Licence assignment drifts. People join, people leave, somebody buys an upgrade for one project. Nothing forces a reconciliation, so nothing reconciles until someone looks.
A licence audit compares what Microsoft is billing you for against the people who actually work at your business. The two drift apart quietly, because nothing in the system objects when a licence stays assigned to somebody who left last spring.
It is the least dramatic finding in a tenant review and often the one that gets the work approved, because it is the one an owner can check on the invoice.
Obvious, and still the step that gets skipped on a shared account.
Convert it to a shared mailbox or delegate access, so mail arriving after the person leaves still reaches somebody.
OneDrive content transferred to a manager before anything is removed.
Applications, distribution groups, forwarding, and anything that authenticates as that user.
Last, not first.
Releasing a licence does not reduce the bill on its own. Somebody has to change the quantity at renewal.
Releasing a licence and reducing your bill are two different actions. Unassigning a licence frees it for somebody else. The subscription still bills for the same quantity until the count is changed, which usually happens at renewal.
This is why a business can clean up thirty licences and see no change on the invoice, then conclude the exercise was pointless. It was not. The second half just never got done.
It varies too much to put a number on, and anybody quoting you a percentage before looking is guessing. What is consistent is the shape of it: licences on people who left, licences on accounts that were never people, and plans a level higher than anybody uses.
On a tenant that has not been reviewed in a few years, the saving often covers the cost of reviewing it. That is a pattern, not a promise.
Careful. Removing a licence from an account can remove access to the mailbox and the files attached to it, and on some plans the data is retained only for a limited window after that.
The order matters: deal with the mailbox and the files first, then release the licence. Doing it the other way round is how businesses lose data they later need.
The habit of reconciling what you are paying for against who actually works there, on a schedule rather than when somebody notices the invoice. It is covered in more detail in the true-up explained.
Most small businesses have never done one, which is why the first one usually finds something.
No, and this is where licence cutting goes wrong. Some of the security controls worth having, including parts of Conditional Access and device management, are only available on particular plans.
Downgrading everybody to the cheapest plan can quietly remove the controls somebody spent money implementing. The useful question is which people need which plan, not what the smallest number is.
A fixed scope review of who has access, how sign-in is protected, where mail goes and what you are paying for.
What the annual reconciliation is, why most small businesses do not have one, and the habit worth borrowing.
Licences, accounts, security settings and the day to day of running a tenant.
Licence allocation is one of the twelve areas in the review, and it is the one that most often pays for the work.