# Use Entra reviews to clean up licenses before renewal A practical Microsoft Entra process for finding over-assigned or underused access, then using review results to guide renewals and workflow changes. Canonical page: https://mosheldon.com/blog/use-entra-reviews-to-clean-up-licenses-before-renewal/ Author: OpenTech Consulting Published: 2026-10-28T12:00:00Z Updated: 2026-10-28T12:00:00Z If your Microsoft Entra renewal is coming up, the safest way to avoid paying for access people no longer need is to review real usage first, then convert the findings into license and access decisions. Microsoft’s current documentation gives you two useful signals: license usage insights for tenant-level feature adoption, and access reviews for recertifying group, app, and role access before you renew or reassign anything [license usage insights](https://learn.microsoft.com/en-us/entra/fundamentals/concept-license-usage-insights), [access reviews](https://learn.microsoft.com/en-us/entra/id-governance/manage-user-access-with-access-reviews). That matters because renewals often get decided from spreadsheets, not evidence. In a small business or school, that can leave you with paid licenses assigned to the wrong people, groups that never get cleaned up, and access paths that survive long after a project ends. Microsoft also notes that license entitlements can change from month to month as agreements renew, lapse, or expand, so the number you plan against should be current, not last quarter’s estimate [license usage insights](https://learn.microsoft.com/en-us/entra/fundamentals/concept-license-usage-insights). ## Start with the right signals Begin by separating two questions: who still needs access, and which paid features are actually being used. Microsoft Entra license usage insights shows purchased license counts and feature usage across the tenant. For Microsoft Entra ID P1, the report uses Conditional Access users as the main usage metric; for P2, it uses Risk-based Conditional Access users. Microsoft says the data reflects the previous month and may take up to three days to update, so do not use it as a same-day dashboard for urgent decisions [license usage insights](https://learn.microsoft.com/en-us/entra/fundamentals/concept-license-usage-insights). Then use access reviews to confirm whether access should continue. Microsoft says access reviews can be used for group memberships, enterprise applications, and role assignments, and that reviewers can self-attest or be assigned a decision maker. When the review ends, you apply the changes and remove access that is no longer needed [access reviews](https://learn.microsoft.com/en-us/entra/id-governance/manage-user-access-with-access-reviews). A practical renewal check should answer four questions: 1. Are we actually using the paid Entra feature tied to this license tier? 2. Which users still need the access they currently have? 3. Which access assignments are tied to old projects, roles, or vendors? 4. Which changes should be made before renewal, and which should wait for a controlled change window? ## Build a repeatable review process Microsoft’s operations guidance recommends regular reviews of application access, external identities, privileged roles, and consent grants, and it explicitly calls for regular automated access reviews for external identities and application access [ID Governance operations reference guide](https://learn.microsoft.com/en-us/entra/architecture/ops-guide-govern). That gives you a workable review sequence: - First review the resource, not the person. Look at the group, app, or role. - Then assign an owner who can decide whether the access is still required. - Next decide whether the review should be self-service, manager-led, or owner-led. - Finally, apply changes and record the reason. For license cleanup, this works best when the access review is tied to a business event: annual renewal, semester start, contract expiration, or a system decommission. Microsoft’s access review guidance supports recurring reviews and reminders, and it notes that by default reviewers get an email link to the access panel [access reviews](https://learn.microsoft.com/en-us/entra/id-governance/manage-user-access-with-access-reviews). If you manage licenses through groups, Microsoft also documents a lifecycle pattern that combines group-based licensing with entitlement management, periodic access reviews, and expiration. That can help you keep license membership on a schedule instead of letting it drift [group-based licenses lifecycle](https://learn.microsoft.com/en-us/entra/id-governance/entitlement-management-group-licenses). For teams already using Entitlement Management, Microsoft says it requires Microsoft Entra ID P2 or Microsoft Entra ID Governance for member users [Microsoft Entra licensing](https://learn.microsoft.com/en-us/entra/fundamentals/licensing). ## Turn review results into renewal decisions The key is not to stop at “remove access.” Translate the review into a renewal decision log. Use three buckets: - Keep: access and licenses that are clearly used. - Remove: access that is no longer required. - Recheck: cases where the owner cannot decide yet or where a project is still in progress. For each bucket, define a follow-up action. “Keep” may mean renewing the license with confidence. “Remove” should trigger unassignment or group cleanup before renewal. “Recheck” should get a dated follow-up and an owner. This matters because Microsoft notes that access reviews are one of the supported ways