The MSP license audit: How to find wasted spend across every client tenant

Key takeaways

• Performing a standardized, multi-tenant license audit ahead of each billing cycle catches unassigned subscriptions before they hit the invoice, protecting gross margin across every client account.
• Building ghost license detection into your offboarding workflow eliminates the single most common billing error found in Microsoft 365 audits.
• Reconciling PSA pricing against current Microsoft retail rates after every price increase prevents invisible margin compression that compounds across dozens of tenants.
• Connecting CIPP (CyberDrain Improved Partner Portal) to an API-integrated distributor enables auditing inventory, detecting inactive accounts and adjusting subscriptions across all client tenants from a single interface.

Picture this: you’ve got 30 clients, 30 Microsoft 365 admin centers, 30 separate sets of user identities accumulating drift and 30 monthly billing cycles that depend on accurate seat counts. Now imagine one technician offboards an employee for one client account, but forgets to remove their license from the CSP portal.

You’re going to be billed for that unused license every month until someone discovers it.

For managed service providers (MSPs) running manual, tenant-by-tenant reconciliation, that scenario is common. However, a Microsoft 365 license audit shouldn’t be a one-time clean-up exercise, but rather a process built into your operations. It’s what separates MSPs who protect their margins from those who absorb costs they can’t see.

Keep reading for common Microsoft billing issues and help building a repeatable audit process for every client tenant to prevent overbilling.

Why Microsoft license billing issues are so common

Billing discrepancies in the Microsoft 365 channel often result from multiple errors that accumulate due to structural gaps between technical provisioning and financial accounting.

Running a modern Microsoft 365 practice requires synchronized tracking across the Microsoft Partner Center, distributor marketplaces, client Microsoft Entra ID (formerly Azure Active Directory) environments and PSA (Professional Services Automation) tools. A breakdown anywhere in that chain creates financial leakage.

These four friction points explain why billing errors compound across multi-tenant environments:

• Mid-cycle subscription changes. Client headcount changes throughout the month. That’s normal. When a client adds seats mid-cycle, provisioning takes effect immediately inside the tenant. If the PSA isn’t updated at the same time, the MSP pays the distributor for the extra seat while continuing to bill the client at the old quantity.
• NCE commitment windows. Under Microsoft’s NCE (New Commerce Experience) framework, seat reductions are restricted to a 7-day window after initial purchase or annual renewal. Miss that window after a client downsizes, and the MSP must continue to pay for that unused seat for the remainder of the term.
• PSA retail price sync gaps. Distributors pass through wholesale cost changes via API when Microsoft raises prices. However, many don’t automatically update retail prices inside PSA tools like ConnectWise Manage, Autotask or Kaseya BMS. When the PSA price book still reflects legacy retail rates, client invoices are generated with the old price while the MSP absorbs the difference, and that gap can be significant as it compounds across all affected tenants.
• Decentralized provisioning. Technicians frequently provision licenses directly inside the Microsoft 365 Admin Center while resolving a support ticket, without executing the corresponding workflow in the distributor marketplace or updating the PSA contract. The technical reality and the billing record drift apart.

What a Microsoft 365 license audit actually covers

An MSP license audit is an operational and financial control exercise. It’s designed to align active technical allocations with actual user activity and recurring client billing. It does not inspect legal entitlement compliance.

These three areas should be inspected and verified or updated in your audit:

1. License inventory: The baseline count of paid subscription seats in the CSP portal versus the number of licenses assigned to active user accounts in Entra ID. Unassigned seats sitting idle in the tenant pool are the first target.
2. License usage: Whether assigned licenses reflect actual user behaviour. For example, an employee is assigned to the Enterprise E5 suite but never actually uses its advanced compliance or governance features. You could downgrade their access to Business Premium and save costs.
3. License cost: The financial reconciliation layer. Match distributor wholesale invoices against current Microsoft retail pricing and PSA contract line items. This is where price sync gaps become visible and can be amended.

