Five M365 licensing truths law-firm IT usually finds late

January 28, 2026

Microsoft Licensing: A futuristic digital graphic for Cocha Technology featuring a glowing neon blue padlock surrounded by red dollar signs, declining bar graphs, and circuit board patterns on a dark background.

Your biggest hidden cost in mid-size law firms

For many mid-size law firms, the Microsoft 365 bill is treated like rent: fixed, non-negotiable, paid without a second look. That passive approach often hides shelfware, unused E5 features, and Copilot seats sitting on weak permissions.

This is not only about trimming a few dollars. License structure affects security posture, privilege protection, and readiness to re-deploy and harden Copilot after the 2024–25 turn-on. Treat the agreement as a control decision, not a utility invoice.

Below are five licensing truths firm IT usually finds late. Use them before renewal, then prove agent reach with a free AI Readiness Snapshot. For SKU help, see Technology Brokerage and our guide to M365 licensing for law firms.

1. You're Paying for "Shelfware" on a One-Way Street

The term “shelfware” traditionally referred to software bought and left unused on a shelf. In the cloud era, it describes licenses that are assigned but inactive, unassigned entirely, or far more powerful than the user actually needs. The standard Microsoft Enterprise Agreement (EA) not only enables this waste but can lock it in for years. The EA is built around an annual “True-Up” process, where you pay for any growth in license usage. If your employee count increases, you pay for the additional licenses, and those new licenses are locked in for the remainder of the EA, becoming part of your new, higher baseline.

The shocking truth is that a standard EA is a one-way street. It has a True-Up, but it typically does not allow for a “True-Down”—a reduction in license count and cost if your workforce shrinks or your needs decrease. This creates a one-way ratchet effect where your commitment can only increase during the three-year term. If you downsize, divest a business unit, or simply find redundancies, you are generally stuck paying for those licenses until the contract expires. Industry analysis confirms the scale of this problem, finding that as much as 40% of Microsoft 365 licenses are unassigned, inactive, or oversized.

This structure turns the standard EA into a potential trap. It is a contract that can enforce inefficiency, forcing you to pay a premium for assets you no longer need. For a company with 5,000 licenses, a 10% workforce reduction in year two of a standard EA could mean paying for 500 phantom employees for up to 24 months—a seven-figure mistake locked in by an inflexible contract.

2. You're Paying for a Ferrari and Driving It in a School Zone

Many organizations pay a premium for high-end licenses like Microsoft 365 E5, which are packed with advanced security, compliance, and analytics tools. Yet, a vast majority of their users only ever access the basic productivity functions—Word, Excel, Outlook, and Teams—that are available in much cheaper tiers. This is the classic “Ferrari in a School Zone” problem: you own a high-performance machine but are only using it for the most basic tasks.

The most common and costly form of this waste is duplicative spending. An organization will pay the premium for an E5 license while also paying for redundant third-party tools. We see this constantly:

Paying for E5’s Defender for Endpoint security suite while simultaneously paying for another endpoint solution like CrowdStrike or SentinelOne.

Paying for E5’s advanced identity protection while also paying for a separate identity provider like Okta or Duo.

Paying for E5 and Zoom, despite having Teams Phone and Audio Conferencing included.

This is where a strategic reframe is essential. The premium cost of an E5 license should not be seen as an additional expense but as a platform consolidation investment. The cost of an E5 upgrade can often be directly offset by calculating the licensing fees for these specific retired products. This transforms the E5 license from a cost center into a cost-neutral consolidation project, funded by eliminating the redundant software you’re already paying for.

3. Your License Tier Is Your First Line of Defense Against the AI Privacy Trap

The rise of generative AI has introduced an insidious new risk: “Shadow AI.” This is the unauthorized use of consumer-grade AI tools, like the public version of ChatGPT, by employees trying to work more efficiently. When an employee pastes confidential client information, strategic plans, or proprietary code into one of these tools, that data is often ingested to train the provider’s AI models. This creates a catastrophic risk of data leakage, and courts may view the voluntary input of privileged information as a “waiver of attorney-client privilege,” turning a security breach into a legal catastrophe.

There is a critical privacy distinction between consumer and enterprise AI that your license tier governs. Only enterprise-grade tools like Microsoft 365 Copilot, managed under your organization’s agreement, operate under a Data Protection Addendum (DPA). This is a contractual guarantee that your company’s data will not be used for training foundational models. Consumer tools offer no such protection.

Your license tier is your primary technical defense. The premium Microsoft 365 E5 license includes Defender for Cloud Apps, a Cloud Access Security Broker (CASB) that gives IT the power to discover, monitor, and block employees from accessing and uploading data to these unauthorized Shadow AI applications. In the age of AI, your license is no longer just about features; it’s a fundamental security and legal control that dictates your ability to protect your most sensitive information.

