TenantTrim

Money & Risk Review

For Microsoft 365 · Northwind Traders · October 29, 2026

Read-only review: nothing in Microsoft 365 was changed

Sample report. The company, people and numbers are fictional, to show what a review delivers.

Since the last review, $588 a year of waste has been removed, none of it off the bill yet. $2,016 a year of licenses are freed and ready to cut at renewal. You are paying $8,964 a year for Microsoft 365 that nobody is using, and there are 5 high security risks to close.

Last review, September 29, 2026$9,132Potential savings found

This review, October 29, 2026$8,964Potential savings still open

Waste removed$588A year, confirmed by this review: all of it licenses now in use, so the bill has not changed

$9,132 found last time, minus $588 removed, plus $420 of new waste since, is the $8,964 still open. Only waste that was there last time and is gone now counts as removed.

Estimated$8,964Wasted per year

$747Wasted per month

5High security risks

36%Microsoft Secure Score

16 money findings, 8 of them high confidence131 accounts and 154 paid licenses analysed25 checks run

Estimated at list prices as of 1 Jul 2026, not read from your invoice. How every figure is worked out.

164days to renewal

Renews on April 12, 2027

Your Microsoft subscription renews on April 12, 2027, 164 days from now. If nothing changes, a further $4,025 will be spent on the waste below before that date. Seats on an annual commitment can normally only be reduced at renewal, so anything not actioned by then is paid for again for another year.

If the year is paid month by month, paying it upfront at renewal costs 5% less: Microsoft has charged 5% more for monthly billing on annual plans since 1 April 2025. This date is the one Microsoft holds for your subscriptions; check it against your invoice. Open renewal-reminders.ics to put 3 reminders for it in your calendar.

Since the last review

Compared with the review on September 29, 2026. Waste removed counts waste that has gone since then: no longer paid for, or now in use; 15 items of waste fixed. Off the bill means fewer licenses are paid for, so the next invoice is lower; now in use means a license that sat idle is used again, so the bill did not change.

$0Off the bill, per year

$588Now in use, per year

$2,016Freed, to cut at renewal, per year

$420New waste per year

4Security risks resolved

12 licenses freed. They have been taken off people and are back in the pool, so they are not counted as saved yet: on an annual term they are paid for until renewal. Give them to new joiners instead of buying more, and cut the seat count on the renewal date.

New since last time

Who or what	Finding	Per year
Aarav Iyer (aarav.iyer20@northwindtraders.example)	Licenses on blocked accounts	$420

What this has returned so far

Counted since your first review on September 29, 2026, across 2 reviews. Value recovered is an estimate: waste removed (licenses cut, or idle licenses put to use), counted from halfway between the reviews in which it was removed. Licenses that are freed but still paid for are not counted until they are cut.

$588Waste removed, per year

$24Estimated value recovered so far

2Reviews done

32Health score today

Most important

Reduce the paid count by 28 unassigned licensesCould save $4,884 a year
Reassign or remove 7 idle Copilot seatsCould save $1,764 a year
Move 16 web-and-phone users to Business BasicCould save $1,344 a year
Add a second sign-in step (MFA) to 2 admin accountsHigh risk
Make a second sign-in step (MFA) compulsory for everyoneHigh risk

Nothing here happens on its own. Decide each line in approval-workbook.xlsx, and your admin makes only the changes you choose.

32Grade E

TenantTrim health score: 32 out of 100

One number to track every month. Security risks and wasted licenses take points off 100, and every action in "Most important" puts them back.

Up 3 points since the last review.

People changes

2 new accounts, 1 account blocked, 1 account removed since the last review. Every new account adds to the bill, and every leaver who keeps a license keeps costing you.

Name	Sign-in name	Change
Meera Krishnan	meera.krishnan116@northwindtraders.example	Joined
Daniel Okafor	daniel.okafor117@northwindtraders.example	Joined
Aarav Iyer	aarav.iyer20@northwindtraders.example	Blocked since last review
	itsupport.admin@northwindtraders.example	No longer in the tenant

Administrator changes

The number of Global Administrators has gone down from 7 to 6 since the last review. Check every one of them is still meant to have it.

