why do inactive accounts keep their M365 licenses after deprovision failed
Explains why inactive accounts keep Microsoft 365 licenses and fixes it by removing the group membership or direct assignment that group licensing re-applies. Use when deprovisioned users retain M365 licenses. Not for IdP account-state problems.
TL;DR
Group-based licensing re-adds the license as long as the account stays in the licensed group, or the deprovision never removed the direct assignment. Remove the group membership or the direct license; disabling the account alone is not enough.
why do inactive accounts keep their M365 licenses after deprovision failedUse this when
- Inactive or deprovisioned accounts still show M365 licenses.
- Removing the license manually works, but it comes back.
- Offboarding disables the account but licenses persist.
Not for this skill when
- The account is still active in the IdP. Fix the deprovision first.
- The license is needed for data retention. Use a deliberate retention license instead.
- No license is actually consumed. Verify in the admin center before acting.
Steps
- Check whether the license comes from a group or a direct assignment. Verify: you know the source.
- Remove the user from the licensing group, or remove the direct license. Verify: the source is gone.
- Confirm the license drops from the account. Verify: the admin center agrees.
- Fix the offboarding workflow to include this step. Verify: the workflow covers it.
- Verify on the next termination that the license releases. Verify: the fix holds.
Variant phrasings
M365 license not removed
The symptom-first phrasing.
group licensing re-adds
The cause-first search.
inactive keeps license
The state-first phrasing.
Compatibility: Microsoft 365 license management with Entra ID group-based licensing.
Why it happens
Group licensing is declarative: membership equals license, regardless of account state. Disabling the account does not remove the membership, so the license persists by design.
Edge cases / pitfalls
- Dynamic groups re-adding the user automatically; fix the rule, not just the membership.
- The 30-day soft-delete window holding the license on deleted accounts; account for the delay.
- Direct assignments surviving alongside group cleanup; check both sources.
- Retention needs: a shared mailbox or archived state may be the right answer, not just license removal.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_3ZzwGsUGmroOyAWydIfMhQ