4. Escaping the One-Way Street: Flexibility Is Negotiable, Not a Given

The “no True-Down” limitation of the standard Enterprise Agreement isn’t the end of the story. While it is the default, businesses are not powerless. Microsoft offers alternative agreement structures that provide the flexibility needed to avoid being locked into paying for unused licenses, and knowing they exist is your most powerful negotiation tool.

The two primary alternatives are:

The Enterprise Subscription Agreement (ESA): Unlike the standard EA where you purchase perpetual licenses, the ESA is a subscription. The key benefit is that it allows you to reduce your license counts at each annual anniversary, providing a “True-Down” option that aligns your costs with your actual workforce size.

The Cloud Solution Provider (CSP) Program: For maximum flexibility, the CSP program allows you to purchase licenses through a partner on a month-to-month basis. This model lets you add or remove licenses at any time, making it ideal for organizations with fluctuating headcounts or seasonal workers.

These options are powerful negotiation levers. This flexibility comes with a trade-off: EAS involves subscribing instead of owning perpetual licenses, and CSP may have a higher per-unit cost. The strategic decision is choosing the model that aligns with your organization’s tolerance for financial risk versus its need for operational agility. By understanding these alternatives, you can tailor an agreement that fits your business reality, especially if you anticipate workforce changes.

5. You Don't Need to Be a Spreadsheet Hero to Find the Waste

Identifying license waste doesn’t require a team of auditors and weeks of manual spreadsheet analysis. The key is knowing where to look and shifting from a passive to an active management mindset. Simply looking at the “Assigned Licenses” count in your admin portal is misleading, as it tells you nothing about actual usage.

A simple yet effective industry standard is the “90-day rule.” Any licensed account that has shown no sign-in activity for 90 days is a prime candidate for having its license reclaimed and redeployed. This single metric can uncover significant waste from former employees whose licenses were never de-provisioned.

For a more granular analysis, your IT team can use built-in tools to find this information without manual effort. Using a simple PowerShell command (Get-MgUser), your IT team can instantly generate a list of every user whose last sign-in was more than 90 days ago. This turns a complex audit into a simple, repeatable script. The data and the tools are already at your disposal; the first and most important step is deciding to use them to move from a “renew and forget” approach to an active “monitor and optimize” operational model.

Did Microsoft cancel Claude? What happened and what it means for licensing

Short answer: Microsoft did not kill Claude as a product you can buy. What showed up in search and the trade press was an internal move. Reports described Microsoft ending or sharply limiting employee Claude licenses, citing high operational costs. That is a cost and tooling decision for Microsoft staff. It is not the same thing as yanking Claude from every Microsoft 365 customer.

Why it still matters for firm IT.

First, it is a cost signal. If Microsoft’s own teams felt Claude usage was expensive at scale, assume your dual-stack bill (Copilot seats plus Claude Team or Enterprise, plus connectors) will get the same scrutiny from your managing partner. Model the real monthly run rate before you promise both tools firm-wide.

Second, do not confuse employee policy with commercial availability. Claude for work, Claude connectors into Microsoft 365, and Copilot remain separate commercial products with their own contracts. Your CSP quote and your Anthropic (or Claude for Enterprise) agreement still control what you can deploy. Microsoft’s internal revoke does not rewrite those.

Third, the security work does not shrink. Whether attorneys land on Copilot, Claude, or both, agents still inherit permissions. Shelfware E5 and Copilot seats on overshared SharePoint are still the expensive failure mode this post started with.

Practical next step for a mid-size firm: decide which tool is primary for drafting, which is secondary, and who pays for each seat. Then prove what those seats can already reach. A free AI Readiness Snapshot is the short path. For SKU math on the Microsoft side, see Microsoft 365 license types and Technology Brokerage.

From fixed cost to control decision for law firms

Your Microsoft licensing agreement should not be a static, uncontrollable cost. It is a lever for savings, client-data controls, and Copilot readiness. Shelfware, unused E5 features, and Copilot seats on weak permissions show up repeatedly in mid-size law firms.

When renewal approaches, do not just approve the invoice. Re-architect seats to match risk, then verify what agents can reach. Get an AI Readiness Snapshot. Licenses don’t fix oversharing. A free AI Readiness Snapshot shows what agents can already reach.

Next steps: Copilot readiness for law firms, the Copilot data ring-fence guide, M365 DLP for law firms (E3 vs E5), and Talk to us about M365 licensing for your firm.