Money

What was found	Count	Per month	Per year
Unassigned licenses	28	$407	$4,884
Idle Copilot seats	7	$147	$1,764
Paying for desktop Office nobody opens	16	$112	$1,344
Licenses on blocked accounts	1	$35	$420
Overlapping licenses	3	$32	$384
Licensed but never signed in	1	$14	$168
Total		$747	$8,964

Before you remove a license. Since 1 July 2026 Microsoft makes a OneDrive with no license read-only after 60 days and archives it after 93, and once it has gone a year unpaid it can be deleted, even if a retention policy or legal hold is on it. Save anything the business still needs to SharePoint first, and turn mailboxes that are still used into shared mailboxes. Every line is in approval-workbook.xlsx for you to decide one by one, and it asks whether mail and files were saved first.

The detail, by finding

Unassigned licenses · 28$4,884 a year

What to do: Lower the license count now, or at renewal if you are on an annual commitment

Who or what	What we found	Per year
Microsoft 365 Business Standard	21 of 111 licenses are paid for but not assigned to anyone	$3,528
Microsoft 365 Copilot	5 of 25 licenses are paid for but not assigned to anyone	$1,260
Exchange Online (Plan 1)	2 of 5 licenses are paid for but not assigned to anyone	$96

Microsoft's instructions: Buy or remove licenses for a subscription · Manage recurring billing

You make this change yourself, in your own admin pages; TenantTrim does not. The steps below were written with the help of AI, so follow Microsoft's own instructions above if they differ, and check them against your own setup first.

How to do it

How it gets done. The number of seats you pay for is part of your Microsoft subscription, not a setting a tool can change. Someone with a billing role lowers it in the admin center.

Check first. Whether new starters are coming who could use the free seats, and when the subscription renews.

Give free seats to new starters before buying more.
To pay for fewer: Microsoft 365 admin center > Billing > Your products > select the subscription > Remove licenses, and enter the new total.
On an annual subscription Microsoft lowers the count straight away only within seven days of buying or renewing; otherwise the change takes effect at the next renewal. Recurring billing must be on.
If you buy through a reseller, ask them to lower the count.

Afterwards. The next review shows fewer paid seats, and counts the saving as verified.

Idle Copilot seats · 7$1,764 a year

What to do: Offer a short Copilot session, then reassign the seat to someone who will use it

Who or what	What we found	Per year
Emma Davisemma.davis25@northwindtraders.example	No Copilot use in the 180 days Microsoft's report covers	$252
Arjun Patelarjun.patel26@northwindtraders.example	No Copilot use in the 180 days Microsoft's report covers	$252
Sophia Millersophia.miller27@northwindtraders.example	No Copilot use in the 180 days Microsoft's report covers	$252
Noah Johnsonnoah.johnson24@northwindtraders.example	No Copilot use in the 180 days Microsoft's report covers	$252
Olivia Wilsonolivia.wilson21@northwindtraders.example	No Copilot use in the 180 days Microsoft's report covers	$252
Liam Brownliam.brown22@northwindtraders.example	No Copilot use in the 180 days Microsoft's report covers	$252
Priya Reddypriya.reddy23@northwindtraders.example	No Copilot use in the 180 days Microsoft's report covers	$252

Microsoft's instructions: Assign or unassign licenses for users

How to do it

How it gets done. Once you approve it, your admin takes the Copilot license off by hand; the person keeps everything else.

Check first. Whether the person would use Copilot after a short session.

Offer a short Copilot session first.
If it stays unused: Billing > Licenses > the Copilot product > select the person > Unassign licenses, then give the seat to someone who asked for it.
If the Copilot license comes from a group (that page shows the group), take the person out of that group instead.

Afterwards. The next review no longer lists the seat as idle.

Paying for desktop Office nobody opens · 16$1,344 a year

What to do: Ask each person before switching, then move them to Microsoft 365 Business Basic at renewal, or on the next bill if you are on a monthly term. The names are in desktop-apps-unused.csv.

Who or what	What we found	Per year
16 people on Microsoft 365 Business Standard	In 180 days these accounts used Microsoft 365 only in a browser or on a phone, never the desktop Office apps on Windows or a Mac. Microsoft 365 Business Basic keeps email, files and the web and phone apps, with the same security; the desktop apps are the difference.	$1,344

Microsoft's instructions: Upgrade or change to a different plan · Assign or unassign licenses for users

How to do it

How it gets done. Moving someone to a cheaper plan is a purchase, a license swap and a conversation with each person.

