In the Management Portal, you check the Overview > Usage tab:
You see additional workload quota usage (i.e. Workstations/ Servers/ VMs).
The usage in the Management Portal does not match the actual amount of devices registered in this tenant. Some extra seats are occupied.
After a device has been removed from the Protection Console, its quota usage is not released and the seat remains occupied.