Renew Early, Renew Late or Let It Lapse? Timing Your Licence Renewals

Fix it now

Three clocks run on a renewal list and none of them is the renewal date. A term subscription has a seven-day window in which the seat count can go down, business antivirus stops protecting on its own schedule, and a perpetual licence never expires at all – only the Software Assurance on top of it does.

1. Renew endpoint protection before the date, with a buffer. Bitdefender publishes that when a GravityZone licence expires the protection modules of installed agents are disabled.
2. Renew early where the vendor stacks the time. ESET publishes that a renewal bought before expiry takes effect only once the original expiry passes, so nothing is lost.
3. Do not renew early if you expect the seat count to fall. A decrease is possible only within seven days of the licences being added, so renewal is the moment the number comes down.
4. Never let a Microsoft 365 subscription lapse as an economy. It runs about 30 days Expired, then about 90 days Disabled where only administrators can reach the data.
5. Let Software Assurance lapse only after checking what it carries. Its benefits end with the coverage, including the Windows Server disaster recovery rights a standby may rely on.
6. Do not plan around Defender picking up the slack. On a client not onboarded to Defender for Endpoint it sits in disabled mode, and on Windows Server it never re-enables itself.

If every line on your list is now sorted into subscription, antivirus or perpetual, stop here. Below is what each clock actually does, with the published timings, and how to pull staggered dates onto one anniversary without stranding a term.

Why it happens

Subscription licences bought on a term are committed for that term, and the window in which that commitment can be reduced is short and published. Microsoft’s new commerce terms allow cancellation with a prorated refund within the first seven days – 168 hours – of any term, and allow the licence count to be decreased only within seven days of when those licences were added. That last clause is the one people miss: it applies whether the seats were added at the initial purchase, at renewal, or mid-term. Seats added in month four start their own seven-day clock and are then committed like everything else. Increases can be made at any time.

Antivirus runs on entirely different logic, and it varies by vendor enough that a general rule is not safe. Bitdefender publishes that when a GravityZone licence expires the protection modules of installed agents are disabled, endpoints are no longer protected and scan tasks cannot be run, with newly installed agents dropping into a trial. ESET publishes something different again for its cloud console: an expired ESET PROTECT subscription suspends the instance, which becomes inaccessible, and after a 30-day retention period – with a warning at 14 days remaining – the instance and all its data are deleted permanently. Check your own product’s page rather than assuming a grace period exists.

The fallback most people assume exists needs correcting. When a third-party antivirus registers with Windows on a client that is not onboarded to Microsoft Defender for Endpoint, Microsoft Defender Antivirus goes into disabled mode, not passive mode – passive mode requires that onboarding. Disabled means it is not scanning and not remediating. It does re-enable itself automatically when the third-party product expires, is uninstalled, or otherwise stops providing real-time protection, but that automatic recovery applies to Windows clients only. On Windows Server nothing is automatic in either direction: Defender has to be turned off by hand when the third-party product goes on, and turned back on by hand when it lapses.

Perpetual licences are the quiet exception on a renewal list. An Office LTSC or Windows Server licence bought outright does not stop on any date; what has a renewal date is Software Assurance, and losing it costs upgrade rights, disaster recovery rights and reassignment flexibility rather than the software. Microsoft states plainly that the right to run a Software Assurance backup instance ends when the coverage ends, which is why lapsing it is a decision to take with the disaster recovery design open in front of you.

Put those together and the real decision date is several weeks before the renewal date. You need time to count actual usage, agree the new seat number and place the instruction, because after the window closes the number can only go up. Put that earlier date in the calendar and treat the renewal date as the deadline it feeds.

Full reference

Early, on the date, or lapse

What Microsoft publishes about an unpaid subscription

Two exceptions worth knowing. Under Volume Licensing, reducing a seat quantity gives no Expired stage at all – the service becomes unavailable immediately. And from 9 February 2026 the Expired stage no longer applies to licence-based subscriptions bought directly under a Microsoft Customer Agreement. CSP subscriptions follow their own Partner Center lifecycle states, so confirm your channel rather than assuming these figures.

The seven-day window is a hard edge

Treat the published rule as exact rather than approximate. Cancellation with a prorated refund is available within the first seven days, stated as 168 hours, of any term. Seat decreases are available within seven days of when the licences were added, and that clock restarts for each addition rather than running once per term. Outside it, seats can be added but not removed, and the subscription renews unless you say otherwise. That is why the useful action a few weeks before renewal is not a purchase decision but a counting exercise: assigned against purchased, per plan.

The same logic argues for co-terminating staggered lines onto one anniversary. Pick a month that suits your finance cycle rather than the month a threat scare happened to fall in, and accept that aligning dates will strand a little unused term on one or two lines. Doing that once buys you a single annual exercise instead of five partial ones.

What expiry does to antivirus, by published behaviour

Which timing to choose, by situation

• Endpoint protection you rely on: renew ahead of the date with a week or two of buffer, and confirm the console shows the new expiry before closing the ticket.
• A subscription whose seat count you expect to fall: do not renew early. The renewal is the only moment the count can come down.
• A subscription that is growing: add seats mid-term as you need them, but remember each addition carries only seven days in which it can be undone.
• Perpetual licences with Software Assurance you no longer use: let it lapse deliberately, after confirming you are not relying on its disaster recovery or reassignment rights.
• A product you are replacing: overlap old and new briefly rather than lapsing into a gap, then cancel at the next window.
• Anything holding data that you are retiring: extract and verify the data first. The published stages start at the expiry date, not when you remember.

Questions people ask about this