TenantTrim

Money & Risk Review

For Microsoft 365 · Northwind Traders · October 29, 2026

Read-only review: nothing in Microsoft 365 was changed

Sample report. The company, people and numbers are fictional, to show what a review delivers.

You are paying $9,132 a year for Microsoft 365 that nobody is using, and there are 6 high security risks to close.

Estimated$9,132Wasted per year

$761Wasted per month

6High security risks

36%Microsoft Secure Score

30 money findings, 13 of them high confidence130 accounts and 154 paid licenses analysed25 checks run

Estimated at list prices as of 1 Jul 2026, not read from your invoice. Nothing has been changed yet: these are savings available, not savings made. How every figure is worked out.

164days to renewal

Renews on April 12, 2027

Your Microsoft subscription renews on April 12, 2027, 164 days from now. If nothing changes, a further $4,100 will be spent on the waste below before that date. Seats on an annual commitment can normally only be reduced at renewal, so anything not actioned by then is paid for again for another year.

If the year is paid month by month, paying it upfront at renewal costs 5% less: Microsoft has charged 5% more for monthly billing on annual plans since 1 April 2025. This date is the one Microsoft holds for your subscriptions; check it against your invoice. Open renewal-reminders.ics to put 3 reminders for it in your calendar.

Most important

Reduce the paid count by 16 unassigned licensesCould save $2,868 a year
Reassign or remove 8 idle Copilot seatsCould save $2,016 a year
Review 8 licensed users with no activity in 30+ daysCould save $1,344 a year
Add a second sign-in step (MFA) to 2 admin accountsHigh risk
Make a second sign-in step (MFA) compulsory for everyoneHigh risk

Nothing here happens on its own. Decide each line in approval-workbook.xlsx, and your admin makes only the changes you choose.

29Grade E

TenantTrim health score: 29 out of 100

One number to track every month. Security risks and wasted licenses take points off 100, and every action in "Most important" puts them back.

Money

What was found	Count	Per month	Per year
Unassigned licenses	16	$239	$2,868
Idle Copilot seats	8	$168	$2,016
Paying for desktop Office nobody opens	16	$112	$1,344
Inactive licensed users	8	$112	$1,344
Licenses on blocked accounts	6	$84	$1,008
Overlapping licenses	3	$32	$384
Licensed but never signed in	1	$14	$168
Total		$761	$9,132

Before you remove a license. Since 1 July 2026 Microsoft makes a OneDrive with no license read-only after 60 days and archives it after 93, and once it has gone a year unpaid it can be deleted, even if a retention policy or legal hold is on it. Save anything the business still needs to SharePoint first, and turn mailboxes that are still used into shared mailboxes. Every line is in approval-workbook.xlsx for you to decide one by one, and it asks whether mail and files were saved first.

The detail, by finding

Unassigned licenses · 16$2,868 a year

What to do: Lower the license count now, or at renewal if you are on an annual commitment

Who or what	What we found	Per year
Microsoft 365 Business Standard	9 of 111 licenses are paid for but not assigned to anyone	$1,512
Microsoft 365 Copilot	5 of 25 licenses are paid for but not assigned to anyone	$1,260
Exchange Online (Plan 1)	2 of 5 licenses are paid for but not assigned to anyone	$96

Microsoft's instructions: Buy or remove licenses for a subscription · Manage recurring billing

You make this change yourself, in your own admin pages; TenantTrim does not. The steps below were written with the help of AI, so follow Microsoft's own instructions above if they differ, and check them against your own setup first.

How to do it

How it gets done. The number of seats you pay for is part of your Microsoft subscription, not a setting a tool can change. Someone with a billing role lowers it in the admin center.

Check first. Whether new starters are coming who could use the free seats, and when the subscription renews.

Give free seats to new starters before buying more.
To pay for fewer: Microsoft 365 admin center > Billing > Your products > select the subscription > Remove licenses, and enter the new total.
On an annual subscription Microsoft lowers the count straight away only within seven days of buying or renewing; otherwise the change takes effect at the next renewal. Recurring billing must be on.
If you buy through a reseller, ask them to lower the count.

Afterwards. The next review shows fewer paid seats, and counts the saving as verified.

