Leavers who never left
This is the most common finding, and the most boring. Accounts are disabled but still licensed, or worse, still enabled. Without dynamic-group governance driven by directory attributes, deprovisioning depends on someone remembering, and in a high-turnover organisation nobody does.
This is a security finding as much as a cost one. A licensed, enabled account belonging to someone who left in March is an access problem before it is a billing one.
Premium SKUs bought for one feature
A department needed one capability, so the whole organisation moved to a higher tier. Frequently the same outcome was available through a policy change, an add-on for the twelve people who needed it, or a capability already included in the tier below.
The audit question is who uses the feature you upgraded for. The answer is usually a smaller number than the licence count.
Nonprofit pricing left unclaimed
For charities this one matters. Microsoft's nonprofit offers changed in 2025, and the pricing still needs someone to claim it and re-verify eligibility when Microsoft asks. When nobody owns that process, it lapses.
We treat this as onboarding work rather than a separate engagement.
How to run the check yourself
Export active licensed users, cross-reference against HR leavers for the last twelve months, and list every SKU above the base tier with its usage. Three queries and an afternoon will usually turn something up.
If you would rather we did it, that is what the free health check covers, along with the identity and governance findings that come out of the same data.