[object Object]

Trials are how Dynamics 365 spreads inside an org. Someone clicks “Try”, gets 30 days, finds the trial useful, keeps using it past expiry by accident — and your tenant now has 47 users with Sales Premium entitlements you did not budget. By the time the M365 admin notices the renewal line items, finance has questions and you have a true-up to run. This is how to do it without panic.

How trials slip into production

  • Self-service trial signups create users with full enterprise SKUs.
  • Trials extend automatically for 30 days when an admin defers expiry.
  • Trials that expire leave the security role on the user, so the user still appears active in usage reports.
  • Trials convert to paid via the Microsoft 365 admin center, frequently by someone other than the licensing owner.

The result: a steady drift of paid entitlements that nobody requested in writing.

What true-up actually means in the Microsoft licensing model

Dynamics 365 is a per-user subscription. A true-up is the reconciliation of “who has the entitlement” against “who actually needs it” against “what we are paying for”. The forcing functions:

  • Annual renewal date — the contract resets and Microsoft sells you the new headcount.
  • Audit — Microsoft’s audit team or your reseller can request a license usage report.
  • Cost review — finance asks why D365 spend doubled.

You want to do the work before any of these. The exercise is the same; the leverage is different.

Pull the actual usage

The Power Platform admin center exposes user activity. The relevant cuts:

  • Active users in the last 30 days, per environment, per app module.
  • Assigned licenses, from M365 admin center via Graph.
  • Security role memberships in each environment.

A user with a Sales license but no activity in any Sales app module for 60 days is a candidate for removal. A user with a license but no role memberships in any production environment is a stronger candidate.

GET https://graph.microsoft.com/v1.0/users?
  $select=id,displayName,assignedLicenses,signInActivity&
  $filter=assignedLicenses/any(a:a/skuId eq <DYN365_SALES_SKU_GUID>)

Pair the result with the Dataverse audit table filtered to a relevant operation set. The intersection is your “licensed but inactive” cohort.

The three-tier cleanup

  1. Dormant licenses: users with the SKU, zero activity in 60 days, no roles in production environments. Remove the license. Document the user in case of dispute.
  2. Overprovisioned licenses: users with Sales Premium who only use Sales Basic features. Downgrade the SKU.
  3. Wrong-SKU: users with Customer Service licenses doing Sales work, or vice versa. Reassign.

Bucket sizes are usually surprising. We routinely see 15-20% of licenses fall into one of these three buckets in a tenant that has not done a true-up in two years.

Build the cleanup queue

A simple Power Automate flow gates each candidate through a review step. The license owner reviews; manager approves on no-response; license is removed with a 7-day “in case” delay.

trigger: Recurrence (weekly)
actions:
  - query_inactive_users:
      kql: |
        SignInLog | where TimeGenerated > ago(60d)
        | summarize last_sign = max(TimeGenerated) by userId
  - for_each_candidate:
      - send_approval:
          assignedTo: [email protected]
          subject: "License removal proposed: {user.displayName}"
          options: [Keep, Remove, Downgrade]
      - on_remove:
          - schedule_removal_in: 7d
          - notify_user: true

The 7-day delay is the safety net. Users who genuinely need the license will pipe up. Users who do not will not notice.

Trial detection

Microsoft tags trial subscriptions with a SKU GUID distinct from the paid SKU. Run the Graph query for trial SKUs separately. Any trial subscription past expiry should already have removed entitlements automatically, but the user records linger. Hard-delete or disable per your HR policy.

The audit-defense file

Keep a single artifact that documents your true-up: snapshot of usage at run time, list of users removed, list of users grandfathered with justification, sign-off from the license owner. If Microsoft audits you, this is the document that turns the conversation from “explain yourself” to “here is the reconciliation”.

The shape we use:

# License True-up Q2 2026

## Snapshot
- Total Sales Premium assignments: 312
- Active in last 60 days: 256
- Dormant: 41
- Wrong-SKU candidates: 15

## Actions taken
- 38 dormant: license removed.
- 3 dormant: grandfathered (executive, low-use approved).
- 12 wrong-SKU: downgraded.
- 3 wrong-SKU: reassigned.

## Net change
- Paid seats reduced by 50.
- Annual cost impact: -$94,800.

## Sign-off
- License owner: ...
- Finance: ...

Operational hardening

After the true-up, prevent regression:

  • Block self-service trial signups via tenant policy (AllowSelfServicePurchase set to disabled per SKU).
  • Require manager approval for new license assignments via Entra workflow.
  • Run the dormancy report monthly, not annually.
  • Tag every license assignment with a cost-center attribute so finance has the cut by default.

Pixel notes

Build a single dashboard for license owners showing assigned vs active vs cost per SKU per cost center. Three KPIs, one table. The dashboard is the forcing function — once owners can see their own meter, they police it.

See also

Dynamics 365 complete guide covers the SKU landscape that you are reconciling against.

Bottom line

  • Trials spread silently and convert into paid drift.
  • Build the dormancy report; remove with a 7-day delay.
  • Bucket into dormant, overprovisioned, wrong-SKU.
  • Keep a single audit-defense file from each true-up.
  • Block self-service signups and require manager approval to prevent regression.
[object Object]
Share