Press CTRL+K to open search

Automating license removal

  • 7 minute(s) read
Prev Next

Overview

This tutorial walks you through setting up the Remove licenses from disabled accounts automation for a tenant in Tenant Manager. By the end, the automation is switched on, tells the people you choose when a run removes licenses or goes wrong, and you know where to read what it did.

Business value

Disabled accounts keep costing money until someone removes their licenses. The automation removes them every day without raising tasks, records exactly what it did, and tells the right people. You keep control through the safety limits and the run history.

Prerequisites

Connect the tenant, let it finish its first sync, and exclude every user who must keep a license. See Connect a Microsoft 365 tenant and Explore users. Turbo360 must also be allowed to remove licenses in the tenant, which your Microsoft Entra administrator grants with one of User.ReadWrite.All, LicenseAssignment.ReadWrite.All, or Directory.ReadWrite.All as an application permission with admin consent. LicenseAssignment.ReadWrite.All covers the license changes only. Turbo360 notices a granted permission within about 5 minutes, so wait a short time after consent before you switch the automation on.

Required permissions

You need the Approve license tasks permission to switch an automation on or off, configure it, and change who is notified. You need Read on Optimization to view the Automation tab and the run history. The Owner and Contributor roles have these permissions. The Reader role can view the tab and the run history only. For details, see Roles and permissions in Tenant Manager.

How it works

The Remove licenses from disabled accounts automation removes every license, paid or free, that is assigned directly to a disabled account. It has no days setting, so it acts on the next daily run after you switch it on. Licenses that come through a Microsoft Entra ID group stay until the person leaves the group. The automation also skips excluded users. The Remove licenses from inactive accounts automation works the same way, with one extra setting for the days of no activity. The inactive automation also skips a person who signed in after the last sync.

An enabled automation runs once a day, at midnight in the Background activity time zone from your account's General settings. Before it removes a license, it checks the live state of each account. It skips an account that was enabled again after the last sync. By default, it also keeps licenses that include a mailbox.

Safety checks protect the tenant. When the last good sync is older than 24 hours, the sync is failing, or Turbo360 cannot remove licenses, the run is skipped. When a run would touch more accounts than the limit you set, it is stopped and removes nothing. The run history says why. Changes to an automation, and each run that removed licenses, failed, or was blocked, appear in the Automation rules category of Tenant Manager user activities.

Steps

You configure the automation, choose who is told, switch it on, and read its run history. Select the tenant in the tree view, and then select License management > Optimization > Automation. The grid has one row for each automation.

Configure the automation

This procedure sets the safety limits and shows who the next run would act on.

  1. Select Configure automation on the Remove licenses from disabled accounts row.
  2. Leave Keep licenses that include a mailbox ticked to keep mailbox licenses. Clear it to remove them.
  3. In Most accounts one run may act on, enter the largest number of accounts a run may change. The default is 100.
  4. Check Who this would act on. It shows how many licenses the next run would remove and from whom, and it lists the people who are left alone, with the reason.
  5. Select Save.

Saving an automation for the first time creates it switched off. A change to an automation that is on applies from the next daily run.

Choose who is told

This procedure sets the people and channels that get a summary when a run removes licenses, fails, or is blocked.

  1. Select Configure automation on the row.
  2. In Notification settings, enter email addresses in Recipient email address, separated by commas. This field is shown on SaaS only. On private hosting, choose a notification channel instead.
  3. On SaaS, choose an Email template, and enter an Email subject if you want to change them. When the subject is empty, the automation's name is used.
  4. Tick Download records from notifications to add a download button to every summary.
  5. Tick the channels you want to use. To set up channels and templates, see Managing notification channels and Email templates.
  6. Select Save.

On SaaS, Email template and Email subject stay disabled until you enter at least one recipient email address, so enter the recipients first.

You can save an automation without a recipient or a channel, but nobody is told about its runs, and the switch stays disabled until it has one. For what a summary contains, see Notification emails.

Switch the automation on

This procedure starts the daily run for the tenant. The switch stays disabled until the automation has at least one notification channel or, on SaaS, a recipient email address. Set one in Configure automation first.

Warning:

This automation has no approval step and no Run now. Once the switch is on, it removes licenses on every daily run, and you cannot undo a run from Tenant Manager. Exclude the users who must keep a license before you continue.

  1. Turn on the switch on the row.
  2. Read the confirmation. It says what the automation will remove from the next daily run.
  3. Select Continue.

The switch turns on, and Next run shows when the automation runs next, or Tonight when the time is not set yet. To stop the daily run at any time, turn the switch off and select Continue in the confirmation.

Read the run history

This procedure shows each daily run and lets you download its records.

  1. After the first run, select View run history on the row.
  2. Read the Status and the counts for each run. Hover over a status to see its issues.
  3. Select the download icon in Download records to save the spreadsheet of the run.

The history shows the latest 200 runs, newest first, 25 per page. Anyone with Read on Optimization can open it. The statuses are as follows.

Status What it means
Running The run is in progress.
Completed The run finished without failures.
Nothing to remove The run finished and matched no accounts.
Partly failed Some licenses were removed and some failed.
Failed No license was removed and some failed.
Skipped A safety check skipped the run, for example out-of-date data, no permission to remove licenses, or no client secret.
Stopped The run would have touched more accounts than the limit.

The spreadsheet has the columns User, Email, License, Outcome, and Details, with one row for each license. The outcome is Removed, Skipped, or Failed, and failures come first.

Troubleshooting

These are the problems you are most likely to meet when you set up the automation.

  1. A banner says that automation cannot remove licenses in this tenant, and the switch will not turn on.
    Cause: Turbo360 does not have permission to remove licenses there.
    Fix: ask your Microsoft Entra administrator to grant one of User.ReadWrite.All, LicenseAssignment.ReadWrite.All, or Directory.ReadWrite.All as an application permission with admin consent. Turbo360 notices a granted or removed permission within about 5 minutes, so the banner can stay for a short time after consent is granted, and a removed permission can take a short time to show. Syncing the tenant does not speed this up.

  2. The switch and Configure automation are disabled.
    Cause: your role does not have the Approve license tasks permission.
    Fix: ask an administrator who can manage Tenant Manager access, such as a module owner, to grant it. View run history stays available.

  3. The run history shows Skipped.
    Cause: the last good sync is older than 24 hours, the sync is failing, or no client secret is stored for the tenant.
    Fix: fix the sync, or edit the tenant to add a client secret. See Syncing a Microsoft 365 tenant. The next daily run after a good sync acts.

  4. The run history shows Stopped.
    Cause: the run would have changed more accounts than the limit.
    Fix: download the records and check the accounts. If they are expected, raise Most accounts one run may act on in Configure automation.

  5. No summary email arrived.
    Cause: the run removed nothing, or no recipient or channel is set.
    Fix: check Notification settings. On private hosting, recipient addresses are not available, so set a notification channel. A summary is sent only when licenses were removed, a removal failed, or the run was blocked. For what counts as blocked, see Notification emails.

Related articles