Microsoft 365 Cleanup: Fix Your Licences and Security Settings Before You Buy Anything Else

For most 30–80 seat businesses, a cleanup is the highest-value few hours in their whole Microsoft 365 tenant — and yes, it can be done for you. A cleanup means two things: stop paying for licences that belong to people who left, or for a plan tier whose security tools were never switched on — and finish the security settings that were left half-configured the day the tenant was set up. Neither half requires buying anything new.

In 30 seconds

• Every licence still assigned to someone who has left is a monthly charge — and a live sign-in an attacker can use. A cleanup starts by setting the licence list against the staff list.
• If you are on Microsoft 365 Business Premium, a real security stack is already in the licence — but it only protects you if someone switched it on. On Business Standard, those tools are not in the plan at any setting.
• Know which of three states your tenant is in: security defaults on, defaults off with nothing replacing them, or defaults properly replaced by Conditional Access. "I think MFA is on" is a guess, not a setting.

Three signs your tenant is due

Is your tenant due? Tick any that sound familiar

• ☐ The licence report and the staff list don't match. People leave, roles change, and a "temporary" account from a project two years ago is still active and licenced. Every one of those accounts is a monthly charge — and a live sign-in an attacker can use.
• ☐ Nobody can say which security defaults are actually on. Microsoft turns on a baseline called security defaults for new tenants, but tenants get moved off it or left in whatever state a rushed setup produced. "I think MFA is on" is the most common answer we hear, and it is a guess, not a setting.
• ☐ You are paying for security twice — or not at all. This is the subtle one. If you are on Microsoft 365 Business Premium, a real security stack is already in the licence. If you are on Business Standard, some of those tools are not in your plan at any setting.

One tick is enough — a cleanup starts by finding out which of those situations you are in.

First half: the licences

Licences attached to people who are gone

Pull the list of licenced accounts and sort it against who actually works here. Departed employees, duplicate accounts from a name change, and test accounts from old projects are the usual finds. Removing a licence from an account that should not exist is both a saving and a security fix — the two are the same list.

The wrong tier, in both directions

Microsoft describes Business Premium as including all the same apps and services as Business Standard "plus advanced cyberthreat protection and device management capabilities." Microsoft's own Business Premium page lists five security services built into the subscription, not sold as add-ons: Microsoft Defender for Business, Microsoft Defender for Office 365 Plan 1, Microsoft Entra ID Plan 1, Microsoft Intune Plan 1, and Microsoft Purview. Business Standard includes none of those five — its identity tier is the free version of Entra ID, per Microsoft's plan comparison.

Microsoft describes Business Premium as including all the same apps and services as Business Standard "plus advanced cyberthreat protection and device management capabilities." Two boundaries from the same comparison: Microsoft lists Defender for Business standalone at CAD $4.10 per user per month, and notes it is "Included in Microsoft 365 Business Premium"; and Microsoft's business plans are designed for organizations with up to 300 users, with a tenant limit of 300 provisioned licences across the business plan family. Conditional Access — the proper replacement for security defaults — requires at least Entra ID P1, which is the identity tier in the Premium column, not the free tier in the Standard column.

So the tier question cuts both ways. A business on Premium that never turned on Defender for Business or Intune is paying for protection it does not have. A business on Standard that separately bought a standalone endpoint tool may be paying twice — or may be missing Conditional Access entirely, because that requires Entra ID P1. (Microsoft lists Defender for Business standalone at CAD $4.10 per user per month on that page, and notes it is "Included in Microsoft 365 Business Premium.")

One boundary worth knowing: Microsoft's business plans are designed for organizations with up to 300 users, with a tenant limit of 300 provisioned licences across the business plan family. At 30–80 seats you are comfortably inside that — but growth eats it faster than owners expect.

That read-only first look is what our free assessment opens with — the licence list set against the staff list, and nothing changes until you've seen what it finds.

Second half: the settings

Security defaults: on, off, or replaced — but know which

Microsoft's security defaults are a preconfigured baseline: every user registers for multifactor authentication, administrators do MFA, legacy authentication protocols and device code flow are blocked, and privileged activities like reaching the Azure portal are protected. Microsoft's reasoning is blunt — in its words, "more than 99.9% of those common identity-related attacks are stopped by using multifactor authentication and blocking legacy authentication."

The problem is rarely that defaults are bad. It is that nobody knows the tenant's state: defaults on, defaults off with nothing replacing them (the dangerous one), or defaults replaced by Conditional Access policies. Microsoft Learn is explicit that if you disable security defaults, you enable Conditional Access policies immediately to take their place — and Conditional Access requires at least Microsoft Entra ID P1, which is the licence tier question from the first half, coming back around.

"I think MFA is on" is the most common answer we hear, and it is a guess, not a setting.

Admin accounts and consent

Two quieter items finish the settings pass. First, admin roles: how many accounts hold Global Administrator, whether they are separate accounts used only for admin work, and whether the emergency ("break-glass") accounts Microsoft recommends — two cloud-only accounts, permanently assigned the Global Administrator role — exist and are documented. Second, app consent: which third-party apps your users have granted access to your tenant, and whether ordinary users can keep granting more. (What that consent can be turned into, an attacker demonstrated in October 2026 — our Microsoft 365 backup security checklist walks through reviewing connected apps after that incident.)