Idle Copilot seats · 8$2,016 a year

What to do: Offer a short Copilot session, then reassign the seat to someone who will use it

Who or what	What we found	Per year
Emma Davisemma.davis25@northwindtraders.example	No Copilot use in 30+ days (last used: 20 Jul 2026)	$252
Noah Johnsonnoah.johnson24@northwindtraders.example	No Copilot use in 30+ days (last used: 5 Aug 2026)	$252
Sophia Millersophia.miller27@northwindtraders.example	No Copilot use in 30+ days (last used: 11 Sep 2026)	$252
Arjun Patelarjun.patel26@northwindtraders.example	No Copilot use in 30+ days (last used: 3 Sep 2026)	$252
Olivia Wilsonolivia.wilson21@northwindtraders.example	No Copilot use in the 180 days Microsoft's report covers	$252
Aarav Iyeraarav.iyer20@northwindtraders.example	No Copilot use in the 180 days Microsoft's report covers	$252
Priya Reddypriya.reddy23@northwindtraders.example	No Copilot use in the 180 days Microsoft's report covers	$252
Liam Brownliam.brown22@northwindtraders.example	No Copilot use in the 180 days Microsoft's report covers	$252

Microsoft's instructions: Assign or unassign licenses for users

How to do it

How it gets done. Once you approve it, your admin takes the Copilot license off by hand; the person keeps everything else.

Check first. Whether the person would use Copilot after a short session.

Offer a short Copilot session first.
If it stays unused: Billing > Licenses > the Copilot product > select the person > Unassign licenses, then give the seat to someone who asked for it.
If the Copilot license comes from a group (that page shows the group), take the person out of that group instead.

Afterwards. The next review no longer lists the seat as idle.

Paying for desktop Office nobody opens · 16$1,344 a year

What to do: Ask each person before switching, then move them to Microsoft 365 Business Basic at renewal, or on the next bill if you are on a monthly term. The names are in desktop-apps-unused.csv.

Who or what	What we found	Per year
16 people on Microsoft 365 Business Standard	In 180 days these accounts used Microsoft 365 only in a browser or on a phone, never the desktop Office apps on Windows or a Mac. Microsoft 365 Business Basic keeps email, files and the web and phone apps, with the same security; the desktop apps are the difference.	$1,344

Microsoft's instructions: Upgrade or change to a different plan · Assign or unassign licenses for users

How to do it

How it gets done. Moving someone to a cheaper plan is a purchase, a license swap and a conversation with each person.

Check first. With each person, that they really only use Office in a browser or on a phone.

Buy Business Basic seats for the people moving.
Give each of them Business Basic, then take Business Standard off.
Lower the Business Standard seat count at renewal.

Before you start. Business Basic has no desktop Office apps. Everything else, including mail and files, stays.

Afterwards. The next review no longer lists them.

Inactive licensed users · 8$1,344 a year

What to do: Check with their manager. If the licenses go, save their OneDrive files and mailbox first, then remove or reassign them.

Who or what	What we found	Per year
Ethan Millerethan.miller12@northwindtraders.example	No sign-in or app activity in 30+ days (last seen: 30 May 2026). Licenses: Microsoft 365 Business Standard	$168
Isabella Patelisabella.patel11@northwindtraders.example	No sign-in or app activity in 30+ days (last seen: 26 Aug 2026). Licenses: Microsoft 365 Business Standard	$168
Mason Khanmason.khan14@northwindtraders.example	No sign-in or app activity in 30+ days (last seen: 29 May 2026). Licenses: Microsoft 365 Business Standard	$168
Ananya Smithananya.smith13@northwindtraders.example	No sign-in or app activity in 30+ days (last seen: 25 Jun 2026). Licenses: Microsoft 365 Business Standard	$168
Lucas Reddylucas.reddy8@northwindtraders.example	No sign-in or app activity in 30+ days (last seen: 9 Aug 2026). Licenses: Microsoft 365 Business Standard	$168
Sophia Brownsophia.brown7@northwindtraders.example	No sign-in or app activity in 30+ days (last seen: 30 Jul 2026). Licenses: Microsoft 365 Business Standard	$168
Rohan Davisrohan.davis10@northwindtraders.example	No sign-in or app activity in 30+ days (last seen: 19 Jun 2026). Licenses: Microsoft 365 Business Standard	$168
Mia Johnsonmia.johnson9@northwindtraders.example	No sign-in or app activity in 30+ days (last seen: 14 Sep 2026). Licenses: Microsoft 365 Business Standard	$168

Microsoft's instructions: Remove a former employee · Block a former employee from signing in · Convert a user mailbox to a shared mailbox

How to do it

How it gets done. Once you approve each one, your admin removes these licenses by hand, and blocks sign-in for someone who has left. Only you can know whether someone has left.

