Overview
The Automation tab in Optimization removes licenses for you on a daily schedule, without raising tasks. Tenant Manager offers two automations for each tenant: Remove licenses from disabled accounts and Remove licenses from inactive accounts. You switch each one on, set a few safety limits, and choose who is told after each run.
An automation acts without asking, so it has several safety checks. It skips excluded users, licenses that come through a Microsoft Entra ID group, and mailbox licenses by default, and it stops when its data is out of date or a run would touch too many accounts.
Business value
Disabled and inactive accounts keep costing money until someone removes their licenses. An automation does this every day for you, records exactly what it did, and tells the right people. You keep control through the safety limits and the run history.
Prerequisites
Before you use the tab, connect the tenant and let it finish its first sync. See Connect a Microsoft 365 tenant. Before you switch an automation on, exclude every user who must keep a license. See Explore users.
Required permissions
You need the Approve license tasks permission to switch an automation on or off, to configure it, and to change who is notified. You need Read on Optimization to view the tab and the run history. The Owner and Contributor roles have these permissions. The Reader role can view the tab and the run history only. For details, see Roles and permissions in Tenant Manager.
Dependencies
- Permission to remove licenses: Turbo360 must be allowed to remove licenses in your tenant. When it is not, a banner on the tab says so, and you cannot switch an automation on. Ask your Microsoft Entra administrator to grant one of User.ReadWrite.All, LicenseAssignment.ReadWrite.All, or Directory.ReadWrite.All as an application permission, with admin consent. LicenseAssignment.ReadWrite.All covers the license changes only. You can always switch an automation off. Turbo360 notices a granted or removed permission within about 5 minutes, and syncing the tenant does not speed this up. The daily run follows the same rule.
- Background activity time zone: the daily run follows the time zone in the account's General settings.
- Notification channels and email templates: to tell people after a run, set up channels under Settings > Notification channels, and optional templates under Settings > Email templates.
How it works
Select the tenant in the tree view, expand License management, select Optimization, and then select the Automation tab. Automation is set up for a tenant, not for a tenant group.
The automations and the daily run
Each automation has its own rule for who it acts on.
| Automation | What it removes | Default setting |
|---|---|---|
| Remove licenses from disabled accounts | Every license, paid or free, that is assigned directly to a disabled account. Licenses that come through a Microsoft Entra ID group stay until the person leaves the group. | No days setting. It acts on the next daily run after you switch it on. |
| Remove licenses from inactive accounts | Every license, paid or free, that is assigned directly to an enabled account with no activity for the number of days you set. Accounts that were never active are included only when they are older than that number of days, so new accounts are not affected. | 30 days of no activity. |
An interactive sign-in or any use of email, Teams, SharePoint, or OneDrive counts as activity. A background sign-in counts as activity only when Microsoft's usage reports have nothing for that person.
The grid has one row for each automation.
| Column | What it shows |
|---|---|
| Disabled/Enabled | The switch that turns the automation on or off. |
| Automation | The name. Hover to see the description. |
| Last run | When the automation last ran, or a dash if it has not run. |
| Next run | When it runs next, a dash when it is off, or Tonight when it is on and the time is not set yet. |
| Actions | Configure automation and View run history. |
An enabled automation runs once a day, at midnight in the Background activity time zone. There is no approval step. The switch decides. There is no Run now and no way to undo a run.
Safety checks and mailbox licenses
Before and during a run, the automation protects your tenant. When a check stops a run, nothing is removed, and the run history says why.
| Situation | What happens |
|---|---|
| The tenant's data is out of date, because the last good sync is older than 24 hours | The run is skipped. The next daily run after a successful sync acts. |
| The tenant's sync is failing | The run is skipped. Any sync issue that was logged makes a tenant count as failing, so a tenant that is missing AuditLog.Read.All or RoleManagement.Read.Directory is skipped too. |
| The run would touch more accounts than the limit you set | The run is stopped and removes nothing. |
| Turbo360 is not allowed to remove licenses in the tenant | The run is skipped. |
| Turbo360 cannot check the tenant's permissions with Microsoft | The run is skipped. The next daily run checks again. A missing or expired client secret also shows up here. Edit the tenant to add or replace it. |
For each account, the automation first asks Microsoft 365 for the live state. It skips the account when it no longer exists, when it was enabled again after the last sync (disabled accounts automation), or when the person signed in after the last sync (inactive accounts automation). If Microsoft 365 cannot confirm the current state of an account, nothing is removed for that person, and the run history says so. For each license, it skips the license when the user is excluded, when the license comes through a Microsoft Entra ID group, when it includes a mailbox and you chose to keep those, and when it was already removed.
