Reviewing Microsoft 365 Licenses: Security Features and Duplicate Licenses

Microsoft 365 for business comprises the Business Basic, Business Standard, and Business Premium plans for organizations with up to 300 users. According to the Product Terms, a customer may deploy no more than 300 user licenses of the Business plans; according to Microsoft Learn, the limit applies to all Business plans combined. Larger organizations should switch to Microsoft 365 for enterprise. Which security features are available depends on the plan and on add-on licenses; the following overview reflects the service descriptions on Microsoft Learn as of October 25, 2026.

License contents change constantly. The current service descriptions and the Product Terms are authoritative. The service plans in your own tenant show the actual scope of your licenses (see section 04). This checklist does not cover prices or discounts.

• Defender for Business purchased separately, although Business Premium already includes it
• Microsoft Entra ID P1 purchased separately for users with Business Premium, E3, or E5, which already include P1
• Defender for Office 365 Plan 1 as an add-on to Business Premium, which already includes Plan 1
• The same license assigned directly and also through a group; Microsoft describes how to remove such unnecessary direct assignments
• Overlapping bundles, such as Office 365 E1 assigned directly and E3 through a group, with overlapping service plans
• Purchased but unassigned licenses: quantity in the subscription higher than the number assigned
• Account deleted, but license not removed from the subscription: according to Microsoft, you keep paying until the license count is reduced
• Shared mailboxes with a license, although they are under 50 GB and use no archive and no retention

Before you remove a direct assignment, check that the group license covers the same services; Microsoft points out that PowerShell cannot determine which services come from which assignment. Before removing a former employee's license, release any holds and back up the data; after 30 days, the content is deleted, except for documents in SharePoint.

1. 1

   Overview in the admin center

   In the Microsoft 365 admin center under Billing, Licenses, you see your subscriptions and licenses. For each product, the Errors & issues tab shows users with assignment problems.

2. 2

   Review group licenses

   In the Microsoft Entra admin center under Billing, Licenses, Overview, a notice shows groups with license errors, such as too few licenses or conflicting service plans.

3. 3

   Purchased versus assigned

   Use the PowerShell command below to compare, for each subscription, the purchased licenses (Enabled) with the assigned ones (ConsumedUnits).

4. 4

   Review users

   Display the licenses of individual users and their services with Get-MgUserLicenseDetail; compare unlicensed accounts and accounts of former employees against the HR list.

Connect-Graph -Scopes Organization.Read.All, User.Read.All

# Subscriptions: purchased (Enabled) and assigned (ConsumedUnits)
Get-MgSubscribedSku | Select -Property Sku*, ConsumedUnits -ExpandProperty PrepaidUnits | Format-List

# Licenses of a user
Get-MgUserLicenseDetail -UserId "name@firma.at"

# Users without a license
Get-MgUser -Filter 'assignedLicenses/$count eq 0' -ConsistencyLevel eventual -CountVariable unlicensedUserCount -All

The commands come from the Microsoft Learn articles on viewing licenses and services with PowerShell. They only read; change assignments only after review.

• List of all subscriptions with purchased and assigned quantities created
• Under 300 users: Business plans reviewed; over 300 users: switch to Enterprise plans planned
• For each add-on license, checked whether the main bundle already includes the feature
• Licenses assigned through groups instead of individually; direct assignments justified
• Errors and conflicts in group licenses resolved in the admin center
• Accounts of former employees blocked, data backed up, licenses removed, and license count reduced
• Shared mailboxes without a license where Microsoft permits this
• Purchased security features also configured: Conditional Access instead of only security defaults, preset security policies for email, devices in Intune and Defender
• Decision made for missing features: add-on license, plan change, or deliberately done without
• Result documented with the date and repeated before the next renewal

A license only protects once the feature is configured. For Business Premium, for example, Microsoft recommends using Conditional Access instead of the security defaults when requirements are higher, and assigning the Standard or Strict preset security policies for email.