Check first. With their manager: someone on leave, off sick or seconded looks exactly like someone who has left.

Ask their manager whether they still work here and still need the license.
If they have left: Users > Active users > select them > Block sign-in. On the Account tab, Sign out of all sessions.
If their mail is still needed, convert the mailbox to a shared mailbox, and give their manager their OneDrive files.
Then remove the license: Licenses and apps, clear the licenses, Save changes.
If a license comes from a group (Billing > Licenses shows the group), take the person out of that group instead.

Before you start. A mailbox without a license is deleted by Microsoft after 30 days unless it was converted to a shared mailbox. An unlicensed OneDrive becomes read-only after 60 days and is archived after 93.

Afterwards. The next review no longer lists them.

Licenses on blocked accounts · 6$1,008 a year

What to do: Save any files still needed from their OneDrive to SharePoint and convert the mailbox to a shared mailbox if it is still used, then remove the licenses.

Who or what	What we found	Per year
Noah Nairnoah.nair4@northwindtraders.example	Account is blocked from signing in (often a former employee) but still has: Microsoft 365 Business Standard	$168
Emma Iyeremma.iyer5@northwindtraders.example	Account is blocked from signing in (often a former employee) but still has: Microsoft 365 Business Standard	$168
Arjun Wilsonarjun.wilson6@northwindtraders.example	Account is blocked from signing in (often a former employee) but still has: Microsoft 365 Business Standard	$168
Olivia Garciaolivia.garcia1@northwindtraders.example	Account is blocked from signing in (often a former employee) but still has: Microsoft 365 Business Standard	$168
Liam Taylorliam.taylor2@northwindtraders.example	Account is blocked from signing in (often a former employee) but still has: Microsoft 365 Business Standard	$168
Priya Williamspriya.williams3@northwindtraders.example	Account is blocked from signing in (often a former employee) but still has: Microsoft 365 Business Standard	$168

Microsoft's instructions: Remove a former employee · Convert a user mailbox to a shared mailbox · Give another employee access to OneDrive and Outlook data · Manage unlicensed OneDrive accounts

How to do it

How it gets done. Once you approve them, your admin removes these licenses by hand. Check first where the mailbox is over 50 GB, has an archive, could not be checked, or turns out to be a shared or room mailbox rather than someone's own: without its license, that mail can be lost.

Check first. Whether their mail or files are still needed, and whether the mailbox is over 50 GB, has an archive, or is on a hold.

If the mail is still needed, convert the mailbox to a shared mailbox first: Microsoft 365 admin center > Users > Active users > select the person > Mail > Convert to shared mailbox. It must still have its license while you do this.
If their files are still needed, give their manager access to their OneDrive, or move the files to SharePoint.
Remove the license: Users > Active users > select the person > Licenses and apps, clear the licenses, then Save changes.
If a license comes from a group (Billing > Licenses shows the group), take the person out of that group instead.
Use the freed seat for a new starter, or lower the seat count at renewal.

Before you start. A mailbox without a license is deleted by Microsoft after 30 days unless it was converted to a shared mailbox. A shared mailbox works without a license only while it is under 50 GB with no archive and no hold. An unlicensed OneDrive becomes read-only after 60 days and is archived after 93.

Afterwards. The next review no longer lists them. The seat shows as unassigned until it is reused or the count is lowered.

