Analyze E5 License Usage to Identify Downgrade Candidates to E3

Manual walkthrough via Microsoft 365 Admin Center

The portal does not provide a single consolidated E5-vs-E3 utilization report, so the manual path combines multiple admin views. Expect this to take 2–4 hours for a mid-size tenant.

Step 1 — Confirm SKU inventory

1. Sign in to Microsoft 365 Admin Center as a Global Reader or Global Admin.
2. Navigate to Billing → Your products.
3. Identify your E5 SKU (SPE_E5, ENTERPRISEPREMIUM, or similar) and E3 SKU (SPE_E3, ENTERPRISEPACK). Note the assigned vs. available counts.

Step 2 — Export E5 license holders

1. Go to Billing → Licenses, click your E5 product.
2. Click Assigned users → Export to download a CSV of current E5 assignees.

Step 3 — Disable report anonymization (required for named attribution)

1. Navigate to Settings → Org settings → Services → Reports.
2. Uncheck Display concealed user, group, and site names in all reports.
3. Click Save. This change is audit-logged.

Step 4 — Gather usage data per E5-exclusive service

1. Power BI Pro usage: Go to the Power BI Admin Portal → Usage metrics, or export the Activity Log (Admin portal → Audit logs) for the last 90 days. Extract unique UserIds.
2. Teams Audio Conferencing / PSTN: Teams Admin Center → Analytics & reports → Usage reports → PSTN and SMS usage. Export the last 90 days.
3. Defender for Endpoint: security.microsoft.com → Assets → Devices — identify which users' devices are onboarded.
4. Advanced eDiscovery / Purview: compliance.microsoft.com → eDiscovery → Premium — list custodians on active cases.

Step 5 — Cross-reference and build the candidate list

1. In Excel, combine the E5 holder list with the four usage lists using VLOOKUP/XLOOKUP on UPN.
2. Any E5 user NOT appearing in any of the four usage lists is a downgrade candidate.
3. Validate with the user's manager before action.

Step 6 — (Optional) Re-enable anonymization

Return to Org settings → Reports and re-enable concealed names if your policy requires it.

Microsoft Graph API approach

The API approach automates the full cross-reference. All endpoints are v1.0 unless noted.

Step 1 — Identify the E5 and E3 SKU IDs in your tenant

GET https://graph.microsoft.com/v1.0/subscribedSkus?$select=skuId,skuPartNumber,servicePlans

Look for skuPartNumber values such as:

• SPE_E5 — Microsoft 365 E5
• ENTERPRISEPREMIUM — Office 365 E5
• SPE_E3 — Microsoft 365 E3
• ENTERPRISEPACK — Office 365 E3

Note the skuId GUID for the E5 SKU — you'll filter users against it.

Step 2 — List all users assigned the E5 SKU

GET https://graph.microsoft.com/v1.0/users?$filter=assignedLicenses/any(x:x/skuId eq {E5_SKU_ID})&$select=id,displayName,userPrincipalName,accountEnabled,department,assignedLicenses&$count=true
ConsistencyLevel: eventual

Paginate with @odata.nextLink. Store the UPNs in a set called e5Users.

Step 3 — Ensure usage reports show real UPNs

GET https://graph.microsoft.com/v1.0/admin/reportSettings
// If displayConcealedNames = true, patch it:
PATCH https://graph.microsoft.com/v1.0/admin/reportSettings
Content-Type: application/json

{ "displayConcealedNames": false }

Step 4 — Pull E5-exclusive feature usage (90-day window)

Each of these returns CSV. Parse and extract the User Principal Name column for users with non-zero activity.

// Teams PSTN / Audio Conferencing
GET /v1.0/reports/getPstnCalls(fromDateTime=2024-01-01,toDateTime=2024-03-31)

// Power BI activity (via Office 365 activations / Yammer not reliable — prefer Power BI admin API)
GET https://api.powerbi.com/v1.0/myorg/admin/activityevents?startDateTime='2024-01-01T00:00:00'&endDateTime='2024-01-01T23:59:59'

// Office 365 Active Users (to see per-service activity flags)
GET /v1.0/reports/getOffice365ActiveUserDetail(period='D90')

Step 5 — Check each user's licenseDetails for dependency signals

GET /v1.0/users/{user_id}/licenseDetails

Returns the service plans enabled for the user — confirms whether Power BI Pro, MCAS, Defender P2, etc. are actually provisioned (not just disabled).

Step 6 — Compute the candidate set

Pseudo-logic:

candidates = e5Users 
  - powerBiActiveUsers 
  - pstnActiveUsers 
  - defenderP2ActiveUsers 
  - advancedEDiscoveryCustodians

Any user remaining is a downgrade candidate. Export to CSV with columns: UPN, Display Name, Department, Account Enabled, Last Sign-in, Recommended Action.

PowerShell automation with Microsoft.Graph

The script below uses the Microsoft.Graph PowerShell SDK to fully automate the analysis and produce a candidate CSV in one run.

Prerequisites

• PowerShell 7+
• Install-Module Microsoft.Graph -Scope CurrentUser
• An admin account with the permissions listed above (or consent on first run)

How it works

1. Connects to Graph with the required delegated scopes.
2. Discovers the E5 SKU automatically by matching skuPartNumber against known E5 identifiers.
3. Enumerates all E5 license holders with paging.
4. Temporarily ensures report names are visible (optionally restores the prior setting on exit).
5. Pulls three 90-day usage reports: PSTN calls, Office 365 active users, and Teams device usage.
6. Checks each user's licenseDetails for active E5 service plans.
7. Produces two CSV files: E5-Downgrade-Candidates.csv and E5-Keep.csv.
8. Prints a summary with estimated annual savings.

Usage

.\Analyze-E5Usage.ps1 -OutputPath C:\Reports -AnnualE5Cost 57 -AnnualE3Cost 36

Review the output CSVs with Finance and department managers before executing any license changes.