Microsoft 365 spend rarely explodes; it drifts. A hire here, a departure there, an upgrade someone needed once — and two years later the tenant is paying for seats nobody uses and plans nobody chose deliberately.
The usual suspects
In tenant reviews, the same patterns account for most recoverable spend:
- Licenses still assigned to departed employees — the single most common finding
- Premium plans assigned org-wide when a fraction of users need the premium features
- Duplicate capability purchased separately (third-party tools doing what an included feature already does)
- Shared mailboxes and service accounts holding full licenses they don't need
- Nobody owning the question — licensing reviewed only when the renewal invoice surprises someone
A better operating rhythm
The fix is process, not heroics: tie license removal into your offboarding checklist, review assignments quarterly against actual usage, and map who genuinely needs which plan tier before the renewal date rather than after.
Just as important: before buying a new tool, check what your existing plans already include. Device management, data-loss prevention, retention, phishing protection — organizations often already own capability they're paying a third party to duplicate.