What a cleanup actually looks like, in order

The cleanup, in order: Audit → Licence fixes → Settings fixes → Written record.

1. Read-only audit first. Licence list vs. staff list, plan tiers vs. the tools actually in use, the tenant's security-defaults or Conditional Access state, admin roles, connected apps. Nothing changes yet — you get the list.
2. Licence fixes. Remove or reassign dead licences, right-size tiers per role, and cancel duplicates. These changes show up on the next invoice.
3. Settings fixes, staged. MFA coverage completed, legacy authentication blocked, admin hygiene sorted, and — if the licences support it — security defaults properly replaced by Conditional Access rather than just switched off. Staged, in report-only or pilot groups first, so nobody gets locked out on a Tuesday.
4. A short written record. What was changed, what your settings now are, and what to re-check quarterly. A tenant drifts back; the record is what makes the next cleanup an hour instead of a dig.

Amen's part in this can sit in either of our lanes, depending on what the audit finds: it is tenant work under our Server & Cloud services, and the email side of it — filtering, authentication records, the accounts attackers actually aim at — sits under Email & Communication.

Asked in almost every tenant we open

Why are we paying for Microsoft 365 licences nobody uses?

Because licences are assigned to accounts, not people, and accounts outlive roles. Someone leaves, a mailbox gets converted but keeps its licence, a project account never gets closed. The fix is rhythm, not a purge: reconcile the licence list against the staff list every quarter, and make licence removal part of offboarding — which is also when the account stops being a security risk.

What Microsoft 365 settings should be turned on for security by default?

Start with Microsoft's own baseline: security defaults enabled (or properly replaced by Conditional Access), which means every user registered for MFA, administrators doing MFA, legacy authentication and device code flow blocked, and privileged activities protected. Then the items defaults don't cover for you: a reviewed admin-role list, break-glass accounts, and user consent to third-party apps restricted. Microsoft Secure Score, in the admin center, shows where your tenant stands against Microsoft's recommendations.

How much does a Microsoft 365 migration cost for a 40-person company?

A migration — moving mail and files into Microsoft 365 from somewhere else — is priced by what is being moved: mailboxes, where the files live today, data volume, and how much cleanup the source needs on the way in. It is a different job from a cleanup, which works on a tenant you already have; our cloud migration checklist covers how a move is staged. Amen quotes migrations after an assessment rather than publishing a per-seat number, because the source environment changes the work more than the seat count does.

Who does Microsoft 365 setup and support for businesses in Winnipeg?

Amen Security does — setup, tenant cleanup, and ongoing support for Winnipeg businesses, with on-site work across Manitoba and remote delivery across Canada and the US. It sits inside our managed and cloud services rather than as a one-off product, which matters for a cleanup: the point is that someone keeps the tenant from drifting back.

The two jobs that sit next to this one

A cleanup doesn't live alone in a tenant. It has two neighbours, and most businesses end up doing all three within a year of each other:

• Your Microsoft 365 backup can be attacked too — this post's app-consent section, in depth: what a connected backup app could reach in October 2026, and the ten checks that followed.
• Cloud migration checklist for Canadian businesses — if the tenant itself is the problem and you're moving into Microsoft 365 rather than tidying the one you have, start with how a move is staged.

Make it a habit, not a rescue

Most tenants do not need a bigger plan or a new tool — and most cleanups, done once, quietly un-happen. Licences creep back on for people who've left. A new app gets consented to on a busy Friday. The defaults get changed for one urgent fix and never changed back. Drift isn't a failure of the first cleanup; it's what a tenant does when nobody's watching.

So make the second cleanup boring. Once a quarter, put the licence list beside the staff list: who joined, who left, whose role changed enough to change their tier. Tie licence removal to offboarding, so the account closes the same week the desk does. Keep the short written record from the first pass updated — your defaults state, your admin list, your approved apps — because that record is the difference between an hour of housekeeping and another dig.

The first cleanup is excavation. Every one after it should be a broom, not a shovel.

Sources & review

• Microsoft — Microsoft 365 Business Premium product page (microsoft.com): the five security services built into the subscription, not sold as add-ons (accessed October 23, 2026).
• Microsoft Canada — Microsoft 365 plans and pricing: the plan comparison behind the table above (Business Standard's identity tier is the free version of Entra ID), Defender for Business standalone listed at CAD $4.10 per user per month and noted as included in Business Premium, business plans designed for organizations with up to 300 users, and the tenant limit of 300 provisioned licences across the business plan family (accessed October 23, 2026).
• Microsoft Learn — "Configure security defaults for Microsoft Entra ID": what security defaults enforce, that disabling them calls for Conditional Access policies to take their place, and Microsoft's own statement on MFA and blocking legacy authentication, quoted in this post (accessed October 23, 2026).
• Reviewed: October 23, 2026.
• Amen Security is a Winnipeg-based managed IT (MSP) and website & custom apps provider: on-site support across Manitoba, remote support across Canada and the US, and a free assessment before any contract.