Microsoft 365 and Azure spend rarely balloons in one dramatic moment. It creeps. A few licences bought for a project that ended, a virtual machine sized for a launch that has long since settled, a storage account nobody prunes, a disk left behind when its server was deleted. Each is small. Together they become a monthly bill that is larger than the work it supports. The encouraging part is that most of this waste is visible and reversible once you know where to look.
This is a practical walk through nine of the most common waste patterns across a Microsoft estate. Each step covers what to check, how to check it in the portal or with a quick command, and what good looks like once it is fixed. The savings are directional by nature, because they depend entirely on your estate, but the patterns are consistent enough that almost every organisation finds something on this list.
1. Reclaim unassigned and underused licences
Check: Compare purchased licences against assigned licences, then compare assigned licences against actual usage. In the Microsoft 365 admin centre, Billing then Licenses shows purchased versus assigned counts, while the usage reports show last activity dates per service.
How: Microsoft Graph PowerShell surfaces the totals quickly. Get-MgSubscribedSku returns prepaidUnits against consumedUnits for every SKU, so a large gap is money spent on seats nobody holds. Cross-reference the usage reports to find assigned seats that have been dormant for weeks.
Good looks like: No paid seats sitting unassigned, no assigned seats going unused for a set period, and a monthly reclaim loop so the gap does not reopen.
2. Offboard leavers properly
Check: Look for accounts that still hold paid licences after the person has left. A leaver whose licence is never removed keeps billing indefinitely, and the mailbox and data often stay live with them.
How: Review Microsoft Entra ID for recently departed users and any accounts with no sign-in activity. A clean joiner, mover, and leaver process removes the licence, blocks sign-in, and converts the mailbox to a shared mailbox where the content still needs to be reachable, which does not require a paid licence.
Good looks like: Licences freed within days of a departure, not months, and offboarding treated as a repeatable process rather than an occasional cleanup.
3. Right-size oversized Azure virtual machines
Check: Compare each virtual machine's provisioned size against the CPU and memory it actually uses. Machines sized for a peak that never returned are one of the largest recurring Azure costs.
How: Azure Advisor produces right-sizing and shutdown recommendations directly, and Azure Monitor metrics show sustained utilisation over time. Where a machine runs consistently under load, move it down to a smaller SKU and keep sensible headroom.
Good looks like: Virtual machines sized to observed utilisation, with resizing revisited on a schedule rather than set once at deployment.
4. Remove idle resources
Check: Find resources that are provisioned and billing but doing no work: virtual machines with no meaningful traffic, test environments left running, load balancers with no backend, databases nobody queries.
How: Azure Advisor flags idle and low-usage resources, and the cost analysis view in Cost Management highlights spend that never changes regardless of activity. Deallocate what is genuinely idle, and delete what is no longer needed after confirming ownership.
Good looks like: No paid resource with sustained zero usage, and a clear owner for anything kept running deliberately.
5. Bring storage growth under management
Check: Storage tends to grow quietly. Old snapshots, ageing blobs, verbose log retention, and backup copies accumulate until the storage line is a meaningful share of the bill.
How: Apply lifecycle management policies on storage accounts to tier cool and archive data automatically or delete it after a set age. Review snapshot counts, and check Log Analytics and backup retention settings, which are frequently left far longer than anyone needs.
Good looks like: Lifecycle policies in place, retention set as a deliberate decision, and snapshot sprawl kept in check.
6. Retire duplicate third-party tooling
Check: Look for paid third-party tools that overlap with capabilities you already own inside your Microsoft plans. Separate multifactor authentication, device management, backup, or security tools frequently duplicate something already included in a licence you are paying for.
How: List your active SaaS subscriptions against the capabilities in your current Microsoft 365 plan mix. Where a Microsoft capability already meets the need, plan a migration and cancel the overlapping tool.
Good looks like: A rationalised toolset with no paid overlap against capabilities you already hold.
7. Fix the plan mix
Check: Confirm the licence plan matches each user's genuine need. Estates drift toward a single high plan for everyone, or keep a legacy mix that no longer fits. Not every user needs the top tier, and smaller organisations often fit better plans than they are on.
How: Segment users by what they actually use, then map them to the right plan. Microsoft 365 Business Premium is often the better fit below 300 seats, while E3 and E5 suit larger or more security-heavy estates, and the right split usually sits between extremes rather than one plan for all.
Good looks like: A plan mix matched to real need per cohort, reviewed as the organisation changes rather than assumed.
8. Clear unattached disks and idle IP addresses
Check: When a virtual machine is deleted, its managed disks and public IP addresses are not always removed with it. Orphaned disks keep billing for storage, and a reserved standard public IP bills even when nothing is attached to it.
How: In the Azure portal, filter disks by an unattached state and public IP addresses by an unassociated state. A quick command such as Get-AzDisk | Where-Object { $_.DiskState -eq 'Unattached' } lists the orphaned disks so you can confirm and remove them.
Good looks like: No orphaned managed disks and no idle reserved IP addresses left billing after their resource is gone.
9. Stop dev and test running around the clock
Check: Non-production environments often run 24 hours a day, seven days a week, when they are only used during working hours. Compute you pay for overnight and at weekends is pure waste in most development and test estates.
How: Apply auto-shutdown schedules to virtual machines, use start and stop automation, and lean on the auto-shutdown feature in Azure DevTest Labs. Match the schedule to the hours the environment is genuinely used.
Good looks like: Development and test compute stopped outside working hours by default, with an easy path to start it when needed.
Measure before and after
None of this sticks without a baseline. Before you change anything, record current monthly spend by service, licence purchased and assigned counts, and the resources you plan to touch. Tag resources by owner and environment so cost is attributable rather than anonymous. Then re-check the same figures after each pass. The point is not a single cleanup but a trend that stays flat or falls while the estate keeps working. A monthly review turns cost control into a habit instead of an annual panic, and it gives you the before-and-after evidence that a change actually saved money.
Where EtherInsights fits
Working this list by hand across a growing estate, or across many tenants for a managed-service provider, is where it becomes a job in itself. EtherInsights is built to find this waste and prove the saving: it surfaces unassigned and underused licences, idle and oversized Azure resources, and the orphaned disks and IPs that hide in the bill, then tracks the before-and-after so a change is backed by evidence rather than a hunch.
For the Azure compute side, Azure VM right-sizing turns utilisation data into owner-backed resizing actions with the evidence to support them. On the licensing side, Microsoft 365 licence management and offboarding closes the loop across the licence lifecycle, so leavers are offboarded, dormant seats are reclaimed, and the plan mix stays matched to need.
Cost creep is normal; leaving it unchecked is a choice. Work the nine steps, measure each pass, and the estate that grows keeps paying only for the work it actually does.
Explore cloud cost optimisation to see how finding waste and proving the saving come together across Microsoft 365 and Azure.