If a person holds a license both directly and through a Microsoft Entra ID group, the automation removes only the direct assignment. The Details column of the records notes that the person still has the license through the group.
Removing a license that includes an Exchange Online mailbox starts Microsoft's 30-day deletion of that mailbox, unless the mailbox is on hold. By default, the automation keeps those licenses and lists them as skipped.
Open tasks and notifications
When an automation removes the licenses that an open removal task asked for, it closes that task as Done and adds a comment that names the automation. It closes a task only when the task covers one person and every license the task names was removed in that run. A task that covers several people stays open.
After a run, Tenant Manager sends a summary only when something was removed, a removal failed, or the run was blocked. A run is blocked when its data is out of date, when it would touch more accounts than its limit, or when Turbo360 cannot remove licenses in the tenant. A run that met only excluded people, Microsoft Entra ID group licenses, or kept mailboxes sends nothing. The summary shows the tenant, the automation, the counts of removed, skipped, and failed licenses, and the first 10 accounts. It links back to Turbo360. If you turn on Download records from notifications, it also links to a spreadsheet of every account and license. That link works for 7 days and needs no sign-in to open. The run history always offers the file.
A run that removed nothing, failed nothing, and was not blocked appears only in the run history. It sends no summary and adds no entry to User activities. Every other run appears in Tenant Manager user activities under the Automation rules category, shown as made by the automation.
Steps
The steps below cover the tasks on the Automation tab. You start in Optimization for the tenant, with the Automation tab open.
Configure an automation
This procedure sets the inactivity days and the safety limits, and shows who the next run would act on.
- Select Configure automation on the row.
- For the inactive automation, enter the number of days in No activity for more than.
- Leave Keep licenses that include a mailbox ticked to keep mailbox licenses. Clear it to remove them.
- In Most accounts one run may act on, enter the largest number of accounts a run may change.
- Check Who this would act on. It shows how many licenses the next run would remove and from whom. It also lists the people who are left alone, with the reason.
- Select Save.
Saving an automation for the first time creates it switched off. Switch it on in the grid. A change to an automation that is on applies from the next daily run.
Choose who is told after a run
This procedure sets the people and channels that get the summary.
- Select Configure automation on the row.
- In Notification settings, enter email addresses in Recipient email address, separated by commas. This field is available on SaaS only. On private hosting, skip to step 5 and choose a notification channel.
- Choose an Email template, and enter an Email subject if you want to change them. When the subject is empty, the automation's name is used. These fields are available on SaaS only.
- Tick Download records from notifications to add a download button to every summary.
- Tick the channels you want to use.
- Select Save.
On SaaS, Email template and Email subject stay disabled until you enter at least one recipient email address, so enter the recipients first.
If you set no recipient and no channel, you can save, but you cannot switch the automation on. A warning icon on Notification settings flags it. On private hosting, summaries go to notification channels only.
Switch an automation on
This procedure starts the daily run for the tenant.
- Exclude the users who must keep a license.
- Configure the automation and choose at least one notification channel or recipient email address.
- Turn on the switch on the row.
- Read the confirmation. It says what the automation will remove from the next daily run.
- Select Continue.
The switch stays disabled until the automation is configured and saved with at least one notification channel or, on SaaS, a recipient email address. Hover over the switch to see why it is disabled. After you configure the automation, it uses the settings you saved: 30 days of no activity for the inactive automation, Keep licenses that include a mailbox on unless you cleared it, and 100 as the default for the most accounts one run may act on.
Switch an automation off
This procedure stops the daily run. You can do it at any time.
- Turn off the switch on the row.
- Select Continue in the confirmation.
View the run history
This procedure shows each daily run and lets you download its records.
- Select View run history on the row.
- Read the Status and the counts for each run. Hover over a status to see its issues.
- Select the download icon in Download records to save the run's spreadsheet.
