Disabled accounts that still hold Microsoft 365 licenses
The classic offboarding leak: someone leaves, IT disables the Entra ID account, and the Microsoft 365 licenses stay assigned. The person can no longer sign in, but the seat keeps billing every month until someone notices.
Why disabled accounts keep their licenses
Disabling an account and unassigning its licenses are two separate operations in Microsoft 365, and offboarding checklists usually stop at the first. Setting accountEnabled to false blocks sign-in immediately, which is the security-critical step, so it happens reliably. License removal is a billing concern with no security urgency, so it slips: it belongs to a different team, a different runbook or a different quarter.
Group-based licensing makes the leak stickier. If the license came from a group assignment, it stays until the account is removed from the group, and disabled accounts are rarely purged from license groups. The admin center offers no built-in view of disabled-but-licensed users, so leavers accumulate quietly, one or two per departure, until the renewal forces a recount.
Detect it manually
With the Microsoft Graph PowerShell SDK, one filtered query lists every disabled account that still holds at least one license:
Connect-MgGraph -Scopes 'User.Read.All'
$p = @{
Filter = 'accountEnabled eq false and assignedLicenses/$count ne 0'
ConsistencyLevel = 'eventual'
CountVariable = 'c'
All = $true
}
Get-MgUser @p | Select-Object DisplayName, UserPrincipalName- The assignedLicenses/$count clause is a Graph advanced query: it only works with ConsistencyLevel eventual and a count request, which is what the splatted parameters provide.
- The output is a list of names. Mapping each account's SKUs to what the seats actually cost, and re-running the check next month, is still on you.
How LicenseMeter detects it
The nightly read-only sync pulls every directory user with its enabled state and license assignments (the User.Read.All application permission, read-only like all five scopes). The rule fires when accountEnabled is false and the account holds at least one license, and the finding is priced at the sum of every SKU the account still carries.
The engine evaluates this rule first and then skips the account, so a disabled leaver is never double-counted by the inactivity rules. Because the signal is pure directory data, this detection works in every tenant: it needs no Entra ID P1 and is unaffected by concealed report names, Microsoft's default since 2021.
What it costs
Every finding carries the full monthly cost of the SKUs the disabled account holds, taken from an editable per-tenant price book prefilled with list-price estimates, because there is no Microsoft API for your negotiated prices.
In the 155-person sample tenant, 8 disabled accounts still hold licenses; accounts disabled in the directory but still licensed add up to € 786,69 a month across Microsoft 365 and connected apps.
Sample figures come from the deterministic demo workspace, not from customer data. The waste calculator turns your own seat count into an estimate.
Related waste patterns
See which of your seats match this pattern.
Connect read-only and the free scan lists every affected account in your tenant, priced per seat and per month, with a PowerShell remediation script your IT reviews and runs.
After the free scan, 14 days of full monitoring, free. No credit card, read-only access.