Microsoft 365 Module

3.1 Contract context for M365 optimization 

Many Microsoft 365 optimization opportunities are visible in your tenant, but not all of them can or should be executed immediately from a contractual perspective. How and when you act depends on your commercial agreement with Microsoft or your reseller, for example: 

– Enterprise Agreement (EA / EAS / SCE): seat reductions and major plan changes usually take effect at True-up or renewal, but you can reassign licenses between users at any time. 

– CSP / New Commerce Experience (NCE): commitment terms and cancellation rules apply; reductions and plan changes may only be possible at the end of the committed term or within limited cancellation windows. 

– Other volume programs / special offers: custom terms may apply. 

Qhub shows you the optimization potential. Your contract determines when and how those optimizations can be realized financially. Always verify the relevant terms before executing large-scale changes. If you’re new to Microsoft 365 licensing, you can [ get started here ]. 

3.2 User Profiling Explained 

What “user profiling” means in Qhub 

People use Microsoft 365 in very different ways. Some are heavy users of Outlook, Teams and Office apps. Others mainly use email and Teams on mobile. Some users only need basic access for a specific role, and some accounts are not human users at all (service or test accounts). 

User profiling in Qhub is simply the practice of grouping users based on how they use Microsoft 365 and what they likely need. The goal is not to label individuals. The goal is to make licensing decisions more consistent, easier to explain, and easier to govern over time. 

Why profiling matters

Without profiling, licensing decisions often happen one user at a time, driven by habit or escalation (“just assign E5 to be safe”). That typically leads to: 

• Premium licenses assigned to users who don’t use the related features 
• Unused licenses remaining in place longer than necessary 
• And uncertainty during True-ups or renewals because the organization lacks a trusted baseline 

Profiling helps you move from opinions to a repeatable approach: same logic, same checks, fewer surprises. 

What Qhub uses to build a profile (in plain terms)

Qhub uses a combination of signals, such as: 

• Recent sign-in activity 
• Workload activity across Microsoft 365 services (e.g., Exchange, Teams, SharePoint/OneDrive), 
• Current license assignment, 
• And (where available) supporting evidence like Office installations. 

These signals help identify patterns such as “active user, but no desktop Office installations” or “no meaningful activity for the configured threshold period”. 

How to use profiling in practice

Profiling helps you answer practical questions, for example: 

• Which users look like “light users” and may not need a premium license? 
• Which users appear inactive and should be reviewed for reassignment, suspension, or removal? 
• Where do we have clear, low-risk opportunities to reduce costs? 

In Qhub, you typically use profiling together with the recommendations and evidence lists to decide what to review first. 

Common profile examples (illustrative) 

The exact names can differ per organization, but the logic is usually similar: 

• Power user – frequent sign-ins and consistent activity across multiple workloads and/or desktop usage. 
• Light user – active, but limited evidence of advanced feature usage or desktop Office installations. 
• Inactive user – no meaningful activity for the configured threshold period. 
• Service/test account – flagged as a non-human account and reviewed separately. 

Important: profiling is not an automatic decision

Profiling produces recommendations, not a forced outcome. Before you make any changes, validate the context: role requirements, security/compliance needs, known exceptions, and the rules and timelines of your Microsoft agreements. 

Note on license recommendations

In some recommendation categories, the Hub may currently use a default target license when estimating savings (for example, mapping certain “light user” patterns to a baseline license). Treat this as a starting point for review and validate whether the suggested target aligns with your organization’s standards and contract constraints. 

Practical tip

Start small. Pick one department or one recommendation category (for example, clearly inactive users) and run a short review cycle. Once stakeholders trust the insights, it becomes much easier to expand profiling into a steady monthly or quarterly governance routine. 

3.3 License Optimization Categories 

For a description of how to interpret the dashboard, go to Section 2 — Understanding the Dashboard. This chapter will focus on giving insights into the savings categories and how you can use these to your own benefit.  

3.3.1 Inactive Users 

Qhub classifies users as active or inactive to help you identify unused licenses and reduce unnecessary Microsoft 365 spend. Microsoft charges per assigned license — not based on usage— so understanding user activity is essential for optimization.  

What are active users? 

Active users are accounts that: 

• Have a license assigned 
• Are enabled in Entra ID 
• Show recent activity across Microsoft 365 services 

Qhub marks a user as active when we detect usage signals such as: 

• Email activity 
• Teams messages/meetings 
• SharePoint or OneDrive access 
• Office app usage 
• Successful sign-ins 

Active users represent the employees who truly consume and rely on M365 workloads. 

What are inactive users? 

