Check ID: exchange_organization_delicensing_resiliency_enabled
Provider: Microsoft 365
Service: exchange
Severity: MEDIUM
Categories: resilience
Resource type: NotDefined

​
What this check verifies

Microsoft 365 Exchange Online Delicensing Resiliency provides a grace period when licenses expire or are reassigned, preventing immediate mailbox access loss. This evaluates whether the organization has Delayed Delicensing enabled to protect mailbox data during licensing transitions. Note: This feature is only available to tenants with 5000 or more paid licenses.

​
Risk

Without Delicensing Resiliency, removing or reassigning an Exchange Online license causes immediate mailbox inaccessibility. This can lead to data loss, business disruption, and inability to recover mailbox contents during organizational changes such as role transitions or license optimizations.

​
Recommendation

Enable Delicensing Resiliency to ensure mailbox data is preserved during license transitions. This provides a grace period allowing administrators to reassign licenses or export data before access is permanently revoked, maintaining business continuity and data protection.

​
Remediation

Set-OrganizationConfig -DelayedDelicensingEnabled $true

​
References

​
Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = exchange_organization_delicensing_resiliency_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks