Handling licence-count overrun surprises

The overrun arrives as one of three tickets: a new starter's account has no mailbox; the group-based licensing report shows Not enough licenses errors; or the finance team asks why the invoice went up. All three are the same thing — assignments exceeded entitlement — and the useful response is the same: understand what is actually broken, find headroom fast, then fix the counting. The commercial context is in licensing models explained and cost optimisation.

What actually stops working

Less than people fear, at first.

• Direct assignment of a licence you have run out of simply fails; the admin center refuses. Nothing existing breaks.
• Group-based licensing fails for the users who could not get one. Those users show an error state in Entra → Licences → the group → Errors. Users who already had the licence keep it; the shortfall lands on whoever was added last. Entra retries on its own after you add headroom; you can also Reprocess the group.
• A subscription that has more assigned than purchased — which happens when you reduce a count, or a trial converts to fewer paid seats — shows a warning in Billing → Licenses, and Microsoft's terms expect you to resolve it, but existing users are not summarily cut off on day one.
• A subscription that expires or is cancelled is the real cliff. It goes through Expired (about 30 days, everything still works, admins warned), then Disabled (about 90 days, users cannot sign in to the service, admins can still access data), then Deleted. Those stages are documented, and the Disabled stage is what "everyone lost email" tickets are made of.

So: an overrun is an urgent accounting problem and a slow-burning service problem, unless it is actually an expiry, in which case the clock is the thing to look at first.

Step 1: measure the gap

Microsoft 365 admin center → Billing → Licenses shows, per product, available, assigned, and any overage. Then find out where assignments went:

Get-MgSubscribedSku | Select-Object SkuPartNumber, @{n="Enabled";e={$_.PrepaidUnits.Enabled}}, ConsumedUnits

And for the users holding the SKU:

Get-MgUser -All -Filter "assignedLicenses/any(x:x/skuId eq 'sku-guid')" -ConsistencyLevel eventual -CountVariable c -Property DisplayName,UserPrincipalName,AccountEnabled,SignInActivity

Sort that by SignInActivity.LastSignInDateTime. The users who have not signed in for months and the accounts that are disabled but still licensed are your headroom, and there are always some.

Step 2: reclaim headroom you already own

In roughly the order of least disruption:

• Disabled accounts still licensed. Leavers whose offboarding removed sign-in but not the licence. Convert their mailbox to shared (if under 50 GB and not on hold) or apply a retention policy and let it become inactive, then remove the licence. The offboarding process guide has the sequence that makes this automatic.
• Duplicate coverage. Users holding both a Business Premium and an E3, or an E5 plus a standalone add-on E5 already includes. Group-based licensing with overlapping groups causes this quietly.
• Service accounts and shared mailboxes with full licences. A shared mailbox needs no licence under the size limit; a room mailbox needs none at all; a service account used only for SMTP needs at most an Exchange Online plan.
• Inactive users. Accounts with no sign-in for 90 or more days — check the reason before touching them, because long leave and seasonal workers are real, but a good share are ghosts.
• Downgrades. Frontline workers holding E3 who need F3; users with E5 whose only E5 use is a feature the tenant never turned on.

Each reclaimed licence is available immediately; group-based licensing picks it up on the next reprocess.

Step 3: buy more, if you must, knowing the rules

Whether you can add licences today depends on how you buy:

• CSP (New Commerce): a partner adds seats to an existing subscription immediately; the increase is prorated and co-termed to the subscription. Decreasing is the constraint: a seat added is committed for the term, with a short window after purchase (seven days under the current New Commerce rules) to cancel. Beyond that you carry it to the term end. Monthly-term subscriptions cost more but let you flex down at each month's end.
• Enterprise Agreement: add seats any time; they are reported and paid at the annual true-up. There is no mechanism to reduce mid-term. An overrun on an EA is therefore a true-up cost, not an outage.
• Direct from Microsoft (MCA or web direct): add in the admin center immediately; reduce only under the same New Commerce rules as CSP.
• Trials and promotional SKUs: converting adds a new paid subscription; users on the trial SKU need reassigning to the paid one — a frequent source of not enough licences two months after a Copilot or Teams Premium trial.

Adding is never blocked; the honest constraint is that you will pay for what you add until renewal, so reclaim first and buy the difference, not the panic number.

Step 4: fix the counting

An overrun is a reporting failure before it is a licensing one.

• One licensing group per SKU, with membership driven by an attribute (department, employee type) rather than by hand, and a monthly review of the Errors tab.
• A headroom alert. A scheduled script comparing enabled to consumed per SKU and posting to a channel when headroom drops below a threshold you choose (a percentage, or the size of an expected hiring wave). Fifteen lines of PowerShell and a Power Automate flow.
• Offboarding that removes licences on a defined day, not "when someone remembers".
• Renewal calendar. The 30-and-90-day stages only happen when a renewal is missed; that is a calendar problem with a name attached.

What needs support, and what has downtime

Microsoft support does not grant licences you do not own and cannot override New Commerce cancellation rules; a CSP partner or your Microsoft account team is the party for anything commercial. Downtime is nil for an overrun caught in the assignment stage. It is very real for a subscription that reaches Disabled, and the recovery is simply to renew — data is intact through that stage — which is why the renewal date belongs on the same calendar as the certificate expiries.