Inactive users are accounts that: 

• Have a license assigned 
• Are still enabled 
• Show little or no activity over a selected period (e.g., 30, 60, 90 days) 

Common examples (not an exhaustive list): 

• Departed employees who were never deprovisioned 
• Seasonal or project workers outside their active period 
• Duplicate or unused AD accounts  
• Users assigned E3/E5 licenses but never signing in 
• Consultants or externals no longer working for the organization 

These users typically represent immediate optimization opportunities. 

3.3.2 Never Active Users 

We make an additional distinction between Inactive Users and users that have never been active (which we call Never Active Users). These are accounts that have been created, but have never logged in. Typical examples of this: 

• New employees (we filter out accounts created <30 days) 
• Service Accounts (accounts that might get emails, but don’t have any active users that need to sign into this account – bots, shared mailboxes, etc.) 
• Forgotten accounts (usually found in cases where there is no link to an HR system) 

Especially the last one is of interest, as this is an immediate cost avoidance that you can work towards. 

3.3.3 Unassigned Licenses 

These are licenses that are just not assigned or in use. We typically scan the environment for licenses that are not assigned to users, as this is a clear and easy category for immediate savings (granted you are able to give these licenses back to Microsoft straight away).  

While it seems an easy savings category, it is interesting to understand why licenses are unassigned: 

• Your organization requires a “buffer” to assign licenses to new employees that are hired into the company 
• A product has been bought but not rolled out yet. This can be due to a negotiation strategy that has just happened, or you are stuck with a certain license threshold due to your contract (commitments in return for discount is a common issue) 
• A large group of employees have just left the organization, and these have yet to be returned to Microsoft 
• Add-ons that were purchased but never deployed 

As you can see, sometimes you have unassigned licenses for a reason, but typically it is good to stay on top of why licenses are unassigned. 

3.3.4 Disabled Users 

Overview 

Disabled users are accounts that have been deactivated in Entra ID (formerly Azure AD) but still consume Microsoft 365 licenses. 

Although these users can no longer sign in, the licenses assigned to them continue to generate costs until they are removed or reassigned. 

Qhub identifies disabled users as one of the highest-impact optimization opportunities in any tenant. 

Why disabled accounts matter for licensing 

When an account is disabled, Microsoft does not automatically unassign the license. 

This often results in: 

• Paid licenses tied to inactive or non-existent employees 
• Large volumes of unused E3/E5 licenses 
• Add-ons (e.g., E5 Security, Defender, Compliance) continuing to bill 
• Missed savings during renewals or CSP billing cycles 

In many organizations, disabled accounts represent 3–10% of total license waste—and in large enterprises, this can be significantly higher. 

Typical causes of disabled users: 

• Offboarding process not linked to license removal 
• Temporary disability for security and compliance reasons 
• Incomplete identity automation 
• Shared or “converted” mailboxes 

The Optimization Potential 

3.3.4.1 Immediate License Reclamation  

Disabled users often hold full M365 E3 or E5 licenses, which can be: 

• Removed 
• Reassigned 
• Replaced with a low-cost SKU (F3) if mailbox retention is needed 
• Eliminated entirely in the next CSP billing cycle 

Savings can be material, especially when E5 seats are left unused. 

3.3.4.2 Add-On License Cleanup 

Disabled accounts frequently retain: 

• E5 Security 
• E5 Compliance 
• Teams Phone add-ons 
• Audio Conferencing 
• Power BI Pro / Premium per User 
• Intune Suite 
• Defender for Identity / O365 

Removing these yields immediate savings. 

3.3.4.3 Reducing CSP Subscription Counts

In CSP, removing a license assignment does not reduce the invoice. But identifying disabled users helps organizations adjust: 

• Seat counts 
• Add-on volumes 
• Monthly renewals 

This can significantly reduce CSP cost over time. 

3.3.4.4 Security & Compliance Benefits

Cleaning up disabled but licensed accounts also: 

• Reduces attack surface 
• Eliminates stale identities 
• Improves audit posture 
• Removes leftover privileged roles 

This is both a licensing and security win. 

How Qhub highlights this 

You can view disabled users with active licenses under: 

Usage Analysis → Disabled Accounts. The Hub provides: 

• List of all disabled but licensed users 
• Assigned licenses and add-ons 
• Inactivity duration 
• Cost impact per user 
• Recommended actions (remove license, reassign, downgrade) 

This makes the optimization step straightforward and auditable. 

3.3.5 Downgradeable Users 

In this section we look at a typical reduction scenario: over-licensed users that could potentially make do with a lower license type.  

