Microsoft 365 is the largest technology line item in most organisations, yet few IT teams can say what it returns. The answer sits in how the licences you already pay for are being used.
In this article
Microsoft 365 licensing now spans upwards of 75 different workloads surfaced across 25 separate admin portals, which leaves most IT teams without a single view of what employees actually use.
Waste concentrates in three places: licences still assigned to departed staff, inactive licences held by employees on extended leave, and add-ons that duplicate entitlements already included in the base plan.
Oversubscription carries a security cost alongside the financial one, because every enabled service widens the attack surface attached to that user.
Adoption programs that surface unused entitlements return more than blanket licence cuts, and reclaimed spend can fund initiatives such as a Copilot rollout without new budget.
For most organisations, their Microsoft 365 (M365) subscription is their biggest financial commitment, but when a Chief Financial Officer (CFO) asks the question, ‘What’s our return on investment for this spend?’, most IT teams can’t offer an answer.
The fault lies in the visibility of how M365 is actually being used across the organisation. Once leaders start looking at the gap between what they’re paying and how their subscription is being used, the answer becomes increasingly striking.
Getting the most out of your M365 investment means taking a really clear look at how things are currently running and making some strategic decisions about how you might redirect some of that usage for maximum return.
The trouble with answering the return-on-investment question starts with scale. Depending on your licence type, the M365 ecosystem can include upwards of 75 different workloads, and that list grows fast once you’re on an E5 plan, with E7 on the way.
The head of modern or digital workspaces typically acts as the internal support function for the end users navigating all of this. IT operators interact with the backend services directly, while most employees in sales, legal, marketing, or other frontline roles only touch the core productivity suite (Word, PowerPoint, Excel, Power BI) without ever seeing the rest.
In theory, all of this is visible somewhere, spread across 25 different Microsoft admin portals. But in practice managers identify a business need, buy the licences, hand them out, and assume people have what they need.
Human nature does the rest. If your licence users don’t have a problem, they don’t go looking for help, so most never discover the full scope of what they’ve been given access to.
Scale inevitably makes this worse. While in a business with a hundred employees you can generally get a daily pulse on what people are actually doing, once an organisation reaches thousands or tens of thousands of employees, that visibility quickly disappears. Without complex custom reporting that someone owns, it’s much harder to know who’s logging into SharePoint, or other parts of the M365 environment that the licence gives them access to.
When we consider where the waste lies in terms of what organisations are paying for and what’s actually being used, the answer again comes back to scale.
For some of the large organisations CoreView works with, we might conduct an assessment and discover a vast number of M365 licences for users who’ve left or been disabled, usually the result of manual offboarding processes where things slip through the cracks.
The next layer is inactive licences. These belong to employees who are still with the organisation but who aren’t interacting, often because they're on long service leave, parental leave, or something similar. The licence stays attached to them, fully paid for, sometimes running to hundreds of dollars a month, but nobody temporarily reclaims it and reassigns it elsewhere.
While these can be a significant contributor to licence waste, they’re also the easiest to fix, and once identified, those licences can be reclaimed and reassigned to add real value.
Beyond that, the next significant contributor to waste we see is duplicate plans. Microsoft’s licensing structure is built around base modules, E5 currently with E7 on the way. Each base module builds on the last, offering more services that can create significant benefits for organisations and their teams. On top of that base, organisations can buy ad hoc add-ons, so that rather than upgrading a whole department from E3 to E5, you might purchase just one extra service to bolt onto the E3.
What can happen in large organisations, though, is that this all gets blended over time, and employees end up with duplicate plans, with organisations paying for an add-on that’s already included in their baseline licence.
It’s also worth noting here that oversubscription is a security issue as much as it’s a financial one. We recently worked with a large state government department where every employee, regardless of role, was issued an E5 licence. That makes sense for frontline business staff, but far less sense for staff who might only occasionally log in to check email. Every enabled M365 service is a window for a potential attack, so giving someone licence entitlements they’ll never use can widen your organisation’s exposure to security risks.