Overlapping licenses · 3$384 a year

Who or what	What we found	Per year
Liam Millerliam.miller102@northwindtraders.example	Microsoft 365 Business Premium already includes what Microsoft 365 Business Standard provides Remove Microsoft 365 Business Standard after confirming nothing depends on it	$168
Olivia Patelolivia.patel101@northwindtraders.example	Microsoft 365 Business Premium already includes what Microsoft 365 Business Standard provides Remove Microsoft 365 Business Standard after confirming nothing depends on it	$168
Ananya Reddyananya.reddy113@northwindtraders.example	Microsoft 365 Business Premium already includes what Exchange Online (Plan 1) provides Remove Exchange Online (Plan 1) after confirming nothing depends on it	$48

Microsoft's instructions: Assign or unassign licenses for users · Assign or unassign licenses to a group

How to do it

How it gets done. Once you approve it, your admin removes the extra license by hand.

Check first. That nothing depends on the extra license itself, such as a group rule or another app.

Users > Active users > select the person > Licenses and apps, clear only the license named here, then Save changes.
If it comes from a group (Billing > Licenses shows the group), change the group instead.

Afterwards. The person still has mail, files and apps through the plan they keep, and the next review no longer lists it.

Licensed but never signed in · 1$168 a year

What to do: Confirm the person exists and still needs the account, then remove or reassign the licenses. A shared mailbox such as info@ or sales@ looks like this too, and needs no license while it is under 50 GB.

Who or what	What we found	Per year
Ava Sharmaava.sharma15@northwindtraders.example	No sign-in or app activity has ever been recorded for this account. Licenses: Microsoft 365 Business Standard	$168

Microsoft's instructions: Assign or unassign licenses for users · About shared mailboxes · Block a former employee from signing in

How to do it

How it gets done. Once you approve them, your admin removes these licenses by hand, and can block sign-in if the account is no longer needed.

Check first. That the person exists and has actually started. A shared mailbox such as info@ looks like this too, and needs no license while it is under 50 GB with no archive or hold.

Ask whoever the account was made for whether it is still needed.
If nobody needs it: Users > Active users > select the account > Block sign-in, then Licenses and apps, clear the licenses, and Save changes.
If a license comes from a group (Billing > Licenses shows the group), take the account out of that group instead.
If it is a shared mailbox, keep its sign-in blocked; Microsoft advises this for every shared mailbox.

Before you start. If a mailbox that is still used loses its license, Microsoft deletes it after 30 days unless it is a shared mailbox under 50 GB with no archive or hold.

Afterwards. The next review no longer lists it.

Who this waste belongs to

Department	Licenses	Per year	Share
Customer Service	5	$1,008	11%
Finance	5	$1,008	11%
Operations	4	$756	8%
Sales	4	$756	8%
Warehouse	3	$588	6%
No department set	5	$804

Taken from the Department field on each account in Microsoft 365. Accounts with no department set are listed separately rather than spread across the others. Send each department head their own line: the people who can confirm whether someone still needs a license are the people they report to.