What we tend to look at are M365 E3 and M365 E5 licensed users and if they are under-utilizing the services from these suites. We say potentially as it always requires additional investigation if this is possible. For instance, we can investigate the following: 

• Is a user actively using the M365 Apps for Enterprise? If the user is either not installing the apps, or has installed them but is not actively using them, it might signal that this user is over licensed. 
• If a user is not showing a lot of email activity (<2GB of emails stored/received), and not storing a lot of data on their OneDrive, this might also signify that this user is not actively using the services they’ve been provisioned with. 

These are two of the checks that we’re doing to investigate if a user might be over provisioned. We then typically recommend the following course of action: 

• Check if a lower license type like M365 F3 or M365 F1 (Light user types) fits any of these users, as this provides the most savings potential. However, F-plans are typically only for users that either 1) use a screen size below 10.1”, or 2) share a device with other users 
• If the F-plans don’t seem to fit (all) these users, there are still other options to reduce your license cost. However, for correct profiling check out the user profiling section. Additionally, investigate if it makes financial sense (for instance, if you have high discounts on your E3 or E5 licenses). 

As you can see, these insights require you to do some homework. While Qhub does offer a lot of help in this regard, you still need to identify if it makes sense for your organization to make this step. As with everything, you can always reach out to our consultants and request help with this assessment and have us help create the correct profiles for your organization. 

3.3.6 Service Accounts  

Overview 

A service account is a non-human identity used to run automated processes, integrations, or background services within an organization’s Microsoft 365 environment. 

Service accounts are not tied to a real employee and do not represent an active user who interacts with M365 applications in the normal way. 

In Microsoft 365, service accounts are common in: 

• Application integrations 
• Email routing or forwarding services 
• Automated workflows 
• Backup tools 
• API-based systems 
• Legacy systems relying on Basic Authentication

Do service accounts need a license? 

Only sometimes. A service account requires a license only if it uses a feature that demands a licensed user. A service account may require a license if it: 

• Sends or receives email via Exchange Online 
• Needs access to a mailbox 
• Authenticates using modern authentication to access data 
• Uses M365 apps or workload features (Teams, SharePoint, etc.) 
• Executes API calls that require a licensed identity (rare but possible depending on the tool) 

A service account does NOT require a license if it:  

• Is used purely for application authentication (app registration / service principal) 
• Does not access any mailbox or user-based features 
• Only interacts through Graph API with app permissions 
• Serves as a placeholder identity in Entra ID without consuming resources 

Why service accounts are an optimization opportunity 

Service accounts frequently carry: 

• Unnecessary E3/E5 licenses 
• Legacy licenses no longer required  
• Mailboxes that could be converted to free shared mailboxes 
• Add-ons that serve no purpose (e.g., E5 Security, Teams Phone) 

These cases often represent an immediate and easy cost-reduction area. 

Typical optimization steps: 

• Remove unused licenses 
• Convert mailbox-bearing accounts to shared mailboxes 
• Replace licensed service accounts with service principals 
• Downgrade to lower-tier licenses when limited access is required 

How Q Hub identifies service accounts 

Qhub automatically flags accounts that look like non-human identities.  

Qhub highlights: 

• Accounts with no human sign-in patterns 
• Licensed service accounts with low or no activity 
• Orphaned or legacy automation accounts 
• Accounts eligible for conversion to shared mailbox 
• Accounts that can move to an unlicensed service principal 

Each flagged account includes a recommended optimization action. 

3.3.7 Overlapping functionality  

Overlapping functionality occurs when users are assigned multiple Microsoft 365 licenses or add-ons that provide the same capabilities. This leads to unnecessary spending, especially in tenants with mixed E1/E3/E5 licenses, security add-ons, or legacy subscriptions. 

Qhub identifies where capabilities overlap so you can consolidate licenses and reduce costs without impacting user functionality. 

What is overlapping functionality? 

Overlapping functionality happens when two or more assigned licenses include duplicated features. The user only needs one of those features—but you’re paying for several. 

Some examples of this (though there are many): 

• M365 E5 + E5 Security add-on (duplicate security stack) 
• M365 E3 + EMS E3 + Defender for Office add-ons (overlapping protection) 
• M365 E3 + Exchange Online  
• M365 E3 + Office 365 E1 
• Power BI Pro assigned to users with M365 E5 (includes Pro rights) 
• Visio Plan 1 and Visio Plan 2 

In many cases, the extra licenses deliver no additional value but continue billing. 

