Ghost accounts cost real money. Here’s how to find them, govern them, and reclaim the spend.
May 2026 | 6 min read
At a Glance
1. Microsoft 365 Lifecycle Management for users: What Ghost Accounts Actually Cost
When someone leaves your organisation, what happens to their Microsoft 365 account? In theory, IT disables it, reclaims the licence, and archives the data. In practice, accounts sit open for weeks. Licences stay assigned. Mailboxes keep consuming storage. Nobody notices until the next audit, or the next invoice.
This is the ghost account problem. It is one of the most common and most expensive failures in Microsoft 365 lifecycle management. And it does not only happen when people leave. Contractors whose projects have ended, seconded staff who never returned, test accounts that outlived their purpose. All of these accumulate when your user lifecycle management process runs on spreadsheets, calendar reminders, and optimism.
A proper Microsoft 365 lifecycle management framework tracks active users versus assigned licences, last login and activity dates across all workloads, account status, group and Teams membership with active ownership, mailbox and OneDrive data with identified business owners, and licence tier versus actual feature usage. Without visibility into all of these, you are governing a tenant you cannot fully see.
2. The Real Cost of Unused Microsoft 365 Licences Before July 2026
Ghost accounts are not just a nuisance. They are a budget drain and a security risk combined.
Inactive Microsoft 365 licences cost the same every month as active ones. Industry research puts average SaaS licence waste at 29% across enterprise organisations. Microsoft 365 typically sits at 20–30% in organisations without automated governance. In a 500-seat tenant, that can mean 100–150 licences assigned to users who have not logged in for months.
Microsoft 365 over-licensing compounds this. An E5 licence held by a user who only reads email and attends Teams calls is an E1 or E3 licence inflated by features sitting idle. Multiply that across the estate, and the waste becomes significant.
July 2026 sharpens the pain. Microsoft has confirmed global price increases of up to 33% on certain plans. Every unused Microsoft 365 licence you carry into the new pricing cycle costs more from that date forward. Right-sizing before renewal is not a nice-to-have.
“If you don’t know which accounts are inactive, you can’t reclaim the licences. You also can’t protect the access they still hold.”
3. Microsoft Native Tools: What They Can and Cannot Do for Lifecycle Management
Microsoft provides some tools to help. The Microsoft 365 admin centre shows last sign-in dates. Entra ID supports lifecycle workflows. Microsoft Lifecycle Workflows can automate joiner and leaver tasks for users managed directly in Entra.
But there are limits. Microsoft’s native reporting has retention gaps: historical activity data is not retained indefinitely, and point-in-time snapshots do not give you the continuous visibility needed to catch drift in real time. Licence-level usage analysis, which identifies users whose plan far exceeds their actual activity, requires additional lifecycle management software or significant manual effort.
The result: most IT teams run periodic, manual audits. They catch some waste and miss the rest. Between audits, the problem grows, and the gap between what is assigned and what is used widens quietly.
4. How TeamsFox Automates Microsoft 365 Lifecycle Management
TeamsFox gives IT teams continuous, tenant-wide visibility into user activity, licence assignment, and account status. The platform integrates with your Microsoft 365 licence management approach, not as a replacement for policy, but as the engine that makes it run without manual effort.
Key capabilities include inactive user detection surfacing users who have not logged in for 30, 60, or 90 days, configurable to your policy threshold; licence right-sizing identifying E3 or E5 holders whose actual usage fits a lighter plan; orphaned account alerts flagging accounts without an active line manager, group membership, or business owner; automated workflows triggering licence reclamation, account disablement, or data archival based on lifecycle events; and a full audit trail of what changed, when, and why, ready for compliance review.
TeamsFox customers achieve an average 30% reduction in Microsoft 365 licence costs and a 60% reduction in admin time spent managing these processes manually. Those are not projections: they are results from organisations that replaced calendar-reminder governance with persistent automation.
