How can I identify inactive users consuming licenses?

Yes. A practical approach is to combine license assignment data with sign-in activity so inactive accounts that still consume paid licenses can be reviewed before licenses are removed.

1. Find disabled accounts that still have licenses with Microsoft Entra PowerShell:

Connect-Entra -Scopes 'User.Read.All'
$disabledUsersWithLicenses = Get-EntraUser -Filter "accountEnabled eq false" -All | Where-Object {
    $_.AssignedLicenses -ne $null -and $_.AssignedLicenses.Count -gt 0
}
$disabledUsersWithLicenses | Select-Object Id, DisplayName, UserPrincipalName, AccountEnabled | Format-Table -AutoSize

This quickly identifies accounts that are already disabled but still consuming licenses.

2. Review sign-in activity for inactivity using Microsoft Graph. The key property is signInActivity, especially:
   • lastSignInDateTime
   • lastSuccessfulSignInDateTime

Examples:

• All users with sign-in activity: https://graph.microsoft.com/v1.0/users?$select=displayName,signInActivity
• Users whose last successful sign-in was before a cutoff date: https://graph.microsoft.com/v1.0/users?$filter=signInActivity/lastSuccessfulSignInDateTime le 2024-06-01T00:00:00Z
• Users whose last sign-in attempt was before a cutoff date: https://graph.microsoft.com/v1.0/users?$filter=signInActivity/lastSignInDateTime le 2024-06-01T00:00:00Z

Important details:

• signInActivity is not returned by default. Include $select=signInActivity or filter on it.
• signInActivity filtering supports eq, ne, not, ge, and le, but not with other filterable properties.
• lastSignInDateTime can be blank if the user never signed in, or if the last attempted sign-in was before April 2020.
• Sign-in data can take time to update: sign-ins typically appear within 6 hours, and the last sign-in date can take up to 24 hours to update.

3. Decide what counts as inactive for the organization. A common window is 90 to 180 days, but that should match business policy because some users may be inactive temporarily, such as while on leave.
4. Review before reclaiming licenses. For each inactive user, confirm:
   • whether the person is still employed
   • whether access is still required
   • whether the account must remain for another reason
5. Use admin portals for license auditing if a UI-based review is preferred:
   • In the Microsoft 365 admin center billing area, review available and assigned licenses and drill down to users assigned to each product subscription.
   • In Microsoft 365 Lighthouse, the Users > Account management > Inactive users tab shows users inactive for over six months across managed tenants. From there, accounts can be reviewed and then blocked or deleted if no longer needed.

A simple workflow is:

• export licensed users,
• compare that list to Graph sign-in activity,
• flag accounts with no recent sign-in,
• validate business need,
• then remove the license or block the account as appropriate.

• Manage user licenses using Microsoft Entra PowerShell
• How to detect and investigate inactive user accounts
• How to detect and investigate inactive user accounts
• How to detect and investigate inactive user accounts
• Power BI implementation planning: Subscriptions, licenses, and trials
• Manage inactive users in Microsoft 365 Lighthouse