Check first. With each person, that they really only use Office in a browser or on a phone.

Buy Business Basic seats for the people moving.
Give each of them Business Basic, then take Business Standard off.
Lower the Business Standard seat count at renewal.

Before you start. Business Basic has no desktop Office apps. Everything else, including mail and files, stays.

Afterwards. The next review no longer lists them.

Licenses on blocked accounts · 1$420 a year

What to do: Save any files still needed from their OneDrive to SharePoint and convert the mailbox to a shared mailbox if it is still used, then remove the licenses.

Who or what	What we found	Per year
Aarav Iyeraarav.iyer20@northwindtraders.example	Account is blocked from signing in (often a former employee) but still has: Microsoft 365 Business Standard, Microsoft 365 Copilot	$420

Microsoft's instructions: Remove a former employee · Convert a user mailbox to a shared mailbox · Give another employee access to OneDrive and Outlook data · Manage unlicensed OneDrive accounts

How to do it

How it gets done. Once you approve them, your admin removes these licenses by hand. Check first where the mailbox is over 50 GB, has an archive, could not be checked, or turns out to be a shared or room mailbox rather than someone's own: without its license, that mail can be lost.

Check first. Whether their mail or files are still needed, and whether the mailbox is over 50 GB, has an archive, or is on a hold.

If the mail is still needed, convert the mailbox to a shared mailbox first: Microsoft 365 admin center > Users > Active users > select the person > Mail > Convert to shared mailbox. It must still have its license while you do this.
If their files are still needed, give their manager access to their OneDrive, or move the files to SharePoint.
Remove the license: Users > Active users > select the person > Licenses and apps, clear the licenses, then Save changes.
If a license comes from a group (Billing > Licenses shows the group), take the person out of that group instead.
Use the freed seat for a new starter, or lower the seat count at renewal.

Before you start. A mailbox without a license is deleted by Microsoft after 30 days unless it was converted to a shared mailbox. A shared mailbox works without a license only while it is under 50 GB with no archive and no hold. An unlicensed OneDrive becomes read-only after 60 days and is archived after 93.

Afterwards. The next review no longer lists them. The seat shows as unassigned until it is reused or the count is lowered.

Overlapping licenses · 3$384 a year

Who or what	What we found	Per year
Liam Millerliam.miller102@northwindtraders.example	Microsoft 365 Business Premium already includes what Microsoft 365 Business Standard provides Remove Microsoft 365 Business Standard after confirming nothing depends on it	$168
Olivia Patelolivia.patel101@northwindtraders.example	Microsoft 365 Business Premium already includes what Microsoft 365 Business Standard provides Remove Microsoft 365 Business Standard after confirming nothing depends on it	$168
Ananya Reddyananya.reddy113@northwindtraders.example	Microsoft 365 Business Premium already includes what Exchange Online (Plan 1) provides Remove Exchange Online (Plan 1) after confirming nothing depends on it	$48

Microsoft's instructions: Assign or unassign licenses for users · Assign or unassign licenses to a group

How to do it

How it gets done. Once you approve it, your admin removes the extra license by hand.

Check first. That nothing depends on the extra license itself, such as a group rule or another app.

Users > Active users > select the person > Licenses and apps, clear only the license named here, then Save changes.
If it comes from a group (Billing > Licenses shows the group), change the group instead.

Afterwards. The person still has mail, files and apps through the plan they keep, and the next review no longer lists it.

Licensed but never signed in · 1$168 a year

What to do: Confirm the person exists and still needs the account, then remove or reassign the licenses. A shared mailbox such as info@ or sales@ looks like this too, and needs no license while it is under 50 GB.

Who or what	What we found	Per year
Ava Sharmaava.sharma15@northwindtraders.example	No sign-in or app activity has ever been recorded for this account. Licenses: Microsoft 365 Business Standard	$168

Microsoft's instructions: Assign or unassign licenses for users · About shared mailboxes · Block a former employee from signing in

How to do it

How it gets done. Once you approve them, your admin removes these licenses by hand, and can block sign-in if the account is no longer needed.