How Qhub detects overlapping functionality 

Qhub automatically analyses: 

• Assigned licenses and add-ons 
• Individual features included per SKU 
• User activity and workload consumption 
• Compliance and security baselines 
• E3/E5/E5 Security entitlements 

Qhub then flags users who are: 

• Assigned more features than they use 
• Covered multiple times by overlapping products 
• Eligible for consolidation into a single SKU 

Where to view this in Qhub 

Navigate to: Usage Analysis → Double Functionality. Here you can: 

• See each user with overlapping capabilities 
• Review which licenses are redundant 
• Export a list of affected users 
• View recommended actions (e.g., remove add-on, downgrade SKU) 
• Analyze cost savings per license type 

Typical optimization actions 

• Remove redundant security or compliance add-ons 
• Downgrade users from E5 to E3 where appropriate 
• Consolidate security features into E5 Security instead of multiple add-ons 
• Remove Power BI Pro where E5 already covers usage 
• Consolidate Teams Phone entitlements 

These actions do not impact functionality because the user retains the required capabilities through the remaining license. 

3.3.8 Other Optimization Recommendations 

There are many more areas for optimization that you should consider. We will list a few more below, but optimization is an ongoing process, and new items will always pop up. We try to be as transparent as possible and work to continuously update these pages as more, different and/or changing options become available. 

3.3.8.1 PowerBI Pro:

Common optimization opportunities 

1. Power BI Proassigned tousers with M365 E5 

Microsoft 365 E5 already includes Power BI Pro entitlements. Assigning a separate Power BI Pro license to these users results in duplicate costs. Consideration for optimization: Remove standalone Power BI Pro license from E5 users. Qhub also checks if the PBI Pro license in M365 E5 is actively being used, generating insights into your users’ usage.

2. ProLicensefor View-Only Users 

Many users only consume reports and never create or publish content. Consider for optimization: 

• Use Power BI Free for viewers (where Premium capacity is in place) 
• Reassign Pro licenses only to report creators and publishers
• Premium Per User vs Capacity Mismatch

Some organizations mix Power BI Pro, Premium Per User (PPU) and Capacity-based licensing (Fabric) without a clear strategy. Consider for optimization: Align licensing with actual usage patterns and scale (few creators vs many consumers).

4. Inactive or Low-Usage Power BI Users

Users with Pro or PPU licenses but don’t create reports, don’t refresh datasets or don’t show any recent activity. Consider for optimization: Reclaim or reassign licenses from inactive users. 

3.3.8.2 SharePoint Storage optimization

SharePoint and OneDrive storage costs grow silently over time. Overspend usually results from unmanaged growth, legacy data, and lack of ownership rather than business need. Qhub helps organizations understand what consuming storage is, why, and whether it is still required. 

Common optimization opportunities

1. Orphaned Sites and OneDrive Accounts

Storage can be tied to former employees, disabled users or abandoned project sites. Consider for optimization: Archive or delete unused sites and OneDrive data after defined retention periods.

2. Duplicate and Redundant Data

Common examples: 

• Multiple copies of the same datasets 
• Old Teams channel files 
• Legacy migrations never cleaned up 

Consider for optimization: Identify large, low-activity libraries and remove duplicates. 

3. Unlimitedgrowthwithout governance 

Without limits: 

• Personal OneDrive storage grows unchecked 
• SharePoint sites accumulate years of data 

Consider for optimization:

Introduce lifecycle policies, quotas, and ownership rules.

4. Paying forextrastorage unnecessarily 

Organizations often purchase additional SharePoint storage while significant unused or stale data still exists. With Qhub, you can easily see where you can clean up data and reduce your storage footprint before buying additional capacity. It is also worth noting that you can always give back that additional storage (if your contract allows). 

3.3.8.3 M365 Copilot

Microsoft 365 Copilot is a high-cost, high-impact license. The main optimization risk is over-deployment: assigning Copilot to users who cannot realistically generate sufficient value. 

Common optimization opportunities

1. Blanket Copilotassignments

Assigning Copilot to all E3/E5 users and/or entire departments without role-based evaluation often leads to low adoption. You should limit Copilot to roles with high document creation, analysis, or communication workloads.

2. Copilotassigned tolow-activity users 

Users with minimal Teams, Outlook, or Office usage and frontline or task-based roles can often be seen as not requiring a license for M365 Copilot. You should actively look to exclude or delay Copilot assignment for low-usage profiles.

3. Security &datareadiness gaps 

Copilot effectiveness depends on multiple factors, like clean permissions, correct SharePoint access and proper sensitivity labels. Without this, Copilot increases risk without delivering value. For the sake of optimization, you should fix data hygiene and access before scaling Copilot.