Active Microsoft 365 users
Cyber Protection counts Microsoft 365 seats only for the users in a Microsoft 365 organization that it considers active. A Microsoft 365 user is active when the user has a mailbox or OneDrive, even if that user is unlicensed in Microsoft 365.
When the mailbox or OneDrive of a user is removed in Microsoft 365, Microsoft retains the data for at least 30 days. Until Microsoft removes the data, Cyber Protection still considers the user active. As a result, a user who was recently deleted in Microsoft 365 can still consume a seat.
To stop an active user from consuming a Microsoft 365 seat, block the user from signing in to Microsoft 365, or convert the mailbox of the user to a shared mailbox. For more information, see Preventing unlicensed Microsoft 365 users from signing in and Backup quotas.