Empty Seats, Full Invoices: A Reconciliation Model for Productivity Licence Estates

The cost that arrives quietly

Most UK organisations do not set out to overbuy productivity licences. The problem accumulates. A manager approves an upgrade for a project. A contractor is given a full suite because it is quicker than designing a limited profile. A merger brings a second tenant with its own naming conventions and renewal date. A leaver is disabled but not unlicensed, or a mover retains an entitlement that belonged to a previous role.

By late 2026, the result is familiar: a Microsoft 365 or Google Workspace tenant that is technically well run but commercially untidy. The invoice is paid, the service works, and nobody can say with confidence how many assigned seats correspond to active, role-appropriate work. Seat creep is not usually a technology failure. It is a control gap between HR records, tenant administration, and finance.

The audit should therefore be treated as a reconciliation exercise rather than a licence purge. The aim is not to remove every unused seat overnight. It is to establish a defensible picture of who needs what, identify downgrade and removal candidates, and create a routine that prevents the same drift from returning within twelve months.

Start with three ledgers

A useful licence audit begins with three sources of truth, not with a vendor portal export.

The first is the people ledger: payroll or HR records covering permanent staff, fixed-term employees, contractors, and anyone else with a legitimate identity in the organisation. The second is the tenant ledger: assigned licences, account status, group membership, shared mailboxes, service accounts, and guest accounts. The third is the finance ledger: invoice lines, contract quantities, true-up arrangements, and any add-ons purchased outside the main agreement.

Reconciliation depends on matching identities reliably. Display names are inadequate. Use a stable identifier such as employee number, payroll reference, or a controlled naming convention linked to the identity provider. Build an exception list for accounts that cannot be matched: shared mailboxes with premium plans, service accounts, contractors without HR records, leavers still in a grace period, and duplicate identities created during a migration.

At this stage, resist the urge to change assignments. The first pass is about classification. Mark each account as active employee, contractor, shared or service identity, leaver in transition, duplicate, or unknown. Only after that classification should anyone decide whether an entitlement is justified.

Map tiers to work, not job titles

Job titles are a poor guide to licence requirements. A senior title does not automatically justify the highest tier, and a frontline role may still need desktop applications, Teams telephony, or enhanced security. The audit should compare assigned capability with demonstrated need.

A practical method is to build a tier-fit matrix. List the capabilities that are genuinely used or required: desktop applications, email and calendar, collaboration, storage, telephony, advanced security, compliance and eDiscovery, and any premium add-ons. Then map each user group to the minimum tier that satisfies its needs. This produces three categories: clearly correct, potentially over-licensed, and insufficiently evidenced.

Telemetry can help, but it should be handled with care. A thirty- to sixty-day usage window may be distorted by leave, project cycles, or seasonal work. Low usage is a prompt for review, not proof of waste. Privacy considerations also apply, particularly where monitoring could be seen as surveillance. The objective is to identify patterns across groups, not to single out individuals.

Common downgrade candidates include full productivity suites assigned to users who only need web-based email and collaboration; premium security or compliance tiers held by staff with no access to sensitive data; duplicate add-ons inherited through mergers; and contractor accounts left on permanent-staff profiles. Each candidate should be reviewed with the line manager and, where necessary, the service owner before change.

Time the negotiation before the renewal

The commercial opportunity sits in the run-up to renewal, not after it. A reconciliation that finishes a week before the contract anniversary leaves little room to act. A workable timetable starts ninety to one hundred and twenty days before renewal for larger estates, with earlier notice where notice periods or minimum commitments apply.

Bring evidence to the negotiation: unmatched accounts, duplicate tenants, inactive assignments, a proposed downgrade schedule, and a realistic view of joiners and movers for the next twelve months. The conversation should distinguish between reducing committed quantities, reassigning existing seats, and changing tier mix. These are different levers and may have different contractual consequences.

It is also worth reviewing how the estate is co-termed. Multiple renewal dates and fragmented add-on purchases make seat creep harder to see. Consolidation may not always be commercially preferable, but the organisation should at least understand the trade-off. Where a merger has left two tenants in place, the audit should establish whether consolidation is a genuine option or a longer-term programme.

Build a twelve-month prevention routine

An audit that ends with a spreadsheet will be repeated next year. The more useful outcome is a small set of controls that keep the estate aligned between renewals.

First, connect joiner, mover, and leaver events to licence profiles. A new starter should receive a default profile based on role and contract type, not whatever licence happens to be available. A mover should trigger a review where the new role requires a different tier. A leaver should follow a defined path from account disablement to licence removal, with a recorded grace period where needed.

Second, create a purchase gate. Any new seat or upgrade should pass through a named owner who checks the request against the licence catalogue and the tier-fit matrix. This does not need to be a heavy approval process. It needs to be consistent enough that exceptions are visible.

Third, run a monthly exception review covering unmatched accounts, duplicate identities, contractor records, and shared mailboxes with premium entitlements. Keep it short and evidence-based. Fourth, ask line managers to attest to their teams' licence requirements once a quarter. This is not a technical control, but it is effective at catching role drift that telemetry alone will miss.

Finally, set a modest target. Zero unused seats is an unrealistic goal in most organisations, and an over-aggressive purge creates service risk. A controlled exception rate is more credible. If unmatched or unexplained assignments remain above an agreed threshold, the organisation should know why and who is responsible for resolving them.

A control, not a cleanup

The licence nobody reads is rarely a single document. It is the accumulation of small decisions that were never reconciled. UK organisations can reduce the cost without disrupting the service by treating productivity licences as a governed estate: three ledgers, a tier-fit matrix, a renewal calendar, and a routine that keeps joiner, mover, and leaver events connected to commercial outcomes. The audit is the beginning of that control, not the end of it.