Microsoft E5 Shelfware: Right-Sizing Guide

Microsoft 365 E5 is an expensive, feature-rich license tier ($60/user/month). It includes advanced security (Defender, Sentinel, Purview), analytics, voice (Teams Phone), and compliance capabilities. However, most organisations assign E5 licenses broadly and achieve only 40-50% feature utilisation.

Shelfware — licences purchased but not actively used — is endemic in E5 deployments. The problem accelerates at renewal time when organisations either (A) renew at the same user count without re-evaluating who actually needs E5, or (B) downgrade users to E3/E1 but fail to account for the cost impact of lost features.

Research by software licensing analysts shows consistent patterns across enterprise organisations:

• 23% of E5 licenses are inactive — Never used, or used <1 day per month.
• 27% of E5 licenses are unassigned — Purchased but not allocated to any user.
• 30% of licensed E5 features are unused — Paid for but never accessed.

Financial Impact Example

For a 5,000-user organisation with 3,000 E5 licenses:

• E5 licensing cost: 3,000 × $60 × 12 = $2.16M/year.
• Shelfware (50%): 1,500 licenses × $60 × 12 = $1.08M/year in waste.

A single mid-market organisation is wasting $1M+ annually on E5 licenses that deliver zero business value.

Cause 1: Over-Provisioning

HR and IT assign E5 to all "office workers" by default, assuming all knowledge workers need the full E5 suite. In reality, most users need only email, Teams, and basic Office (E1/E3 territory). Over 50% of E5 licenses are assigned to users who never access Sentinel, Defender, or Purview.

Cause 2: Feature-to-Role Misalignment

E5 features require specific roles to justify cost:

• Sentinel (SIEM): IT/security staff only (5-10% of population).
• Insider Risk Management: Compliance, legal, HR staff (3-5%).
• Teams Phone: Users needing VoIP capability (20-30%).
• Advanced Threat Protection: IT/security staff (5-10%).

Giving E5 to a Marketing Manager for access to Email alone wastes $720/year ($60/month).

Cause 3: Change-Over Inertia

Once a user is assigned E5, they rarely get downgraded. Even if their role changes (e.g., promotion out of security team, departure from compliance function), E5 licenses persist. Downgrade processes are infrequent (annual or never), leaving stale assignments.

Cause 4: Lack of Visibility

Most organisations lack tooling to track which E5 features are actually used by which users. Office 365 Admin Centre shows licence assignment but not feature usage. Without visibility, right-sizing decisions are guesses.

Cause 5: "Just in Case" Purchasing

IT teams purchase extra E5 licenses "in case we need them for new hires" rather than purchasing on-demand. These buffer licenses often go unused for 6-12 months, then get rolled into the standard licensing pool.

Feature: Sentinel (Cloud SIEM)

Included with E5. Designed for SOC teams to ingest and analyse security logs. Requires skilled operators and active tuning.

Utilisation: 10-15% of E5 organisations actively use Sentinel. Most have not configured it beyond basic M365 logging.

Cost if purchased standalone: $4,000-$20,000/month depending on data volume. Often not worth standalone investment, but "free" with E5 creates illusion of value.

Feature: Insider Risk Management

Detects risky user behaviour (data exfiltration, suspicious logins, policy violations) using behavioural analytics.

Utilisation: 5-8%. Requires HR, legal, and privacy sign-off. Many organisations skip due to compliance complexity.

Feature: Advanced Threat Protection (Defender for Office 365)

Email security and anti-malware scanning beyond basic protection.

Utilisation: 25-30%. Many organisations use but never tune rules or investigate detections.

Feature: Teams Phone (PSTN Calling)

VoIP phone functionality within Teams.

Utilisation: 30-40% of licensed users. Effective but often undervalued. Many organisations purchase but users still rely on desk phones.

Feature: Purview Compliance

Data governance, DLP, records management, eDiscovery.

Utilisation: 40-50%. Highly specialised. Most organisations struggle to operationalise beyond basic DLP.

Step 1: Export user inventory from Azure AD with licence assignment and last-login date.

Step 2: Segment users by actual role and feature needs.

Step 3: Cross-check E5 licence assignment against role requirements.

Step 4: Identify inactive users (last login >90 days) assigned to E5.

Step 5: Interview department heads to understand which E5 features are actually used.

Expected findings: 30-50% of E5 licenses are misaligned with actual role needs.

Right-sizing means matching licence tier to actual job role and feature needs. Standard segmentation:

• E5 (Premium): IT, Security, Finance, Legal, Compliance roles requiring advanced features. Target: 10-15% of population.
• E3 (Standard): Knowledge workers and managers needing core productivity. Target: 50-60% of population.
• E1 + Teams (Value): Light users, field workers, temporary staff. Target: 25-35% of population.

Right-Sizing Example

5,000-user organisation currently: 3,000 E5, 1,500 E3, 500 E1.

Right-sized model: 500 E5 (IT/Security/Compliance), 3,000 E3 (Knowledge workers), 1,500 E1 (Light users).

• Current cost: 3,000 × $60 + 1,500 × $40 + 500 × $15 = $240K/month.
• Right-sized cost: 500 × $60 + 3,000 × $40 + 1,500 × $15 = $115K/month.
• Annual savings: ($240K – $115K) × 12 = $1.5M.

Annual savings from right-sizing typically range from $1M-$4M depending on organisation size and current E5 penetration:

• Small (1,000 users): $200K-$500K savings.
• Mid-market (5,000 users): $1M-$2M savings.
• Enterprise (10,000+ users): $2M-$4M+ savings.

Implementation is straightforward and can be done without user impact (no need to uninstall software, just remove license assignment).

A SaaS company had 2,000 E5 licenses assigned broadly across product, engineering, and operations teams. They conducted a shelfware audit and discovered 800 E5 licenses (40%) were assigned to users who never accessed Sentinel, Defender, or Purview.

Right-sizing results:

• Reduced E5 to 400 licenses (IT/Security only).
• Upgraded 1,400 E1 users to E3 for better Teams/Office access.
• Annual savings: 1,600 × $60 × 12 = $1.152M.

Implementation took 6 weeks and required zero user retraining (E5→E3 downgrade is transparent).

Redress Compliance has conducted 120+ shelfware audits for enterprise Microsoft customers, identifying and eliminating $80M+ in aggregate waste. We specialise in license optimisation without compromising security or compliance.

Author: Fredrik Filipsson | Cost Optimisation Advisor

Microsoft Licensing Knowledge Hub · All White Papers · Enterprise Spend Navigator Newsletter