Check first. That the person exists and has actually started. A shared mailbox such as info@ looks like this too, and needs no license while it is under 50 GB with no archive or hold.

Ask whoever the account was made for whether it is still needed.
If nobody needs it: Users > Active users > select the account > Block sign-in, then Licenses and apps, clear the licenses, and Save changes.
If a license comes from a group (Billing > Licenses shows the group), take the account out of that group instead.
If it is a shared mailbox, keep its sign-in blocked; Microsoft advises this for every shared mailbox.

Before you start. If a mailbox that is still used loses its license, Microsoft deletes it after 30 days unless it is a shared mailbox under 50 GB with no archive or hold.

Afterwards. The next review no longer lists it.

Who this waste belongs to

Department	Licenses	Per year	Share
Customer Service	3	$672	7%
Finance	2	$672	7%
Sales	2	$420	5%
Operations	1	$252	3%
Warehouse	1	$252	3%
No department set	3	$468

Taken from the Department field on each account in Microsoft 365. Accounts with no department set are listed separately rather than spread across the others. Send each department head their own line: the people who can confirm whether someone still needs a license are the people they report to.

Security

10All risks5High4Medium1Low

Risk	Finding	Why it matters, and what to do
High	MFA is not enforced Everyone	Security defaults are off and no active Conditional Access policy requires MFA for all users. If MFA is switched on person by person with the older per-user setting, this review cannot see it; Microsoft recommends moving from that setting to security defaults or Conditional Access. What to do: Turn on security defaults, or create a Conditional Access policy that requires MFA for all users. Microsoft's instructions: Security defaults · Require MFA for all users with Conditional Access You make this change yourself, in your own admin pages; TenantTrim does not. The steps below were written with the help of AI, so follow Microsoft's own instructions above if they differ, and check them against your own setup first. How to do it How it gets done. Requiring MFA changes how every person signs in. A person turns it on, at a quiet time, after telling everyone. Check first. That every administrator can already sign in with MFA, and whether any scanner or old mail app still signs in with a password alone. Without Entra ID P1 (most small plans): Microsoft Entra admin center > Entra ID > Overview > Properties > Manage security defaults > Enabled > Save. With Entra ID P1 or higher (Business Premium includes it): create a Conditional Access policy that requires MFA for all users, leave out your emergency access accounts, start it in Report-only, then turn it on. Tell people beforehand; they set up MFA at myprofile.microsoft.com under Security info. Before you start. Security defaults also block old sign-in methods and device-code sign-in. After turning them on, run the TenantTrim review with the normal sign-in window rather than -DeviceCode. Afterwards. The next review no longer lists this risk.
High	MFA by text message or phone call only 10 of 110 accounts (9%)	1 of them hold administrator rights. Their only registered method is a text message or a phone call. Microsoft stops sending these codes on 1 February 2027 (for Global Administrators, on 1 July 2027). After that, anyone with nothing else has to register a passkey at sign-in before they can carry on. Phone codes are also the easiest MFA to defeat, through SIM swapping and fake sign-in pages. Full list in mfa-phone-only.csv. What to do: Have these people add the Microsoft Authenticator app or a passkey before 1 February 2027, so the change does not catch them at sign-in. Start with the administrators. Microsoft's instructions: Manage authentication methods · Run a registration campaign You make this change yourself, in your own admin pages; TenantTrim does not. The steps below were written with the help of AI, so follow Microsoft's own instructions above if they differ, and check them against your own setup first. How to do it How it gets done. Each person has to add a stronger method themselves before the phone one can go. Check first. Who relies on a text or call today. Help each person add Microsoft Authenticator or a passkey at myprofile.microsoft.com under Security info. Once they have, turn off text and voice methods: Microsoft Entra admin center > Entra ID > Authentication methods. Before you start. Turn a method off only after everyone who uses it has another one, or they cannot sign in. Afterwards. The next review no longer lists them.
High	Admins without MFA Noah Khan (noah.khan104@northwindtraders.example)	Has admin rights but is not registered for multi-factor authentication What to do: Register MFA for this account, or remove its admin rights. Microsoft's instructions: Require MFA for administrators with Conditional Access · Security defaults You make this change yourself, in your own admin pages; TenantTrim does not. The steps below were written with the help of AI, so follow Microsoft's own instructions above if they differ, and check them against your own setup first. How to do it How it gets done. Each administrator has to set up MFA themselves; nobody can do it for them. Check first. That each account listed is still needed as an administrator. Ask each administrator to set up MFA now at myprofile.microsoft.com under Security info. Then require MFA for every administrator: security defaults do this, or a Conditional Access policy for administrator roles. Before you start. Keep your emergency access accounts out of any policy that could block sign-in. Afterwards. The next review no longer lists them.
High	Too many Global Administrators 6 Global Administrators	olivia.patel101@northwindtraders.example, liam.miller102@northwindtraders.example, priya.smith103@northwindtraders.example, noah.khan104@northwindtraders.example, emma.sharma105@northwindtraders.example, arjun.garcia106@northwindtraders.example What to do: Keep 2 to 4. Give everyone else a narrower admin role. Microsoft's instructions: Best practices for Microsoft Entra roles · Assign Microsoft Entra roles You make this change yourself, in your own admin pages; TenantTrim does not. The steps below were written with the help of AI, so follow Microsoft's own instructions above if they differ, and check them against your own setup first. How to do it How it gets done. Deciding who keeps full control is a business decision. Check first. Who actually needs full control. Most people can do their job with a narrower role. Microsoft Entra admin center > Entra ID > Roles & admins > Global Administrator. Remove the role from anyone who does not need it, and give them a narrower one (such as User Administrator or Billing Administrator). Microsoft recommends fewer than five, including two emergency access accounts. Before you start. Never remove the last working Global Administrator, and keep the emergency access accounts. Afterwards. The next review shows the lower number.
