What this check looks at
Detects standalone add-ons that are already included in a suite the tenant also owns.
Microsoft sells many security and management products both on their own and inside suites. Microsoft 365 Business Premium includes Entra ID P1, Intune, Defender for Office 365 Plan 1 and Defender for Business; Microsoft 365 E3 includes Entra ID P1 and Intune; E5 adds Entra ID P2 and Defender for Office 365 Plan 2. When a tenant moves to a suite, standalone add-ons bought earlier are not cancelled and keep renewing.
This check compares the paid subscriptions with the product catalogue and lists standalone subscriptions whose features are already included in a suite the tenant also holds, with an indicative annual list cost. This check only warns, never fails: it raises a warning when at least one overlap is found. The overlap is inferred from the catalogue, so who holds which licence must be checked before cancelling anything.
The cost is a straight duplicate: paying twice for the same feature for the same people. It builds up quietly as suites are upgraded and nobody reviews the old add-ons, and it can be larger than it looks because add-ons are often bought for every user.
Why it matters
Paying separately for Entra ID P1 alongside Microsoft 365 Business Premium, or for Intune alongside E3, is a direct duplicate charge. It accumulates quietly as suites are upgraded and the old add-ons are never cancelled.
A typical case: a 100-person firm moved to Business Premium two years ago but still renews 100 seats of Entra ID P1 and 100 of Defender for Office 365 Plan 1 bought before the upgrade. At list price that is several thousand pounds a year for features already in Business Premium.
Cancelling a duplicate has no effect on users when the suite covers the same people, and the saving recurs every year. The only risk is cancelling an add-on that also covers people without the suite, which the assignment check below rules out.
ISO 27001 A.5.9 (inventory), CIS Controls v8 safeguard 2.1 (software inventory), the NCSC 10 Steps asset management guidance and the NCSC CAF asset management outcome all expect licences to be tracked and rationalised.
How to fix it
Where: Microsoft 365 admin centre → Billing → Your products
Before you start
- Confirm the suite includes the add-on’s features for the same users before cancelling it.
Step by step
- Confirm the overlap. For each overlap in the evidence, check what the suite includes: in the Microsoft 365 admin centre, Billing > Licences, open the suite and look at the services it contains. Make sure it includes the add-on’s features at the same level (for example Defender for Office 365 Plan 1 against Plan 2).
- Check who holds the add-on. In Billing > Licences, open the add-on and look at who it is assigned to. Each of those people should also hold the suite. Anyone who holds only the add-on (contractors, shared accounts, people on a cheaper plan) needs either the suite or to keep the add-on.
- Remove the duplicate assignments. For people covered by the suite, select them on the add-on’s page and unassign the licence, or remove them from the licensing group if group-based licensing is used. Check the matching service in the suite is switched on for them under Users > Active users > the user > Licences and apps.
- Cancel or shrink the subscription. In Billing > Your products, open the add-on subscription. Within seven days of purchase or renewal it can be cancelled; otherwise turn off recurring billing (or reduce the renewal quantity) so it ends at the end of the term. For CSP subscriptions, ask the partner to make the change in Partner Center.
- Diarise the end date. Put the subscription’s end date in the MSP’s calendar and check afterwards that it has gone and that nobody lost a feature.
- Confirm the duplicate has ended. Billing > Your products should no longer list the standalone add-on after its end date, or list it only for the people who need it. The warning clears at the next assessment once the subscription ends.
What users will notice
None if the suite covers the same features.
How to confirm it worked
The standalone add-on no longer appears in Billing, Your products.
Frameworks and controls
This check maps to controls in 5 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | A3.a Asset management |
| ISO 27001:2022 | A.5.9 Inventory of information and other associated assets |
| CIS Controls v8.1 | 2.1 Establish and maintain a software inventory (IG1) |
| NIST CSF 2.0 | ID.AM-02: Inventories of software, services, and systems managed by the organization are maintained |
| NCSC 10 Steps | Asset management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Microsoft 365 licensing plans (Microsoft Learn)