Put it this way: a cleaning staff member onboarded into a hospital’s M365 tenant likely doesn’t need the same access as the Chief Information Officer.
Some of the organisations we work with start to learn about this ‘waste’ and think the immediate (and easy) answer is to start cutting licences completely. While that’s a quick way to potentially reduce your M365 subscription spend, it’s not necessarily the right long-term answer.
From our perspective, getting this kind of waste under control starts with your individual employee identity layer, with onboarding designed around what each role actually needs.
When we run our assessments, and we’ve got the inactive and duplicate licences issues under control, our next focus is service activation and usage, right down to the granular user level. Here, we’re looking very specifically at what each licence holder is and isn’t using.
That might look like an E5 licence user, with all the entitlements that come with it, using three of those services almost daily, but having never logged into SharePoint, at least not in the last 180 days. That tells us one of a few things:
This is just an example, but a granular view of usage over time can change how you approach your next Enterprise Agreement refresh. Instead of blanket-purchasing expensive licences for everyone because you assume you need them, you can build a bespoke agreement that involves pooling the right licence types for the right groups of employees.
This can work in your favour, but it can also lead you right back to the same issue with services you’re paying for that nobody’s using. The core issue is really about driving adoption and supporting activation of the licences you already have. If you’re already paying for these services, they can deliver genuine business benefits. What we usually find in our assessments is that the gap isn’t need but awareness and that’s where running adoption programs that flag unused access directly to users can make a real difference.
The same logic applies here to consolidation. Microsoft has an answer for nearly every business requirement already built into the ecosystem and a good example here is OneDrive. This is a service organisations are often licenced for, but tell us their users have always used Dropbox, so they end up paying for both. If you’re already paying for OneDrive as part of your base licence, there’s real merit in putting some effort into consolidating that and supporting adoption across the organisation.
The exception is security tooling. We know that many organisations run platforms like CrowdStrike instead of Microsoft Defender. CISOs often have good reason not to put every egg in the Microsoft basket and that’s a legitimate case-by-case call, but elsewhere, there’s real value hiding in plain sight.
There are applications tucked into the M365 ecosystem, like Viva Engage and Amplify, that most organisations don’t know exist. With a bit of awareness, training and enablement, you can consolidate these tools or get more return on investment from the services you’re already investing in.
Rather than treating wastage as a sunk cost, it becomes the starting point for whatever’s next in the Microsoft ecosystem and whatever’s next for your team. We’ve seen organisations reallocate wasted licence spend directly into new initiatives, like a Copilot rollout, without needing to ask for additional budget.
This is where an M365 licence and security assessment can really start to add value. It shows whether the services you’re already paying for are actually being adopted and used.
One key thing worth remembering is that this isn’t a one-off exercise. Microsoft is always innovating, and the pace doesn’t slow down, and keeping pace with what’s available and what you need can be a full-time job. Some universities we work with, for example, often employ a dedicated Microsoft licensing specialist full-time, simply because their environment is so layered across academic, staff, student, contractor, guest, and alumni licences to be managed, sometimes for hundreds of thousands of users at once.
That complexity is exactly why visibility needs to be continuous rather than a one-time audit. Treated the right way, Microsoft’s release cadence offers a steady stream of new opportunities to get more value from an ecosystem you’re already invested in.
If this has got you thinking about whether your organisation could get more from its Microsoft 365 investment, CoreView’s M365 licence and security assessment is a good place to start.
Rather than jumping straight to cost-cutting, it shows you exactly where your organisation has opportunities to drive adoption, consolidate tooling, and reduce unnecessary risk, turning reclaimed spend into funding for what’s next for your teams.
Most importantly, it gives you a clear, defensible answer the next time the CFO asks what you’re actually getting for your Microsoft investment. Reach out for a no-obligation health check to check how aligned you are with Essential Eight recommendations.