Security

13All risks6High6Medium1Low

Risk	Finding	Why it matters, and what to do
High	MFA by text message or phone call only 10 of 110 accounts (9%)	1 of them hold administrator rights. Their only registered method is a text message or a phone call. Microsoft stops sending these codes on 1 February 2027 (for Global Administrators, on 1 July 2027). After that, anyone with nothing else has to register a passkey at sign-in before they can carry on. Phone codes are also the easiest MFA to defeat, through SIM swapping and fake sign-in pages. Full list in mfa-phone-only.csv. What to do: Have these people add the Microsoft Authenticator app or a passkey before 1 February 2027, so the change does not catch them at sign-in. Start with the administrators. Microsoft's instructions: Manage authentication methods · Run a registration campaign You make this change yourself, in your own admin pages; TenantTrim does not. The steps below were written with the help of AI, so follow Microsoft's own instructions above if they differ, and check them against your own setup first. How to do it How it gets done. Each person has to add a stronger method themselves before the phone one can go. Check first. Who relies on a text or call today. Help each person add Microsoft Authenticator or a passkey at myprofile.microsoft.com under Security info. Once they have, turn off text and voice methods: Microsoft Entra admin center > Entra ID > Authentication methods. Before you start. Turn a method off only after everyone who uses it has another one, or they cannot sign in. Afterwards. The next review no longer lists them.
High	MFA is not enforced Everyone	Security defaults are off and no active Conditional Access policy requires MFA for all users. If MFA is switched on person by person with the older per-user setting, this review cannot see it; Microsoft recommends moving from that setting to security defaults or Conditional Access. What to do: Turn on security defaults, or create a Conditional Access policy that requires MFA for all users. Microsoft's instructions: Security defaults · Require MFA for all users with Conditional Access You make this change yourself, in your own admin pages; TenantTrim does not. The steps below were written with the help of AI, so follow Microsoft's own instructions above if they differ, and check them against your own setup first. How to do it How it gets done. Requiring MFA changes how every person signs in. A person turns it on, at a quiet time, after telling everyone. Check first. That every administrator can already sign in with MFA, and whether any scanner or old mail app still signs in with a password alone. Without Entra ID P1 (most small plans): Microsoft Entra admin center > Entra ID > Overview > Properties > Manage security defaults > Enabled > Save. With Entra ID P1 or higher (Business Premium includes it): create a Conditional Access policy that requires MFA for all users, leave out your emergency access accounts, start it in Report-only, then turn it on. Tell people beforehand; they set up MFA at myprofile.microsoft.com under Security info. Before you start. Security defaults also block old sign-in methods and device-code sign-in. After turning them on, run the TenantTrim review with the normal sign-in window rather than -DeviceCode. Afterwards. The next review no longer lists this risk.
High	Staff can approve outside apps App consent setting	Any member of staff can grant an outside app access to company mail and files, without an administrator approving it. Fake consent screens are one of the most common ways attackers get in without a password. What to do: In Microsoft Entra admin center, set Enterprise applications > Consent and permissions > User consent to "Do not allow", and turn on the admin consent request workflow Microsoft's instructions: Configure how users consent to applications You make this change yourself, in your own admin pages; TenantTrim does not. The steps below were written with the help of AI, so follow Microsoft's own instructions above if they differ, and check them against your own setup first. How to do it How it gets done. Changing who can approve apps affects everyone, so a person chooses the setting. Check first. Which outside apps people approve today. Microsoft Entra admin center > Entra ID > Enterprise apps > Consent and permissions > User consent settings. Choose to allow only apps from verified publishers for selected permissions, or do not allow user consent, then Save. Before you start. Set up the admin consent workflow at the same time, so people can still ask for an app they need. Afterwards. The next review no longer lists this.
High	Admins without MFA Noah Khan (noah.khan104@northwindtraders.example)	Has admin rights but is not registered for multi-factor authentication What to do: Register MFA for this account, or remove its admin rights. Microsoft's instructions: Require MFA for administrators with Conditional Access · Security defaults You make this change yourself, in your own admin pages; TenantTrim does not. The steps below were written with the help of AI, so follow Microsoft's own instructions above if they differ, and check them against your own setup first. How to do it How it gets done. Each administrator has to set up MFA themselves; nobody can do it for them. Check first. That each account listed is still needed as an administrator. Ask each administrator to set up MFA now at myprofile.microsoft.com under Security info. Then require MFA for every administrator: security defaults do this, or a Conditional Access policy for administrator roles. Before you start. Keep your emergency access accounts out of any policy that could block sign-in. Afterwards. The next review no longer lists them.
High	Too many Global Administrators 7 Global Administrators	olivia.patel101@northwindtraders.example, liam.miller102@northwindtraders.example, priya.smith103@northwindtraders.example, noah.khan104@northwindtraders.example, emma.sharma105@northwindtraders.example, arjun.garcia106@northwindtraders.example, itsupport.admin@northwindtraders.example What to do: Keep 2 to 4. Give everyone else a narrower admin role. Microsoft's instructions: Best practices for Microsoft Entra roles · Assign Microsoft Entra roles You make this change yourself, in your own admin pages; TenantTrim does not. The steps below were written with the help of AI, so follow Microsoft's own instructions above if they differ, and check them against your own setup first. How to do it How it gets done. Deciding who keeps full control is a business decision. Check first. Who actually needs full control. Most people can do their job with a narrower role. Microsoft Entra admin center > Entra ID > Roles & admins > Global Administrator. Remove the role from anyone who does not need it, and give them a narrower one (such as User Administrator or Billing Administrator). Microsoft recommends fewer than five, including two emergency access accounts. Before you start. Never remove the last working Global Administrator, and keep the emergency access accounts. Afterwards. The next review shows the lower number.
High	Admins without MFA Priya Smith (priya.smith103@northwindtraders.example)	Has admin rights but is not registered for multi-factor authentication What to do: Register MFA for this account, or remove its admin rights.
