How to automate inactive license management for Microsoft Entra ID users

Effectively managing user licenses in Microsoft Entra ID can save your organization a lot of time and investment costs. By thoroughly understanding user requirements before assigning licenses—and regularly monitoring for inactive users and unused licenses—organizations can optimize their license usage. However, overlooking this important task could result in significant, avoidable costs.

Why should you automate license management for your Entra ID users?

Managing licenses for multiple Microsoft services—such as Outlook, PowerBI, SharePoint Online, OneDrive for Business, and Office applications—is crucial for Microsoft Entra ID users across various departments and levels. As users transition between departments or change organizational levels, their access needs will evolve, necessitating adjustments to the services they are authorized to use.

For administrators, manually adjusting settings for thousands of users with diverse needs is not only cumbersome but also prone to errors. Mistakes such as assigning incorrect licenses or failing to revoke unnecessary ones can hinder productivity and inadvertently provide access to unauthorized resources. Moreover, this will also drive up the expenses of your organization, as you will end up paying for licenses that your team does not even require or use frequently. Automating this process ensures accuracy, enhances security, and reduces unnecessary expenses, making it an essential strategy for efficient organizational management.

Automate inactive license management for Microsoft Entra ID users

To automate inactive license management for your Microsoft Entra ID users, you will need to automate two major processes.

• Tracking unused licenses
• Unassigning stale licenses from user accounts

Track Microsoft Entra ID users with stale licenses using M365 Manager Plus

You can track which users have inactive licenses by identifying the service that they rarely use or haven't used at all. If they haven't logged in to a service for a long period of time, it's reasonable to consider removing their license, as they aren't utilizing it. You can obtain the data on your users' last logins to services like Exchange Online, SharePoint Online, OneDrive for Business, and others using Microsoft Graph API. However, this process can be complex, error-prone, and challenging to filter through effectively.

ManageEngine M365 Manager Plus—a comprehensive tool used for reporting, managing, monitoring, auditing, and creating alerts for critical activities in your Microsoft 365 environments—can also be used to track Microsoft Entra ID users with stale licenses.

Here are the steps to automate tracking Microsoft Entra ID users with stale licenses using M365 Manager Plus.

1. Log in to M365 Manager Plus, navigate to Reports, and select Schedule Report. Convert download
   
2. Click Create Schedule.
   
3. Type in a Scheduler Name and select the tenant for which you want to generate and schedule this report.
4. Select Azure Active Directory in the Microsoft 365 Service drop-down and select the Stale Microsoft 365 Licenses report.
5. In the pop-up that opens, you can decide the Service Licenses that you want to run the check for, the Matching Criteria (whether you want to match all selected licenses, or any of the licenses selected), and the Inactive Period for which data will be generated. You can click More Options to filter the report further and customize the Export File Name with macros.
   
6. Configure the schedule using the Scheduled to Run drop-downs.
7. Select the format in which you want the report to be emailed using the Export As drop-down. We will select CSV for this example. You can also configure the Storage Path to download the reports locally.
8. In the Notification Settings drop-down, select Notify all reports.
9. If you want the reports emailed to you, use the Select Notification Template option to select a format for your emails. This option will be accessible once you configure your email server.
10. Click Save to create a scheduler that automates tracking Microsoft Entra ID users with stale licenses.
    

Remove stale licenses of Microsoft Entra ID users with M365 Manager Plus

Once the inactive services of users have been identified, you will have to remove the respective services from their assigned list of services. However, doing the same assignment for individual users in the Microsoft 365 admin center is a mundane and exhausting task for administrators with huge work loads.

Unlike the Microsoft 365 admin center, M365 Manager Plus helps add, remove, and change Microsoft 365 licenses in bulk—without having to use a single PowerShell script. And the best thing is, you can automate this just like how you automated the process of generating the list of inactive licenses. Here are the steps to automate removing stale licenses of Microsoft Entra ID users with M365 Manager Plus.

1. Log in to M365 Manager Plus and navigate to Automation.
2. Click Create New Automation and assign a name for your schedule. We will be using Stale License Cleanup-Exchange Online for this example.
3. Select License Modification from the Select Task/Policy field.
4. Fill the following fields accordingly:
   1. Select Remove selected licenses from the Assign / remove licenses dropdown.
   2. Select all the Exchange Online licenses in the Select Licenses field.
   3. Select your preferred location from the Usage Location dropdown. We have used None selected here as we did not want to limit the automation only to certain locations.
5. Select CSV File in the Import Objects from field.
6. Paste the file path of the report exported in Step 2 in the Location of CSV field, and check the Select only the appended objects from the file box.
7. Set your desired Frequency using the adjacent drop-boxes and click Save.
   

Limitations of using native tools to automate inactive license management for Entra ID users

• Admins need to spend a lot of time executing complex Microsoft GraphAPI scripts.
• Administrators must be assigned at least the Reports Reader role to fetch results using Microsoft GraphAPI.
• Reports generated using Microsoft GraphAPI cannot be exported.

Benefits of using M365 Manager Plus to automate inactive license management for Entra ID users

• Effortlessly identify groups with disabled users without the need to memorize or execute complex PowerShell scripts.
• Delegate granular permissions to technicians without elevating their Microsoft 365 privileges, and create custom roles with any combination of reporting, management, and auditing tasks.
• Filter your reports just once and save them as custom reports that you can access in just a few clicks.
• Gain a thorough understanding of your environment in Microsoft Entra ID, Exchange Online, SharePoint Online, OneDrive for Business, and other Microsoft 365 services with detailed reports from a single console.
• Keep tabs on even the most granular user activities in your Microsoft 365 environment.
• Manage users, mailboxes, groups, sites, and contacts effortlessly in bulk without PowerShell scripting.
• Monitor the health and performance of Microsoft 365 features and endpoints around the clock.