Disabled Accounts With Active Licenses: The Silent Budget Leak

When someone leaves, the offboarding runbook says: disable the account. Sign-in blocked, access revoked, job done. Except for one detail — disabling an account does nothing to its license. Microsoft keeps billing for every assigned seat, enabled or not.

Why this leak is so common

Blocking sign-in and removing a license are different operations, owned by different concerns:

• Disabling is a security action — it happens immediately, often the hour someone leaves
• License removal is a cost action — it has no security urgency, so it waits... indefinitely

There are also legitimate reasons to keep the license temporarily: the mailbox needs to stay reachable during handover, OneDrive files need retrieving, litigation hold applies. "Temporarily" is where the money goes to die. The 30-day handover quietly becomes 14 months because nothing ever prompts anyone to finish the job.

The math

Every disabled-but-licensed account costs its full SKU price monthly. Typical findings in a 300–500 user tenant: 5 to 25 such accounts, often on E3 ($36/mo) or Business Premium ($22/mo). Ten disabled E3 accounts = $4,320/year for users who can't even sign in.

There's a security angle too: a disabled account with an active license still has a populated mailbox and OneDrive. If it's ever re-enabled — accidentally or maliciously — everything is right there. Reclaiming the license and archiving properly shrinks that surface.

Finding them

PowerShell one-liner territory:

• Get-MgUser -All -Filter "accountEnabled eq false" -Property DisplayName,AssignedLicenses and keep rows with non-empty AssignedLicenses

Or connect SeatPrune, which surfaces "disabled accounts with active licenses" as a standing finding — with each account's SKU, monthly cost, and how long it's been disabled. The "how long" column is the persuasive one: an account disabled 400 days ago has no handover story left.

Reclaiming safely

1. Check holds first. Accounts under litigation hold need their license (or the mailbox goes on hold via other means) — exclude them.
2. Preserve what's needed. Convert the mailbox to shared (free under 50 GB — see our shared mailbox guide) and transfer OneDrive ownership before unassigning.
3. Remove the license. The seat returns to your pool immediately.
4. Reduce at renewal. Pooled seats still bill until you lower the committed count at your NCE renewal date. Diarise it.
5. Fix the runbook. Add "remove/convert license within 30 days" as an explicit offboarding step with an owner. The leak isn't a one-time mistake, it's a missing process step.

Disabled + licensed is the purest form of M365 waste: you're paying full price for exactly nothing. It's usually a four-figure annual saving found in under ten minutes.