Medium	Outside apps with access to company data 2 outside apps	These apps from outside your company can reach company data. An app your business uses and knows about is fine; one nobody recognises is worth turning off. Fabrikam Mail Archive (Fabrikam, Inc., publisher verified by Microsoft) can read email and open files in OneDrive and SharePoint, on its own, across the whole company, with nobody signed in. Litware Meeting Notes (publisher not verified) can read email and read Teams chats, meeting transcripts or recordings, for 2 people who approved it themselves. Access approved for people reaches only what each of those people can reach themselves. What to do: In Microsoft Entra admin center, open Entra ID > Enterprise apps > All applications, select each app, then Permissions. Turn off any app nobody recognises or still uses Microsoft's instructions: Review permissions granted to enterprise applications · Configure how users consent to applications You make this change yourself, in your own admin pages; TenantTrim does not. The steps below were written with the help of AI, so follow Microsoft's own instructions above if they differ, and check them against your own setup first. How to do it How it gets done. Only the people who use each app know whether it is still needed. Check first. With the people who use each app: is it still in use, and does it need this much access? Microsoft Entra admin center > Entra ID > Enterprise apps > All applications: select the app, then Permissions. The Admin consent tab shows access given for everyone; the User consent tab shows access people gave it themselves. For an app nobody recognises or uses: on its Properties page set Enabled for users to sign-in to No, then delete it once nobody has missed it. For an app still in use: on the Admin consent tab, revoke any permission it does not need. Before you start. Turning an app off stops whatever it does for the business, such as backups, email signatures or meeting notes. Ask the people who use it first. Afterwards. The next review no longer names the apps you turned off.
Medium	Anyone can invite guests Guest invite setting	Every member of staff can invite outside people into your Microsoft 365 tenant and share company files with them. Nobody reviews or records the invitation. What to do: In Microsoft Entra admin center, set External collaboration settings so only administrators and guest inviters can invite Microsoft's instructions: Configure external collaboration You make this change yourself, in your own admin pages; TenantTrim does not. The steps below were written with the help of AI, so follow Microsoft's own instructions above if they differ, and check them against your own setup first. How to do it How it gets done. A tenant-wide setting that a person changes. Check first. Who needs to invite guests. They can be given the Guest Inviter role. Microsoft Entra admin center > Entra ID > External Identities > External collaboration settings > Guest invite settings: choose Only users assigned to specific admin roles can invite guest users. Afterwards. The next review no longer lists this.
Medium	Low Secure Score Secure Score 36%	Microsoft rates this tenant at 28 of 77 security points What to do: Work through the top Secure Score improvements in this report. Microsoft's instructions: Microsoft Secure Score recommended actions You make this change yourself, in your own admin pages; TenantTrim does not. The steps below were written with the help of AI, so follow Microsoft's own instructions above if they differ, and check them against your own setup first. How to do it How it gets done. Each Secure Score action changes a setting a person should understand first. Check first. What each recommended action changes for the people who work here. In the Microsoft Defender portal, open Secure Score and its recommended actions. Start with the highest-point actions that do not change how people work. Points take about a day to update. Afterwards. The next review shows a higher score.
Medium	Users without MFA 17 of 110 users (15%)	Not registered for multi-factor authentication. Full list in users-without-mfa.csv. What to do: Ask these users to register for MFA, then require it for everyone. Microsoft's instructions: Run a registration campaign · Security defaults You make this change yourself, in your own admin pages; TenantTrim does not. The steps below were written with the help of AI, so follow Microsoft's own instructions above if they differ, and check them against your own setup first. How to do it How it gets done. Each person has to set up MFA themselves. Check first. Which of the accounts listed are people, and which are service accounts. Ask each person to set up MFA at myprofile.microsoft.com under Security info. Or let Microsoft prompt them at sign-in: Microsoft Entra admin center > Entra ID > Authentication methods > Registration campaign. Afterwards. The next review lists fewer, and then none.
Medium	Dormant administrator account IT Support (previous provider) (itsupport.admin@northwindtraders.example)	Holds full administrator rights and was last signed in to on March 31, 2026. An account nobody uses is an account nobody watches, which is exactly what an attacker wants. What to do: If this is your emergency break-glass account, keep it, and check it has a long unique password and MFA. If it is not, take the administrator role off it. Microsoft's instructions: Assign Microsoft Entra roles · Manage inactive user accounts You make this change yourself, in your own admin pages; TenantTrim does not. The steps below were written with the help of AI, so follow Microsoft's own instructions above if they differ, and check them against your own setup first. How to do it How it gets done. It may be your emergency access account, which is meant to go unused. Check first. Whether this is an emergency access (break-glass) account. If it is, leave it. If nobody needs it: Microsoft Entra admin center > Entra ID > Roles & admins, and remove its role. Or block its sign-in: Microsoft 365 admin center > Users > Active users > select it > Block sign-in. Afterwards. The next review no longer lists it.
Medium	Stale guest accounts 9 of 14 guests	Outside users with no sign-in for 90+ days who can still reach shared files and Teams. Full list in stale-guests.csv. What to do: Remove guests who no longer need access, and review guests every quarter. Microsoft's instructions: Monitor and clean up stale guest accounts You make this change yourself, in your own admin pages; TenantTrim does not. The steps below were written with the help of AI, so follow Microsoft's own instructions above if they differ, and check them against your own setup first. How to do it How it gets done. Only whoever invited a guest knows whether the work has finished. Check first. With whoever invited each guest. Remove guests who no longer need access: Microsoft 365 admin center > Users > Guest users. Review guests every quarter. Afterwards. The next review lists fewer.
Low	Staff can register apps App registration setting	Every member of staff can register applications in your tenant. These can hold long-lived credentials that survive a password reset. What to do: In Microsoft Entra admin center, set User settings > Users can register applications to No Microsoft's instructions: Restrict who can create applications You make this change yourself, in your own admin pages; TenantTrim does not. The steps below were written with the help of AI, so follow Microsoft's own instructions above if they differ, and check them against your own setup first. How to do it How it gets done. A tenant-wide setting that a person changes. Check first. Whether anyone builds apps against your Microsoft 365. They can be given the Application Developer role. Microsoft Entra admin center > Entra ID > Users > User settings: set Users can register applications to No. Afterwards. The next review no longer lists this.

