The trouble with Microsoft 365 licensing

The move from device-licensed Office to per-user Microsoft 365 subscriptions is, for most organisations, already done. It brought real benefits and a set of consequences that are still being discovered years later, usually at renewal.

This post covers what the licensing model actually is, why organisations found the old model hard to keep current, what to negotiate before committing, and — the part that has changed most since it was written — what you have to measure once you are on it.

Licensing terms move. Everything below reflects Microsoft’s published position as we understand it, and none of it is a substitute for reading the Product Terms that apply to your agreement.

What the model is

Microsoft 365 is a subscription service under the online services licensing model, licensed per user. Each User Subscription Licence must be assigned to a single named user before that person uses the software.

That is the fundamental break with what came before. Perpetual Office — the Office LTSC line — is licensed per device: the licence attaches to the machine, and anyone using that machine is covered. A subscription attaches to the person, and follows them across whatever they work on.

The practical entitlement is generous. A licensed user can install the Office applications on up to five PCs or Macs, five tablets and five phones, and can also use the browser versions without installing anything. Company-managed devices and personal devices both count. For an organisation whose staff work across a laptop, a home machine, a tablet and a phone, that single change removes an entire class of compliance question that the device model produced constantly.

The plans divide roughly as follows. Microsoft 365 Apps for enterprise — the product formerly called Microsoft 365 ProPlus — gives you the desktop applications and the installation rights, and no cloud services. The Microsoft 365 Enterprise plans, E1, E3 and E5, add the services: mail, storage, collaboration, and at E5 the security, compliance and analytics layers. The most common source of confusion at renewal is still that Apps for enterprise does not host your email.

Why the old model was hard to keep current

One of the main attractions of an Enterprise Agreement was New Version Rights — the ability to move to the latest version of a product during the agreement term. In practice a great many organisations never exercised that right for Office, and stayed several versions behind while paying for the option. The reasons were consistent, and they are worth restating because they are exactly the reasons a subscription model is now uncomfortable for some of the same organisations:

Compatibility. Line-of-business applications integrate with Office. A new Office version may break that integration, requiring development work or a vendor upgrade you do not control.

Training. Users have to be comfortable with the product. Changes to the interface or to functionality mean training, or at minimum guided material, for everyone.

Logistics. Upgrading ten copies of Office is trivial. Upgrading forty thousand or a hundred thousand machines is a programme with a name and a budget.

Functionality. Does the new version do enough more to justify the disruption? Often the honest answer was no.

Cost. In outsourced environments especially, the cost of delivering the upgrade — testing backwards compatibility, validating integrations, running the rollout — could match or exceed the cost of the software itself.

No downgrade rights

This is the point that catches people, and it deserves its own heading.

Microsoft’s position on subscription Office is that downgrade rights do not apply. With perpetual licences you could buy the current version and deploy an older one you had already tested. With a subscription you cannot. You get the current release, and it updates on Microsoft’s cadence rather than yours.

You do have some control over the cadence, but it is a choice between update channels rather than a choice to stop. Current Channel delivers features as they ship. Monthly Enterprise Channel batches them once a month on a predictable date. Semi-Annual Enterprise Channel is the slowest supported option, aimed at the environments that need a long validation window. Choosing a channel is a real decision with real testing consequences, and it is worth making deliberately at the start rather than inheriting the default.

Every one of the five reasons organisations avoided upgrading still exists. The subscription model does not remove them. It removes your ability to defer them.

What to negotiate before you commit

If you are moving to Microsoft 365, or renegotiating, three things are worth putting into the agreement rather than assuming:

• A transition period. Twelve to twenty-four months to move from per-device Office to per-user subscriptions, so the two models can coexist while the migration runs without you paying twice for the same users.
• A route back. An addendum allowing reversion to device-based Office licensing if forced upgrades cause problems you cannot resolve. You may never use it. Negotiating it costs nothing at signature and is impossible to obtain later.
• An extended validation window. Time between releases before you are expected to be current, because for a large organisation the planning and testing genuinely take months.

What you have to measure afterwards

Here is where this post has aged, and where the answer has changed completely.

Per-device Office licensing produced a compliance problem: are we licensed for everything that is installed? Per-user subscription licensing produces a financial one: are we paying for people who are not using this? The compliance question largely answered itself the day you moved to subscriptions. The financial question is now permanent, it compounds monthly, and no amount of contract negotiation touches it.

There are three specific ways subscription spend leaks:

Seats that are assigned and idle. Someone is licensed for E5 and has not opened anything beyond mail in six months. This is invisible in a licence count, because the licence count says the seat is assigned. It is only visible in usage.

Users on the wrong tier. E5 assigned where E3 would do, or E3 where E1 would do. The difference per user is not large. Multiplied by several thousand people and thirty-six months, it is the largest single line in most Microsoft renewals.

Leavers. The Microsoft 365 licence usually does get removed on the last day, because it is the one everybody remembers. The other twenty applications that person had do not, and neither do the OAuth grants they consented to, some of which still hold read access to company data.

CerteroX SaaS Management is where those are handled. It syncs from Entra ID and Okta and pulls authoritative user and licence lists directly from Microsoft 365, so the entitlement picture comes from the vendor rather than a spreadsheet. Unused licences are flagged at thirty or more days of zero usage. Cost per licensed user is reported alongside cost per active user, which is the number that shows you what you are really paying per person who turns up. Upcoming renewals appear with days-to-renewal and the utilisation rate attached, so the conversation with your reseller starts from evidence.

Acting on it is part of the same product: reclaim, reassign, downgrade tier, archive, remind or dismiss, individually or through a workflow engine with eight triggers, eleven conditions and thirteen actions. Offboarding produces a per-user checklist showing every licence held and whether revocation is pending, in progress or complete, with the estimated monthly cost of whatever is still open — and OAuth grants scored from 0 to 100 on sensitivity, scope, consent and dormancy, revocable in one click.

Forty-seven SaaS connectors ship today, across a catalogue of more than 35,000 applications, so Microsoft 365 is measured on the same basis as everything else in the portfolio rather than in its own console.

The on-premises side has not gone away, and CerteroX SAM still handles it: Microsoft Licence Statement import, device and user CALs, external connectors, and SQL Server and Windows Server core licensing with cluster and virtualisation awareness. Most organisations of any size are running both models at once for years. The point is that they should be visible in one place, computed against one data model, rather than argued about between two teams with two spreadsheets.

The short version

Subscription licensing traded a compliance risk for a financial one. That is usually a good trade — the compliance risk was lumpy, unpredictable and adversarial, and the financial one is smooth and manageable.

It is only manageable if you measure it. If nobody is watching utilisation per user per tier, the trade quietly stops being a good one somewhere around the second renewal.

To see Microsoft 365 utilisation per user per tier in a fully populated environment, book a demo.