The history shows the latest 200 runs, newest first, 25 per page. Anyone with Read on Optimization can open it.
| Status | What it means |
|---|---|
| Running | The run is in progress. |
| Completed | The run finished without failures. |
| Nothing to remove | The run finished and matched no accounts. |
| Partly failed | Some licenses were removed and some failed. |
| Failed | No license was removed and some failed. |
| Skipped | A safety check skipped the run, for example out-of-date data, no permission to remove licenses, or a permission check that could not be completed. |
| Stopped | The run would have touched more accounts than the limit. |
The spreadsheet has the columns User, Email, License, Outcome, and Details, with one row for each license. The outcome is Removed, Skipped, or Failed. Failures come first.
Configuration
The Configure dialog has these options.
| Option | Default | Description |
|---|---|---|
| No activity for more than | 30 days | Inactive automation only. The days without activity before an account is included. |
| Keep licenses that include a mailbox | On | Keeps mailbox licenses, and lists them as skipped. |
| Most accounts one run may act on | 100 | A run that would change more accounts than this removes nothing and says so in its history. |
| Recipient email address | Empty. A new automation takes the account's notification defaults, if any are set. | Who gets the summary. SaaS only. |
| Email template | System template | The layout of the summary email. SaaS only. |
| Email subject | Empty | The subject of the email. When empty, the automation's name is used. SaaS only. |
| Download records from notifications | Off | Adds a Download records button to every summary. |
| Channels | None | The notification channels that get the summary. |
Permission behavior
What you can do on the tab depends on your role and on the tenant.
- Without Approve license tasks, the switch and Configure automation are disabled. Hover over one to see "You are not authorized to perform this operation". View run history stays available.
- When Turbo360 is not allowed to remove licenses in the tenant, you cannot switch an automation on or configure it. You can still switch it off.
- An automation never removes anything from an excluded user.
Example scenario
To stop paying for licenses on accounts nobody uses, Jonas Weber, a module owner at Relecloud, excludes the shared service accounts in Explore, and then opens the Automation tab for Relecloud Munich. For Remove licenses from inactive accounts, he sets 60 days and leaves the mailbox option on.
Who this would act on shows that the next run would remove licenses from 9 people, which is under the limit of 100. He adds the IT mailbox to Recipient email address, saves, and turns the switch on. The next morning the run history shows Completed, and he downloads the records.
Limitations
- Only the two built-in automations are available. You cannot create others.
- Automation is set up for a tenant, not for a tenant group.
- There is no Run now and no undo. A removed license can be added back only by a new request.
- The run history shows the latest 200 runs, 25 per page.
- Licenses that come through a Microsoft Entra ID group are never removed. Remove the person from the group instead.
Troubleshooting
-
A banner says that automation cannot remove licenses in this tenant.
Cause: Turbo360 does not have permission to remove licenses there.
Fix: ask your Microsoft Entra administrator to grant one of User.ReadWrite.All, LicenseAssignment.ReadWrite.All, or Directory.ReadWrite.All as an application permission with admin consent. Turbo360 notices a granted or removed permission within about 5 minutes, so the banner can stay for a short time after consent is granted, and a removed permission can take a short time to show. Syncing the tenant does not speed this up. -
The run history shows Skipped for out-of-date data.
Cause: the last good sync is older than 24 hours, or the sync is failing.
Fix: fix the sync. See Syncing a Microsoft 365 tenant. The next daily run after a good sync acts. -
The run history shows Stopped.
Cause: the run would have changed more accounts than the limit.
Fix: download the records, check the accounts, and raise Most accounts one run may act on if they are expected. -
A person appears under Left alone and keeps their license.
Cause: the person is excluded, their licenses come through a Microsoft Entra ID group, or their license includes a mailbox.
Fix: none is needed. Remove them from the group, or clear the mailbox option, if you want the license removed. -
No summary email arrived.
Cause: the run removed nothing, or no recipient or channel is set. On private hosting, summaries go to notification channels only.
Fix: check Notification settings. A summary is sent only when something was removed, a removal failed, or the run was blocked. For what counts as blocked, see Notification emails.
FAQs
-
Does an automation need approval?
No. The switch decides. Once it is on, it runs every day without asking. -
How do I protect a person from an automation?
Exclude the user in Explore. An automation skips every license of an excluded user. -
What happens to a person's mailbox?
By default, the automation keeps licenses that include a mailbox. If you clear that option, removing the license starts Microsoft's 30-day deletion of the mailbox, unless it is on hold.