How to Optimize Microsoft Office 365 Licenses and Reduce Costs

Back during the early days of software-as-a-service (SaaS) there was a wave of discussion that it would be the end of software asset management (SAM) and the need to manage software licenses. They managed themselves, apparently.

Fast forward to 2020 and organizations around the world struggle to manage their SaaS instances and frequently waste money on unnecessary licenses or entitlements. Microsoft Office 365 (O365) represents a difficult challenge for license management, as organizations frequently miss opportunities to optimize their environment and reduce costs. Add to that the need to optimize Microsoft Office 365 licenses due to the upcoming price increases in March 2022.

Licenses Assigned to Offboarding Employees

The first cost optimization opportunity for Microsoft Office 365 licenses is to identify all licenses assigned to employees who are leaving or who have left the company. This situation typically occurs due to a lack of SAM processes, controls, or governance for assigned licenses. While frustrating for SAM professionals to see happening, it’s quite an easy fix.

Step 1: Request an updated employee transition report

HR should keep a record of all employees leaving the organization. Some organizations have separate reports for temporary or contracted workers and permanent staff, so make sure you request a report that includes these attributes. The timeframe for the report should go as far back as realistically possible.

Whilst you’re engaged with your HR teams it is also worth requesting a transition report on a monthly basis and building a process around O365 and offboarding employees to ensure this situation doesn’t happen again and explore the opportunity of removing licenses automatically.

Step 2: Export a report from the Microsoft Office 365 Admin Portal for all licensed users

If you do not have access to your O365 Admin Portal, I strongly suggest you request access. It only needs to be read-only with the ability to run reports. Within the Admin Portal there is a report that shows all licensed users, including those with free or trial licenses assigned.

Create a report to focus on licensable applications only, or in this case, anything licensable within Office 365. Other reports in the Admin Portal also display utilization and consumption data, but we will cover that when we investigate User Profiling.

Once you’ve created or found the pre-existing report, export it to a spreadsheet.

Step 3: Perform spreadsheet analysis

Once you have both sets of data, create a single spreadsheet and have the data sets on separate sheets within the same document. This is a great example of how a spreadsheet tool like Excel still remains one of the most used SAM tools in the world!

You need to perform a  VLOOKUP that compares your Licensed O365 Users versus your HR t Report to flag any licensed leavers who have left.

Once you have your list (if this is the first time you’ve done it and your HR transition reporting process isn’t robust, you may have a long list), it is worth sharing with your InfoSec team to ensure removing the leavers license doesn’t impact any services or other accounts that they may be linked to.

Once you get the OK from InfoSec, the next step is to remove those licenses!

Step 4: Removing Microsoft Office 365 licenses

This can be done a few different ways:

1.  Directly within the O365 portal, manually
2. Via an in-house developed script
3. Via a third-party tool

If you do not have a third-party tool, then your in-house teams can create a PowerShell script that can unassign licenses en masse and even deactivate O365 accounts. This method needs to be tested before being deployed – the mass removal of licenses from active users will not go down well.

An Admin within the Admin Portal can also unassign licenses manually on a per user basis. If you don’t have many to remove, this is a quick way of doing so.

Step 5: Document and automate this process

This process should be automated and designed to run every month to ensure that off-boarded employees’ licenses are removed, reassigned, or eliminated. Like other SAM processes, documentation needs to be a process flow and work instruction detailing what happens, when it needs to occur, and the roles and responsibilities for each participant. This also needs to be referenced or mentioned within your employee off-boarding process.

Once you have this process automated – even via an internal PowerShell script – the SAM team should conduct regular spot checks to ensure it works as designed.

Ensure any license removals or changes to process follow your internal Change Management Process.

Identify License Assigned to Test Accounts

The next action is to identify licenses assigned to test or fake accounts. You can identify said accounts as they typically do not have a proper first and last name. When you identify a test account such as Test 001 with some sort of Microsoft Office 365 license, it is important to contact the owner to understand why it has a license and if removing the license will impact any services.