High	Admins without MFA Priya Smith (priya.smith103@northwindtraders.example)	Has admin rights but is not registered for multi-factor authentication What to do: Register MFA for this account, or remove its admin rights.
Medium	Low Secure Score Secure Score 36%	Microsoft rates this tenant at 28 of 77 security points What to do: Work through the top Secure Score improvements in this report. Microsoft's instructions: Microsoft Secure Score recommended actions You make this change yourself, in your own admin pages; TenantTrim does not. The steps below were written with the help of AI, so follow Microsoft's own instructions above if they differ, and check them against your own setup first. How to do it How it gets done. Each Secure Score action changes a setting a person should understand first. Check first. What each recommended action changes for the people who work here. In the Microsoft Defender portal, open Secure Score and its recommended actions. Start with the highest-point actions that do not change how people work. Points take about a day to update. Afterwards. The next review shows a higher score.
Medium	Stale guest accounts 9 of 14 guests	Outside users with no sign-in for 90+ days who can still reach shared files and Teams. Full list in stale-guests.csv. What to do: Remove guests who no longer need access, and review guests every quarter. Microsoft's instructions: Monitor and clean up stale guest accounts You make this change yourself, in your own admin pages; TenantTrim does not. The steps below were written with the help of AI, so follow Microsoft's own instructions above if they differ, and check them against your own setup first. How to do it How it gets done. Only whoever invited a guest knows whether the work has finished. Check first. With whoever invited each guest. Remove guests who no longer need access: Microsoft 365 admin center > Users > Guest users. Review guests every quarter. Afterwards. The next review lists fewer.
Medium	Users without MFA 16 of 102 users (16%)	Not registered for multi-factor authentication. Full list in users-without-mfa.csv. What to do: Ask these users to register for MFA, then require it for everyone. Microsoft's instructions: Run a registration campaign · Security defaults You make this change yourself, in your own admin pages; TenantTrim does not. The steps below were written with the help of AI, so follow Microsoft's own instructions above if they differ, and check them against your own setup first. How to do it How it gets done. Each person has to set up MFA themselves. Check first. Which of the accounts listed are people, and which are service accounts. Ask each person to set up MFA at myprofile.microsoft.com under Security info. Or let Microsoft prompt them at sign-in: Microsoft Entra admin center > Entra ID > Authentication methods > Registration campaign. Afterwards. The next review lists fewer, and then none.
Medium	Outside apps with access to company data 1 outside app	These apps from outside your company can reach company data. An app your business uses and knows about is fine; one nobody recognises is worth turning off. Fabrikam Mail Archive (Fabrikam, Inc., publisher verified by Microsoft) can read email and open files in OneDrive and SharePoint, on its own, across the whole company, with nobody signed in. What to do: In Microsoft Entra admin center, open Entra ID > Enterprise apps > All applications, select each app, then Permissions. Turn off any app nobody recognises or still uses Microsoft's instructions: Review permissions granted to enterprise applications · Configure how users consent to applications You make this change yourself, in your own admin pages; TenantTrim does not. The steps below were written with the help of AI, so follow Microsoft's own instructions above if they differ, and check them against your own setup first. How to do it How it gets done. Only the people who use each app know whether it is still needed. Check first. With the people who use each app: is it still in use, and does it need this much access? Microsoft Entra admin center > Entra ID > Enterprise apps > All applications: select the app, then Permissions. The Admin consent tab shows access given for everyone; the User consent tab shows access people gave it themselves. For an app nobody recognises or uses: on its Properties page set Enabled for users to sign-in to No, then delete it once nobody has missed it. For an app still in use: on the Admin consent tab, revoke any permission it does not need. Before you start. Turning an app off stops whatever it does for the business, such as backups, email signatures or meeting notes. Ask the people who use it first. Afterwards. The next review no longer names the apps you turned off.
Low	Unlicensed accounts can sign in 1 account with no license	These accounts hold no license and have no MFA, but sign-in is still allowed on them. They are usually shared mailboxes, meeting rooms or old service accounts, which Microsoft creates with sign-in switched on. Full list in unlicensed-accounts-without-mfa.csv. What to do: For shared mailboxes and rooms, block sign-in on the account in the Microsoft 365 admin center: the mailbox keeps working for the people who use it. Remove anything nobody can name. Microsoft's instructions: About shared mailboxes You make this change yourself, in your own admin pages; TenantTrim does not. The steps below were written with the help of AI, so follow Microsoft's own instructions above if they differ, and check them against your own setup first. How to do it How it gets done. Only you know which of these accounts are shared mailboxes, meeting rooms or old service accounts. Check first. That nobody signs in to these accounts directly. For each shared mailbox or meeting room: Users > Active users > select it > Block sign-in. The mailbox keeps working, and Microsoft advises keeping it blocked. Afterwards. The next review no longer lists them.