License inventory vs. license usage vs. license cost

Most single-tenant audit guides stop at inventory. That’s enough for a corporate IT department managing one organization. For an MSP, it’s only the first third of the picture. Usage data identifies rightsizing opportunities, while cost alignment catches margin erosion. All three layers are required to run an audit that actually protects the business.

What changes between a single-tenant audit and a multi-tenant one

Single-tenant audit methods (native Microsoft 365 Admin Center reports, Microsoft Purview and tenant-specific PowerShell scripts) work well for an internal IT team managing a single organization. They break down fast at MSP scale.

Running sequential single-tenant workflows across 30, 50 or 100 clients introduces much higher overhead. Each admin center requires an individual authentication context switch. PowerShell scripts run one tenant at a time, can’t aggregate data across tenants and are bound by native retention limits. Microsoft Purview’s standard audit logs cap at 180 days by default.

Here’s how the two approaches compare:

The four-stage audit framework

MSPs need a repeatable, four-stage process applied consistently to every client environment. Each stage produces a defined output that feeds into the next.

Here’s a summary of what each stage addresses:

Let’s discuss each stage in more detail…

Stage 1: Inventory—what subscriptions exist and who has what

The inventory stage establishes your baseline. Your technical teams pull license allocation data from tenant directory endpoints and cross-reference it against active CSP subscriptions.

You’re seeking to determine if the number of licenses purchased matches the number assigned to active user accounts. A small buffer of one or two unassigned seats is often intentional, held for rapid onboarding in the future. Anything beyond that deserves scrutiny.

Stage 1 output: Full license assignment list by user, by tenant

Stage 1 primary tools used: CIPP license reports, Microsoft 365 Admin Center, Graph API/PowerShell

Stage 2: Usage check—identify inactive accounts and ghost licenses

This is where you’re likely to uncover the most Microsoft billing issues. Ghost licenses are paid subscriptions still assigned to offboarded, disabled or dormant user accounts.

Ghost licenses from late offboarding are often the most frequently encountered issue across partners managing multiple tenants. The pattern is consistent: a helpdesk technician executes an offboarding ticket by blocking the user’s sign-in and converting the mailbox to shared, but the paid license assignment stays in place, and the seat is never cancelled. The distributor keeps billing.

This stage seeks out:

• User accounts with zero interactive sign-in activity over the past 90 days.
• Licenses assigned to disabled, external or temporary test accounts.
• Shared mailboxes retaining paid standalone licenses despite qualifying for free shared mailbox status (under 50 GB storage).

The Zylo 2026 SaaS Management Index found that an average of 46% of provisioned licenses sit unused or underutilized in any given month across corporate SaaS environments. Inside an MSP’s client portfolio, that unused capacity is direct margin leakage. The MSP pays the distributor for unused licenses.

Stage 2 output: List of candidates for license reclamation

Stage 3: Cost alignment—match license costs to PSA and current retail pricing

Stage 3 moves from technical data to financial reconciliation. This step catches billing discrepancies before client invoices go out. Three evaluations happen here:

1. PSA pricing audit. Verify that the retail unit pricing charged to clients in the PSA reflects current Microsoft list prices. Sherweb doesn’t automatically sync Microsoft retail prices to PSA tools. This is a known process gap that requires manual reconciliation after any price adjustment. When the PSA still reflects old retail rates, the MSP absorbs the extra costs on every affected tenant.
2. SKU optimization. Evaluate whether clients are carrying suboptimal license combinations. Here’s a common example: your client is running Microsoft 365 Business Standard with separate add-ons for Microsoft Defender for Business, Entra ID Plan 1 and Intune. If you consolidate those components into a Microsoft 365 Business Premium account, you can deliver stronger security integration at a lower aggregate monthly cost.
3. NCE renewal alignment. Review upcoming commitment expiration dates. Annual NCE agreements approaching renewal represent a critical window to reduce seat counts or switch billing frequencies without penalty (or having to hold unused seats for another term).

