One of our clients recently spotted a message under Health > Service Health in the Microsoft 365 admin portal reading “License configuration issue detected.” It’s the kind of automated alert we expect to see more of, so it’s worth setting out what triggered it, what it does (and doesn’t) tell you, and what to check next.
What the Alert Flagged
- The trigger: Customer Managed Key (CMK), a Microsoft Purview feature that requires an E5 licence.
- The message itself: it listed the licences Microsoft expected to see against the licences it actually detected in the tenant.
- The root cause: when a feature like CMK is switched on at the tenant level, every user in that tenant automatically gets the benefit of it, whether or not they hold the qualifying licence.
Source: Service health – Microsoft 365 admin | Microsoft Learn
Why Tenant-Level Features Create Licence Risk
- No opt-out by default: enabling a premium feature tenant-wide extends it to every user unless conditional access or licensing policies are configured to prevent this.
- This isn’t new: we’ve long advised clients that if an E5 licence is activated at the tenant level, Microsoft expects all employees to be licensed accordingly, not just the users who need the feature.
- CMK is one example: the same principle applies to any tenant-wide E5 capability, from Purview features to Defender and Entra add-ons.
Is This Microsoft Running AI Audits?
Not quite, at least not yet. This looks like an automated, rules-based check rather than an AI system actively investigating a tenant. Microsoft’s Service Health dashboard has flagged known configuration issues for years; what’s notable here is that it’s now reconciling a specific premium feature (CMK) against the E5 entitlement it requires, and surfacing the mismatch directly to admins.
That distinction matters, but it doesn’t make the underlying risk any smaller. Whether the check is powered by AI or a straightforward rules engine, the effect is the same: Microsoft’s own portal is now telling organisations when a feature is switched on without the licensing to back it up.
What We Found When We Checked Further
At The SAM Club, we’ve built new analysis reporting for the Microsoft admin portal that goes further than the standard dashboards. Running this for clients, we’ve already found licences that were over three years old still assigned to a user who had left the organisation, simply missed by the leaver/joiner process.
That’s a real cost sitting on an invoice for three years, for someone who was never going to use it. It’s exactly the kind of gap that compounds when tenant-wide features are switched on: every stale, unremoved account may also be silently consuming a licence entitlement it shouldn’t have.
What Our Reporting Can and Can’t See
- Can spot: stale accounts, duplicate assignments, and generic accounts with a licence assigned for review
- Can’t see: what’s switched on at the tenant level. That visibility sits with Microsoft’s own admin tools, not with reporting built on top of them.
Need Help With Your Microsoft Licence Position?
Contact us at The SAM Club if you’d like us to review your Service Health page, check for licence configuration issues, and cross-reference this against your actual licence assignments to help you remain compliant. This enhancement to our service is provided as standard to our clients.