Disabling an account stops sign-ins; it does not touch group memberships, and group-based licenses follow membership. Every disabled account left as a direct member of licensed groups keeps consuming its seats until someone removes the memberships or the account.
Why the gap exists#
Offboarding processes disable accounts promptly because security requires it, then defer cleanup because deletion has retention implications. The deferred state, disabled but fully membered, is where seats quietly accumulate, invisible to license views that do not join account state with inheritance.
Finding them manually#
The join is account state against licensed membership:
Connect-MgGraph -Scopes "User.Read.All"
Get-MgUser -All -Filter "accountEnabled eq false" -Property displayName,assignedLicenses |
Where-Object { $_.AssignedLicenses.Count -gt 0 } |
Select-Object DisplayNameReclaiming safely#
For each hit, the question is which membership to remove: the account may sit in several licensed groups, and some memberships may matter for retention workflows. Removing the right edges, rather than all of them, keeps the offboarding reversible while freeing the seats.
VisualizerEngine
How VisualizerEngine does it
The population is a saved structural search: disabled accounts holding license assignments, each with the inheritance paths that explain the seats. Removal impact analysis confirms which membership edge frees the license without side effects, and utilization alerts surface new accumulations as offboarding continues.