.AM-02: Inventories of software, services, and systems managed by the organization are maintained |
| NCSC 10 Steps | Asset management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Remove licences from users (Microsoft Learn)