Microsoft 365 License Management for User Accounts with the Microsoft Graph PowerShell SDK (2024)

Comments

1. 

   Rob 25 Apr 2024Reply

   Thank you for your examples, Tony. I am trying to find the best way to export SKU, UPN, Display Name, and Department to one CSV file, but no amount of manipulation gives me the right results. Do you know of the best method to achieve this?

2. 

   Paul Karanja 24 Mar 2024Reply

   Hi Tony,

   I have seen a lot of examples of how to assign skus and disable service plans, I am yet to see an example on how to enable disabled service plans. I can’t seem to get the right syntax for it.

   1. 

      Tony Redmond 25 Mar 2024Reply

      When you run Set-MgUserLicense to disable service plans for a license, you pass two values in a hash table to the AddLicenses parameter. One is the product (SKU) id for the license, the other is an array of disabled service plans. To reenable a service plan, run Set-MgUserLicense again after removing its service plan identifier from the array of disabled service plans. All explained in detail in the Office 365 for IT Pros eBook (;-)

3. 

   Preston H. 5 Mar 2024Reply

   Tony, I have looked high and low and cannot find a command that says if you have both SkuId X and SkuId Y assigned to your account, remove the Y license. Is this possible with Graph? Just to clarify, we recently got Microsoft 365 E3 licenses and assigned them via groups. I need to go back and remove the Exchange Online Plan 2 license from their account. Doing this with Graph would probably be the best way to do it, but I can’t seem to find the right commands for it. It may not even be possible but it probably is. Have you seen this type of scenario before?

   1. 

      Tony Redmond 5 Mar 2024Reply

      Seems straightforward enough. Find the users with the Microsoft 365 E3 licenses (SKUId = 05e9a617-0261-4cee-bb44-138d3ef5d965) and check each account to see if they have a separate Exchange Online Plan 2 license (SKUId = 19ec0d23-8335-4cbd-94ac-6050e30712fa). If true, remove the Exchange Online Plan 2. Is that what you want to do?

      1. 

         Preston H. 5 Mar 2024Reply

         That’s what I am looking for, so i can do this for 2000 or so users.

         1. 

            Tony Redmond 5 Mar 2024Reply

            Should be quick and easy.

            Run Get-MgUser to find the users with the Microsoft 365 E3 license.
            ForEach user check the AssignedLicenses property to see if Exchange Online Plan 2 is present.
            If it is, run Set-MgUserLicense to remove the Exchange Online license.

            1. 

               Tony Redmond 5 Mar 2024

               And I am literally running out of the house to the airport else I would write the code… But it is simple enough. You might want to add some logging etc. to track the removals of the licenses. Remember to stop paying Microsoft for the Exchange Online P2 licenses!

            2. 

               Preston H. 5 Mar 2024

               I will see if I can figure out how to write this. hopefully with some whatif statements! Thanks!

         2. 

            Tony Redmond 5 Mar 2024Reply

            I remembered that I wrote this article https://practical365.com/switch-microsoft-365-licenses/ about approximately the same situation. Perhaps it will help.

            See Also

            Reddit - Dive into anythingArchive in Outlook for WindowsWhy email is stuck in Outlook & how to make it sendRecall an email message that you sent in Outlook

         3. 

            Tony Redmond 8 Mar 2024Reply

            Did you get your licenses reassigned?

            1. 

               Preston H. 8 Mar 2024

               I am working on that now! This is a script I wrote that pulls the userid’s from a CSV file. I did it this way because I can run a report to show who has the E3 and the Exchange Online Plan 2 license, and I know for certain I am pulling an EP2 license away from an E3. You just put the userid’s in the CSV file, with the first line being called UserId, and all the lines below are the UPN’s of the users that you want to remove the license from. Not as complex of a script like yours but hey it works!

               $users= Import-Csv “C:\temp\userlist.csv”
               $ep2Sku = Get-MgSubscribedSku -All | Where SkuPartNumber -eq ‘EXCHANGEENTERPRISE’
               foreach ($user in $users)
               {
               Set-MgUserLicense -UserId $user.userid -RemoveLicenses $ep2Sku.SkuId -AddLicenses @()
               }

            2. 

               Tony Redmond 8 Mar 2024

               Whatever works… works… that’s the beauty of PowerShell.

            3. 

               Preston H. 8 Mar 2024

               I appreciate the help!

4. 

   Hector Abreu 2 Mar 2024Reply

   Why not simply show how to script the removal of a single or all lics assigned to a departed user?

   Here is how I do this using MSOL:

   $upn = “someupn” #this is trivial

   (get-MsolUser -UserPrincipalName $upn).licenses.AccountSkuId |
   foreach-object{
   Set-MsolUserLicense -UserPrincipalName $upn -RemoveLicenses $_
   Set-MsolUser -UserPrincipalName $upn -BlockCredential $true
   }

   This used to work like a charm before Graph.

   does anyone here know how to do the exsact same action using Mg-GRaph?
   Thanks

   1. 

