Microsoft 365 Tenant Cleanup Blueprint

What this helps with

• ✓Identifying unused licenses and saving costs
• ✓Removing stale accounts and orphaned groups
• ✓Cleaning up abandoned Teams and SharePoint sites
• ✓Improving security posture (MFA, Conditional Access)
• ✓Documenting the tenant for future management

Step-by-step plan

1. 1

   Run a license audit

   Export license assignments from Entra ID. Identify unassigned licenses and users who haven't signed in for 90+ days. Use Microsoft 365 Admin Center → Billing → Licenses.

2. 2

   Audit user accounts

   Export all users. Filter by: last sign-in, license, account type. Flag shared mailboxes, service accounts, and ex-employee accounts. Disable before deleting.

3. 3

   Clean up Groups and Teams

   List all Microsoft 365 Groups. Archive or delete Teams with no activity in 6+ months. Remove nested groups that serve no purpose. Set expiration policies going forward.

4. 4

   Audit SharePoint sites

   Review site collections via SharePoint Admin Center. Delete or archive inactive sites. Review external sharing settings — default to "Only people in your organization".

5. 5

   Tighten security settings

   Enable MFA for all users (Entra ID → Security → MFA). Set up Conditional Access policies. Review admin roles — remove unnecessary Global Admins.

6. 6

   Document and set policies

   Create a tenant runbook: how new users are onboarded, how licenses are managed, naming conventions for Groups and Teams. Schedule a quarterly review.