Top Secure Score improvements

Turn on Safe Links for Office apps (+8 points)
Make sure all users can complete multifactor authentication (+8 points)
Block legacy authentication with Conditional Access (+8 points)
Require multifactor authentication for all admin roles (+6 points)
Turn on self-service password reset (+1 points)

Step 2 (optional): clean up

This review changed nothing. If you choose to act on it, 12 license changes on 12 accounts are ready to make, worth up to $2,736 a year. Each removes only the license named, and nothing else about the account changes. None of them happens until you approve it. For 1 person who may have left, the workbook also offers to block sign-in: choose it only for someone who has left. 14 other findings need a person, and are on the Manual actions sheet with Microsoft's own steps.

By hand. Your admin follows the steps under each finding in the Microsoft 365 admin center. Any admin who can manage licenses can do it, and nothing else is needed. Each change is your decision: check it against Microsoft's instructions, linked under each finding, before making it.

The clean-up tool: coming soon. The 12 license changes above, worth up to $2,736 a year, are the kind it will make for you once you approve them, with a record of every change. Until then, your admin makes them by hand. To hear when it is ready, and for tips on doing it by hand: tenanttrim.pages.dev/cleanup.

Proposed
You decide in Excel
Your admin makes it
The next review confirms it

Every proposed change is listed, one account to a line, in approval-workbook.xlsx. Run the review again a month later: it confirms which savings are real.

What this review checked

25 checks ran. 2 of them could not run in full; they are listed here with the reason.

Area	Status	Notes
Licenses against headcount	Not available	Not compared: the number of staff was not given. Run the review again with -Headcount and the number of people who need Microsoft 365.
License term	Not available	Not checked: the license term was not given. Run the review again with -Commitment monthly or -Commitment annual.