Some test accounts genuinely do require a O365 license for a variety of reasons, including access to Cloud services, external email sending or because the test account needs the Office software. Either way, it’s good to conduct a review to ensure that if the account does need a license that it has been assigned the correct license for the level of testing required.

Other test accounts may not be as obvious – they may have been created with the names of famous or fictional people. For example, ‘Homer, Marge, Bart, Lisa and Maggie Simpson’ is a popular choice for test accounts, along with the likes of ‘Luke Skywalker’ and ‘James Bond’.

Just double-check they are test accounts though as I once removed an O365 E3 license from an actual user called James Bond…His manager wasn’t happy.

Identify Internal-Only Accounts

You can also potentially recoup Microsoft Office 365 licenses and save money by reviewing internal-only accounts, such as ‘Internal Communications’ or ‘CIO Comms’ type accounts.

As part of that plan, these teams may require a dedicated mailbox. If the account only sends internal emails, and you do not need to archive or support the account, then as long as the person running/access the account has a full E5/E3 license then you do not need to also license the internal communication account.

Further information about creating shared accounts and the licensing requirements can be found here.

Profile Microsoft Office 365 Users and Entitlements

Profiling your O365 users presents a more of a time-consuming activity, but it can pay off handsomely in the long term. I mentioned earlier in the blog that some organizations procure E5/E3 licenses for every user within their organization. Whilst this may be required in some instances the likelihood is that not all of your users require a full license.

For example, if you work for an organization that has a form of manufacturing production line, those employees may only check emails once every few weeks and may even share a communal desktop. They do not need E5/E3 licenses.

You can profile users with the same or similar role and put it into your policy that “shop workers” will instead be assigned an Office F1 license along with Exchange Online Plan 2 – a bundle that costs significantly less than an Enterprise Plan license.

You can scale this further for other job roles. Some organizations only provide E5 licenses to their C-Levels or a list of VIPs, while the rest of the organization maintains E3 licenses.

This activity can be time-consuming and you need the full support of your key stakeholders and sign off from senior management. Moving from a blanket assignment to user profiling creates a shift in how employees conduct their work, so make sure these changes are fully communicated to all stakeholders involved.

Simplify Microsoft Office 365 License Management with Zylo

Everything I’ve mentioned so far – whilst effective – involves a manual process with a fair bit of data analysis and development involved (if this is your first-time optimizing O365 licenses). But, a tool like Zylo can change that by providing key data, automation, and innovative SaaS management.

Zylo integrates directly with Microsoft Office 365 which means they can extract a substantial amount of data which allows the analysis and optimization of O365 licenses to be done outside of Excel (hurrah!). You can view and manage assigned licenses, users, consumption and conduct internal audits directly within Zylo.

For example, all the processes mentioned above can be created and automated within Zylo’s SaaS management platform. You can directly remove or downgrade O365 licenses within Zylo, which removes the requirement to build a custom PowerShell script. You can even email and query license users about their consumption from within Zylo, which saves a lot of time compiling emails!

Finally, what really works well is the fact that Zylo reviews your users O365 consumption and makes suggestions on the optimal license type. This allows you to identify potential savings and optimization opportunities and also show the value to your senior management that SAM brings to your organization.

Basically, Zylo performs the user profiling actions for you so you can focus on other priorities – and we all know SAM managers need more time!

Conclusion

People who claimed that SaaS managed itself all those years ago probably have hundreds, if not thousands of Microsoft Office 365 licenses tied up in off-boarded, test, or internal-only accounts.

They will have also made a blanket statement that everyone needs an E5 license, when in fact, an Exchange Online Plan and Office F1 license for tens of dollars (example price) combined price will suffice.

But you’re smarter than that; you knew that SaaS wouldn’t manage itself and that there is a world of optimization opportunities out there, especially for Office 365. If you haven’t reviewed your O365 estate, now is the time to do so. You may be sitting on a goldmine that will further ‘sell’ SAM to your organization and key stakeholders.

And with Zylo’s direct integration, optimizing O365 licenses has never been easier.