Stage 3 output: Cost discrepancy report by client tenant

Stage 4: Action and documentation—reclaim, reassign, escalate

Stage 4 converts audit findings into verified changes and records. Reclaiming licenses without client confirmation risks disrupting access or violating that client’s specific requirements.

Here are the tasks you should perform during this stage:

1. Client confirmation. Present reclamation candidates (dormant accounts, SKU consolidation opportunities) to client contacts for sign-off before making any changes.
2. Technical execution. Unassign redundant licenses in Entra ID and execute seat reductions in the CSP distributor portal.
3. PSA reconciliation. Update recurring agreement quantities, proration adjustments and unit prices in the PSA before the next billing cycle.
4. Baseline documentation. Export and archive audit snapshot data into an external data store. This preserves historical visibility beyond Microsoft’s native retention limits and gives you a defensible record if questions arise later.

Stage 4 output: Updated license counts, billing notes and signed client confirmations

How CIPP makes this scalable across all client tenants

Running a four-stage audit manually across 50 client environments is operationally expensive and not scalable. CIPP is an open-source, hosted, multi-tenant management layer built specifically for MSPs to unify Microsoft 365 administration across all clients in a single interface.

Cross-tenant license visibility from a single dashboard

Rather than authenticating to each client portal individually, administrators can access a global view showing total provisioned seats, active assignments and unassigned buffers across all managed organizations. The authentication context switching that makes tenant-by-tenant auditing slow disappears entirely.

Automated detection of inactive accounts and licensing drift

CIPP automates the core work of Stage 2. Built-in reporting routines continuously query sign-in timestamps across all mapped tenants, surfacing accounts that have been dormant for 90 to 180 days. It also tracks configuration baselines. When an unauthorized seat addition or unmapped SKU appears in a tenant, CIPP flags the deviation so it gets caught before the billing cycle closes.

What Sherweb’s exclusive CIPP integration adds

Standard CIPP deployment handles multi-tenant Microsoft 365 management. Sherweb’s exclusive distributor integration extends that to cover the billing and procurement layer, connecting technical tenant data directly to financial workflows. Key capabilities include:

• API-driven license procurement inside CIPP. Administrators can increase or decrease subscription seat quantities directly within the CIPP interface. Changes are executed through a direct API call to Sherweb’s billing engine. This eliminates the need to switch between the management portal and the distributor catalog.
• The Sherweb Licence Report. Standard tenant reports analyze only what’s assigned inside Microsoft 365 directories. The dedicated Sherweb Licence Report within CIPP queries Sherweb’s billing API directly, placing billed subscription counts side by side with active tenant assignments. If an MSP is paying for 50 licenses on a distributor agreement while only 42 seats are assigned in the tenant, that discrepancy appears immediately, without any manual cross-referencing.
• Automated offboarding and provisioning workflows. When a user account is removed, integrated offboarding wizards automatically ensure the associated license is either unassigned or scheduled for cancellation in the distributor portal. This closes the process gap that produces ghost licenses in the first place.
• NCE migration support. The integration provides structured workflows for migrating legacy CSP subscriptions into NCE structures while managing commitment terms and seat constraints.
• Real-time PSA billing sync. Combined with Sherweb’s native HaloPSA integration, license modifications trigger event-driven billing updates. Subscription changes flow into client contract agreements immediately, updating quantities and calculating proration automatically rather than waiting for daily batch syncs.

For an MSP managing 30-plus client tenants, the difference between running the four-stage audit in CIPP and a portal-by-portal manual process is significant in terms of overhead and technician time. It’s the difference between an audit cadence that’s sustainable and one that still misses things even with a dedicated person behind it.

How often should MSPs run a license audit?

A thorough annual audit will catch some things, but not the ghost license created by last month’s offboarding ticket, or the PSA pricing gap that opened the day Microsoft raised prices. We recommend a combination of monthly, quarterly and annual reviews. The strongest MSPs treat licensing audits as a proactive, recurring customer-lifecycle motion.

