Start here
What an overage is #
Your support package includes a set of protections for every user you pay for. If you have more accounts or more computers than that, the extras carry a small charge. That charge is what we call an overage.
The principle is simple: you pay for a number of users, and each of those users comes with their entitlements included. Backups, identity monitoring, a monitoring agent for their computer, and on some packages a password manager and endpoint protection as well.
If your Microsoft 365 tenant has more licensed accounts than you have paid support users, or somebody has two computers rather than one, those extras still need protecting. They are covered, and they are billed at a small per item rate rather than a whole additional user.
An overage is not a fine and it is not a surprise mechanism. It is simply the cost of covering something beyond the count you are paying for. Most customers have a handful, most of the time, and plenty of those are worth keeping.
The reason we publish this is so you can see the maths, check it yourself whenever you like, and decide whether each one earns its place.
The rules
What your package includes #
Both packages work the same way. Assurance simply includes more per user.
| Included for every paid support user | Elevate | Assurance |
|---|---|---|
| Microsoft 365 backup | Yes | Yes |
| ITDR, identity threat detection and response | Yes | Yes |
| One monitoring agent for their computer | Yes | Yes |
| Keeper password manager | No | Yes |
| EDR, endpoint detection and response | No | Yes |
The overage rules are identical across both. On Assurance there are simply more things being counted, because Keeper and EDR follow the same one per user logic as everything else.
ITDR is identity threat detection and response. It watches your Microsoft 365 accounts for signs that somebody other than the owner is using one: an impossible journey between countries, a suspicious mailbox rule, a sign in that does not fit the pattern.
EDR is endpoint detection and response. It does the same job on the computer itself, watching for the behaviour of an attack rather than only for files already known to be bad.
Both are specialist products we deploy and monitor on your behalf. They are separate from anything included in your Microsoft licensing, and they are not the same as the Microsoft branded tools of similar names.
The rules
Microsoft 365 accounts #
Every licensed Microsoft 365 account gets backed up and monitored. The ones belonging to your paid support users are included. Any others are overages.
| What it is | Charged? | Why |
|---|---|---|
| A paid support user's account | Included | Backup and ITDR come with the user you are already paying for. |
| A shared mailbox | Never charged | It has no licence and no sign in, so there is nothing to protect in the same way. |
| Any other licensed account | Small overage | It still holds company data and can still be signed into, so it still needs backing up and watching. |
This is worth knowing because it is where most avoidable overages come from. Departmental addresses, leavers whose mail you want to keep, and catch all addresses do not need a licence at all, which means they never appear as an overage.
If you are not sure which of your addresses need a licence and which do not, that question is answered in full in Which kind of mailbox?.
A worked example
The rules
Computers and servers #
The same logic applies to machines. One monitoring agent per user, one per server, and anything beyond that is an overage.
| What it is | Charged? |
|---|---|
| A paid support user's computer | Included, one each |
| A server | Included, one agent per server |
| A second computer for the same person | Small overage |
| A machine with no user attached, such as a shared workshop PC | Small overage |
The commonest reason for an endpoint overage is somebody with both a desktop and a laptop, which is a perfectly reasonable way to work. The second machine still gets monitored, patched and protected, and it is charged at the small per device rate rather than as another user.
Old machines that were never decommissioned. A laptop replaced eighteen months ago and left in a cupboard can still be counted if it was never retired properly. Those are worth clearing out, and it costs you nothing to ask us to check.
Keeper and EDR follow exactly the same rule. One of each per paid user, with anything beyond that counted the same way. There is a guide to using Keeper at Keeper Password Manager.
Your part
Seeing your current position #
You do not have to wait for an invoice or ask us. Your current overages are visible in the portal at any time.
- Go to the portal coffeecup.support
- Sign in as a billing or administrator user Overages are commercial information, so they are visible to those roles rather than to everybody. If you should have access and do not, tell us who needs it.
- Look at your current overages You will see what is counted, in which category, and how it compares to what your package includes.
- Query anything that looks wrong If something is listed that you do not recognise, ask. Occasionally it is a machine that should have been retired, or an account nobody remembered was still licensed. We would far rather sort that out than bill you for it.
Fifteen minutes in the portal before your renewal conversation is time well spent. It is much easier to discuss your package when you can both see the same numbers, and it occasionally shows that a different user count would suit you better.
Your part
Reducing your overages #
Some overages are worth paying for. Others are the residue of things nobody got round to tidying up. These are the ones worth looking at.
Convert leavers to shared mailboxes
This is the biggest one, and it saves money twice. A departed employee's mailbox converted to a shared mailbox keeps all the history and keeps the address working, while removing both the Microsoft licence and the overage, because shared mailboxes are never charged.
It also closes a live set of credentials that nobody is watching, which is the better reason to do it. See When somebody leaves.
Retire machines you no longer use
Old laptops in cupboards, machines replaced but never decommissioned, and kit belonging to people who have left. Tell us which ones are genuinely gone and we will remove them.
Check whether every licensed account needs to be one
Departmental addresses, catch alls and anything that only ever receives email can usually be a shared mailbox instead of a licensed account. Ask us to review them with you.
Look at your support user count
If your overages have grown steadily, it may simply mean your business has grown and the paid user count has not kept up. Sometimes adjusting that works out better than carrying a long list of extras. We will tell you honestly which way round is better for you.
We will not quietly let overages accumulate because it suits us. If your position changes noticeably we will raise it with you, and if the answer is that your package should change rather than your overages growing, we will say so.
Support
Common questions #
Are shared mailboxes really never charged?
Correct. They carry no Microsoft licence and cannot be signed into, so they never count towards your Microsoft 365 overages. Have as many as you find useful.
Somebody has a laptop and a desktop. Is that two overages?
One. The first machine is included with them as a paid user, and the second is a single endpoint overage. It is still fully monitored and protected.
What about a phone or a tablet?
The agent counts cover computers and servers rather than phones. If you want mobile devices managed, that is a separate conversation and we will set it out clearly.
We have taken somebody on. What should we do?
Tell us, and we will add them as a paid support user rather than letting them appear as a set of overages. A new starter added properly is normally better value than the equivalent extras, and it means they get everything from day one.
Can we opt an account out of backup to avoid the charge?
We would rather you did not, and we will push back if you ask. An unbacked up licensed account is exactly the kind of gap that gets noticed at the worst moment. If cost is the issue, converting it to a shared mailbox usually solves the problem properly instead.
When are overages billed?
They appear on your regular invoice alongside your package. Your agreement sets out the rate and the billing period. If you would like a copy or a walk through of a particular invoice, just ask.
I cannot see overages in the portal
Overages are visible to billing and administrator users rather than to everyone, so you may be signed in with a standard account. Tell us who in your organisation should have that access and we will arrange it.
Something is listed that we do not recognise
Ask us. It is usually a machine that should have been retired or an account nobody remembered was licensed. We will look into it and correct it if it is wrong.
Getting help
If anything on your account does not look right, or you would like us to go through your current position with you and suggest where it could be tidied up, get in touch. We are happy to do that at any point rather than only at renewal.