How to find licences on dormant Microsoft 365 accounts

What this check looks at

Finds enabled but long-dormant accounts that still consume paid licences.

An account can stay enabled and licensed long after anyone uses it: a leaver whose account was never disabled, someone on long-term leave, a shared or test account created years ago, a role that was never filled. Microsoft 365 keeps billing the licence and keeps the account able to sign in.

This check looks at enabled member accounts that hold a paid licence and finds those with no interactive sign-in for more than 90 days, or none recorded at all. The check fails when such accounts make up 5 per cent or more of enabled members, and warns when there are some but fewer than 5 per cent. It reports that it could not check when sign-in activity is unavailable, which needs Entra ID P1.

These are two problems in one: wasted spend, and an unmonitored credential with mail, files and group memberships attached. The check counts interactive sign-ins only, so someone who leaves Outlook running for months can look dormant here; confirm with the usage reports before removing anything.

Why it matters

Dormant licensed accounts combine the two problems: wasted spend and an unmonitored credential. Reclaiming the licence usually forces the account review that should have happened already.

A typical case: a 150-person charity has 14 licensed accounts with no sign-in for over six months: four leavers who were never processed, three volunteers, a former trustee and six test or shared accounts. That is thousands of pounds a year at list price, and one of the leaver accounts, still enabled, is later taken over by password spraying and used to send phishing to the charity’s donors.

Reviewing these accounts with managers once a quarter recovers the spend and closes the access, and moving genuinely light users to a cheaper plan keeps them working for less.

ISO 27001 A.5.9 (inventory), CIS Controls v8 safeguards 2.1 (software inventory) and 5.3 (disable dormant accounts), the NCSC 10 Steps asset management guidance and the NCSC CAF asset management outcome expect both the licences and the accounts to be reviewed.

How to fix it

Where: Microsoft 365 admin centre → Users → Active users

Before you start

• Confirm with the business that each person has left or no longer needs the product; dormant can mean long leave.

Step by step

1. 1Export the dormant licensed accounts. Use the list in the evidence (account, last sign-in, licences), or refresh it in Microsoft Graph PowerShell: Connect-MgGraph -Scopes User.Read.All,AuditLog.Read.All, then Get-MgUser -All -Property userPrincipalName,accountEnabled,userType,assignedLicenses,signInActivity | Where-Object { $_.AccountEnabled -and $_.UserType -eq "Member" -and $_.AssignedLicenses.Count -gt 0 } | Select-Object UserPrincipalName, @{n="LastSignIn";e={$_.SignInActivity.LastSignInDateTime}}, @{n="LastNonInteractive";e={$_.SignInActivity.LastNonInteractiveSignInDateTime}}.
2. 2Check real usage before acting. In the Microsoft 365 admin centre, Reports > Usage, look at each account’s activity over 180 days. If names show as codes, untick Display concealed user, group, and site names in all reports under Settings > Org settings > Services > Reports. Someone with recent mail or Teams activity is in use even without a recent interactive sign-in.
3. 3Ask the managers. Send the remaining list to the client’s managers or HR and ask, for each account: left, on leave, shared or service account, or still needed.
4. 4Disable leavers and reclaim their licences. For leavers, block sign-in (Users > Active users > the user > Block sign-in), convert the mailbox to shared if colleagues need it, then remove the licence under Licences and apps. The dormant accounts finding has the full leaver steps.
5. 5Sort out shared and service accounts. Accounts used as shared mailboxes should become real shared mailboxes, with no licence and sign-in blocked. Service or test accounts that genuinely need a licence should be named as such and documented; the rest should be removed.
6. 6Downgrade light users. For people who only use email and Teams in a browser or on a phone, move them to a cheaper plan (for example Microsoft 365 Business Basic, or F3 for frontline staff) under Licences and apps, after checking in the usage reports which apps they use.
7. 7Confirm and reduce the subscriptions. Re-run the export: no enabled, licensed member account should be idle for more than 90 days without a recorded reason. Reduce subscription quantities to bank the saving. The finding clears at the next assessment.

What users will notice

People whose licence is removed lose access to the product once reclaimed.

How to confirm it worked

The dormant licensed accounts in the evidence fall at the next assessment.

Frameworks and controls

This check maps to controls in 5 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.

The framework mappings were last checked against the published standards in October 2026.

Microsoft’s documentation

• Microsoft 365 usage reports (Microsoft Learn)

Related checks

• How to find licences on disabled accounts in Microsoft 365
• How to find unassigned Microsoft 365 licences
• Disabled and dormant accounts that still hold admin roles
• How to find inactive users in Microsoft 365

The full Microsoft 365 security checklist, worst first