Security risk: Orphaned accounts in Microsoft 365
Microsoft 365 orphaned accounts, those without an active owner or manager, retain full access to SharePoint, Teams, and OneDrive until explicitly disabled or deleted. Former employees, ex-contractors, and test users represent a persistent attack surface. If credentials are compromised, IT has no automated alert. Regular lifecycle reviews, or continuous automated monitoring, are not optional for any organisation running a serious M365 governance framework.
5. Building a Microsoft 365 Lifecycle Management Process That Sticks
Tooling matters, but it needs a policy framework behind it. The following principles work in practice for organisations building a credible Microsoft 365 governance programme.
Define your inactive threshold. What does ‘inactive’ mean in your organisation? 30 days without login? 60 days? No email sent in 90 days? Define it explicitly and document it. Without a threshold, there is nothing to enforce.
Assign account owners. Every user account should have an identified business owner responsible for confirming whether it is still needed. HR integration helps: when a departure is logged, the lifecycle process should trigger automatically rather than waiting for IT to notice.
Disable before you delete. Disable first, archive after a defined retention period, then delete. This gives you a recovery window and protects against accidental offboarding.
Manage guest accounts separately. B2B guest accounts in Entra ID are often forgotten entirely. They accumulate in Teams and SharePoint sites long after the project they were invited for has ended. Ghost accounts from external partners are just as expensive and risky as internal ones. Guest lifecycle management deserves its own policy.
6. Why the July 2026 Price Increase Makes Microsoft 365 Lifecycle Management Urgent Now
Microsoft’s July 2026 pricing changes affect every Microsoft 365 customer. If you are carrying unused or oversized licences into the new pricing cycle, your M365 bill rises by more than just the percentage increase. It rises on a larger base than you actually need.
Organisations that audit and right-size before July 1 reduce the number of licences subject to the new prices. Those who wait pay more, for longer, on accounts that should have been cleaned up months ago.
The ghost account problem is solvable. The tools exist. The savings are real. The only thing standing between your current spending and a materially lower one is visibility.
Frequently Asked Questions
What are ghost accounts in Microsoft 365?
Ghost accounts are user accounts that remain active and licensed in Microsoft 365 after the person has left the organisation or no longer needs access. They represent unnecessary cost and a persistent security risk. Ghost account audits typically surface these during licence reviews.
How do I find inactive Microsoft 365 licences?
Microsoft’s admin centre provides basic last sign-in data, but retention is limited, and it does not give licence-level usage details. Tools like TeamsFox provide continuous visibility into inactive Microsoft 365 licences with configurable inactivity thresholds and automated alerts.
What are Microsoft 365 orphaned accounts?
Microsoft 365 orphaned accounts are accounts that have no active owner, manager, or business sponsor in the system. These accounts retain access to SharePoint, Teams, and OneDrive until explicitly disabled. They are common in organisations that rely on manual offboarding processes.
Is lifecycle management covered by Microsoft’s native tools?
Microsoft provides Entra ID lifecycle workflows and basic admin centre reporting. However, these tools do not offer continuous monitoring, automated licence reclamation, or the cross-workload visibility needed to catch drift between audits. Dedicated lifecycle management software fills the gap.
How much can I save by removing unused Microsoft 365 licences?
Industry benchmarks put unused SaaS licence waste at around 29% in unmanaged estates. TeamsFox customers achieve an average 30% licence cost reduction after implementing automated lifecycle management. The savings are higher for organisations entering the July 2026 pricing changes with an unaudited estate.
About TeamsFox
TeamsFox is the Microsoft 365 licence management and optimisation platform that gives IT teams tenant-wide visibility, evidence-based governance, and automated lifecycle controls. Continuous monitoring surfaces ghost accounts, inactive licences, and orphaned identities before they become security risks or budget waste. Headquartered in Düsseldorf and trusted in 20+ countries, TeamsFox helps organisations reduce licence spend by up to 30%, cut storage costs by 40%, and free up 60% of administrative time.