Protecting margins consistently requires several cadences:

• Monthly pre-billing cycle sync. Perform these syncs three to five days before generating monthly client invoices. This rapid check confirms unassigned seats, catches ghost licenses from recent offboardings and verifies PSA contract quantities match active CSP billing.
• Quarterly business review alignment. This is a deeper review integrated into client QBRs. Use it to present license utilization summaries, highlight cost-saving adjustments made on the client’s behalf and recommend structural changes such as SKU consolidation. Framing audit outputs as a client-facing deliverable turns backend maintenance into visible advisory value, the kind that strengthens retention.
• Annual NCE renewal window. Schedule your annual review 30 to 60 days before NCE subscriptions expire. This is the only window to reduce baseline seat commitments or switch billing frequencies without financial penalty.
• Microsoft price increase triggers. When Microsoft announces price adjustments, you should review your accounts. Review PSA rate cards against incoming distributor wholesale cost changes and update price books before billing cycles run at legacy rates.

Most Microsoft billing issues result from unmanaged licensing drift, ghost licenses and PSA pricing gaps. Manual, single-tenant inspection methods don’t help prevent unnecessary costs from accumulating and compounding over multiple MSP client accounts.

We recommend implementing a repeatable and scalable four-stage audit framework. Running this audit consistently, supported by multi-tenant tooling, closes the operational gaps between technical administration and billing.

Looking to expand your Microsoft 365 practice? Resell Microsoft 365 with Sherweb and get access to the distributor tools, support and integrations built for MSPs managing clients at scale. Join Sherweb’s partner program to get started.

Frequently asked questions

How do I check for unused Microsoft 365 licenses?

To check for unused Microsoft 365 licenses, MSPs need to analyze account sign-in activity and entitlement assignments across client tenants. Filter user directories for accounts with zero interactive sign-ins over 90 days, locate disabled accounts that still carry active license assignments and identify unassigned subscription seats sitting idle in the tenant pool. Tools like CIPP, Graph API reports or the Microsoft 365 Admin Center can surface this data. CIPP is the only option that aggregates it across all tenants simultaneously.

How often should an MSP audit Microsoft 365 licenses?

MSPs should audit Microsoft 365 licenses monthly before billing runs, with deeper strategic reviews tied to client QBRs each quarter and a dedicated review 30 to 60 days before annual NCE subscriptions renew. Monthly checks catch operational issues like ghost licenses and unbilled mid-cycle seat additions. Quarterly reviews identify opportunities for longer-term rightsizing and tier consolidation.

What is a ghost license in Microsoft 365?

A ghost license in Microsoft 365 is an active paid subscription that continues generating wholesale charges in the CSP portal after the associated user has been offboarded or disabled. This typically happens when a technician disables a departing employee’s account but doesn’t remove the license assignment or cancel the seat in the distributor portal. The distributor keeps billing the MSP, often for months, until someone manually catches it.

How does CIPP help with Microsoft 365 license management?

CIPP helps with Microsoft 365 license management by providing centralized multi-tenant visibility, automated dormant account detection, configuration drift reporting and direct integration with distributor billing APIs. Billing and engineering teams can audit inactive users across dozens of tenants simultaneously and adjust seat counts from a single administrative interface. Sherweb’s exclusive CIPP integration extends this to include API-driven procurement and real-time PSA billing sync.

What is the best way to audit Microsoft 365 licenses across multiple tenants?

The best way to audit Microsoft 365 licenses across multiple tenants is to run a standardized four-stage framework (inventory, usage check, cost alignment and action/documentation) through an API-connected multi-tenant portal integrated with your PSA and cloud distributor. This replaces manual, tenant-by-tenant portal checks with cross-tenant data aggregation, enabling identification of unassigned seats, dormant users and billing sync gaps across all managed environments in a single pass.