to manage group memberships, app access, and role assignments, while license usage insights only shows adoption patterns and not whether a specific person still needs a license [license usage insights](https://learn.microsoft.com/en-us/entra/fundamentals/concept-license-usage-insights), [access reviews](https://learn.microsoft.com/en-us/entra/id-governance/manage-user-access-with-access-reviews). In other words, usage tells you where to look; reviews tell you what to change. Also watch license scope carefully. Microsoft’s licensing documentation says Microsoft Entra ID P1 and P2 are included in some Microsoft 365 and EMS bundles, and that access reviews require Microsoft Entra ID Governance for member users, with some capabilities also available through P2 [Microsoft Entra licensing](https://learn.microsoft.com/en-us/entra/fundamentals/licensing). Because bundles and add-ons vary, verify your exact edition before you remove or add anything. ## Verify before and after you change anything Do not trust the review outcome until you verify the effect. Before cleanup: - Export the current license assignment list. - Identify which licenses come from direct assignment and which come from group-based assignment. - Confirm which reviewers own each group or application. - Check whether the tenant has the required paid license level for the feature you plan to use [Microsoft Entra licensing](https://learn.microsoft.com/en-us/entra/fundamentals/licensing). After cleanup: - Recheck the license usage page after the next monthly data refresh. - Confirm removed users no longer have the related access. - Spot-check the group or app for any orphaned assignments. - Review any exceptions and decide whether they need a temporary extension or a permanent rule change. Microsoft says product usage data may lag by up to three days, so avoid same-day conclusions immediately after a change [license usage insights](https://learn.microsoft.com/en-us/entra/fundamentals/concept-license-usage-insights). That delay is a good reason to schedule renewal decisions a little ahead of the actual invoice date. For schools, this process is especially useful when students, staff, and guests have different access patterns. Microsoft’s license usage page distinguishes active users and guest users, which can help you separate internal demand from external collaboration. For small businesses, the same distinction can show whether contractor access is creeping into licenses intended for employees [license usage insights](https://learn.microsoft.com/en-us/entra/fundamentals/concept-license-usage-insights). ## Make the workflow part of renewal, not an extra task The best cleanup process is the one people can repeat. Tie the review to your renewal calendar, assign owners for each application or group, and make the result a standard part of procurement and account maintenance. Microsoft’s operations guidance explicitly recommends assigning owners to key governance tasks and regularly reviewing who has access to applications, external identities, and privileged roles [ID Governance operations reference guide](https://learn.microsoft.com/en-us/entra/architecture/ops-guide-govern). If your team is still doing this manually, start small: one app, one group, one renewal. Use the same review questions each time, verify the license tier before making changes, and keep a short record of what was removed and why. Over time, that gives you a defensible renewal process based on current access needs instead of guesswork. For a broader process view, see our related guidance on [how to build a simple software license review process](https://mosheldon.com/blog/software-license-review-process/), [trim unused software access before renewals](https://mosheldon.com/blog/trim-unused-software-access-before-renewals/), and [use Entra reviews to trim unused licenses before renewal](https://mosheldon.com/blog/use-entra-reviews-to-trim-unused-licenses-before-renewal/). ## Sources and references - [Microsoft Entra license usage insights](https://learn.microsoft.com/en-us/entra/fundamentals/concept-license-usage-insights): Explains the license usage insights page and what it shows about license count, value, and potential over-usage in a tenant. Good anchor source for a license-review workflow. - [Manage user access with Microsoft Entra access reviews](https://learn.microsoft.com/en-us/entra/id-governance/manage-user-access-with-access-reviews): General access-review guidance for groups, apps, and roles; useful for describing how to structure recurring access recertification before renewals. - [Microsoft Entra ID Governance operations reference guide](https://learn.microsoft.com/en-us/entra/architecture/ops-guide-govern): Supports the operational recommendation to run regular automated access reviews for external identities and application access, and notes that each user who interacts with access reviews needs a paid Microsoft Entra ID P2 license. - [Manage the lifecycle of group-based licenses in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/id-governance/entitlement-management-group-licenses): Shows how to combine access packages, expiration, and access reviews for recurring license-related workflows; useful for process design and delegation planning. - [Microsoft Entra licensing](https://learn.microsoft.com/en-us/entra/fundamentals/licensing): Provides the current licensing matrix and example license scenarios for access reviews and entitlement management, helping avoid guessing about entitlement requirements.