Top Secure Score improvements

Turn on Safe Links for Office apps (+8 points)
Make sure all users can complete multifactor authentication (+8 points)
Block legacy authentication with Conditional Access (+8 points)
Require multifactor authentication for all admin roles (+6 points)
Turn on self-service password reset (+1 points)

Step 2 (optional): clean up

This review changed nothing. If you choose to act on it, 26 license changes on 26 accounts are ready to make, worth up to $4,920 a year. Each removes only the license named, and nothing else about the account changes. None of them happens until you approve it. For 9 people who may have left, the workbook also offers to block sign-in: choose it only for someone who has left. 17 other findings need a person, and are on the Manual actions sheet with Microsoft's own steps.

By hand. Your admin follows the steps under each finding in the Microsoft 365 admin center. Any admin who can manage licenses can do it, and nothing else is needed. Each change is your decision: check it against Microsoft's instructions, linked under each finding, before making it.

The clean-up tool: coming soon. The 26 license changes above, worth up to $4,920 a year, are the kind it will make for you once you approve them, with a record of every change. Until then, your admin makes them by hand. To hear when it is ready, and for tips on doing it by hand: tenanttrim.pages.dev/cleanup.

Proposed
You decide in Excel
Your admin makes it
The next review confirms it

Every proposed change is listed, one account to a line, in approval-workbook.xlsx. Run the review again a month later: it confirms which savings are real.

What this review checked

25 checks ran. 2 of them could not run in full; they are listed here with the reason.

Area	Status	Notes
Licenses against headcount	Not available	Not compared: the number of staff was not given. Run the review again with -Headcount and the number of people who need Microsoft 365.
License term	Not available	Not checked: the license term was not given. Run the review again with -Commitment monthly or -Commitment annual.