      Tony Redmond 3 Mar 2024Reply

      It’s even easier to remove all the licenses from a user account using the Graph SDK. I’ve updated the post to show how.

5. 

   Nick Castle 1 Dec 2023Reply

   Hello Tony,

   I find myself in a somewhat complicated situation at my company, and I believe your expertise could be very helpful. We regularly need to make license changes in Microsoft 365, for example, switching from an EOP2 to an M365 E3. The main challenge is managing services during these transitions.

   To give you a clearer picture, consider this example: a user currently has the ENTERPRISEPACK license with the BPOS_S_TODO_2 service active. When changing their license to ENTERPRISEPREMIUM, I want to ensure that the equivalent service in the new license remains active, which in this case would be BPOS_S_TODO_3.

   Although I can set up a logic to handle these changes based on service nomenclature, this method isn’t entirely accurate or reliable. I wonder if you know of any more robust and precise solution to maintain the equivalence of activated or deactivated services when switching between different Microsoft 365 licenses.

   Any guidance or suggestion you could provide would be immensely appreciated.

   Thank you for your time and help.
   Nick Castle

   1. 

      Tony Redmond 2 Dec 2023Reply

      Interesting question. It should be possible to compare the set of service plans for the original SKU with those for the new SKU and figure out matching plans. After that, it’s a matter of making sure to disable the correct service plans when assigning the new license to make sure that you end up with equivalence. I’ll think about this a bit more and see if I can do any better.

6. 

   Hrishikesh 1 Dec 2023Reply

   Hi Tony,
   Thanks for the script that is bit helpful to move from MSOL to Graph. I have only one difficulty, how do I get total license count by MS Graph (Previously called “ActiveUnits” in MSOL) ? From your script I can get ConsumedUnits but how do I get ActiveUnit count ? Actually we have Report License script that runs based on MSOL and sends us a report of every product’s name, total license count and consumed unit count – facing difficulity with Graph to get it.

   1. 

      Tony Redmond 1 Dec 2023Reply

      You mean like the code explained in https://office365itpros.com/2023/07/06/microsoft-365-subscriptions-ps/?

      1. 

         Hrishikesh 1 Dec 2023Reply

         Wow, Thanks a ton, Tony. I Appreciate your quick response. Your referred link solved my issues with the report. I was actually after this below two lines –

         ActiveUnits = $Sku.PrepaidUnits.Enabled
         WarningUnits = $Sku.PrepaidUnits.Warning

         Thank you very much once again. I am converting our legacy MSOL scripts into Graph but as I am not that expert I may come back again for help. Thank you very much.

         1. 

            Tony Redmond 2 Dec 2023Reply

            Amazing what you can find on the internet 😉

7. 

   Pranav P 20 Nov 2023Reply

   can you give the github link to this script

   1. 

      Tony Redmond 20 Nov 2023Reply

      There is no link. There are only code examples.

8. 

   Pranav P 20 Nov 2023Reply

   Hey i need to assign licenses to multiple users , using csv,can give me the scripts for that

9. 

   Andy Swiffin 11 Oct 2023Reply

   Whatever happened to the “new license management platform” announced by Alex Simonds here:

   https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/migrate-your-apps-to-access-the-license-managements-apis-from/ba-p/2464366

   in which he says: “Group licensing will be extended. In the new licensing platform, Azure AD Premium or Office 365 E3 will no longer be required to use group-based licensing for license assignments”

   ?

   1. 

      Tony Redmond 11 Oct 2023Reply

      I asked Alex Simons about this recently. The answer from his team is that work is still ongoing to finalize the new product license management platform. When that’s done, they’ll remove the P1 requirement.

10. 

    JHH 9 Oct 2023Reply

    I have a script that pulls from a csv file where I create temp student accounts. I have the script create the account, then change the password, then add office license, then add PBI license. During each license phase assignment every piece of meta information about the account that was assigned a license is displayed. So, student 1 -10 shows me each account meta info and it happens twice since it runs through assigning one license then the other. Below is a snippet of the PBI assignment section (other license assignment section is the same). Looks the same as above in article other than the throttle control statement. Why would all that info be show after each assignment?

    #Add Office License
    $batchCount = 0
    Import-Csv -Path .\PbiXX.csv |
    ForEach-Object {
    if ($batchCount -eq $batchSize){
    Start-Sleep -Seconds $wait
    $batchCount = 0
    }
    Set-MgUserLicense -UserId “$($_.FirstName)@pbiclass.com” -Addlicenses @{SkuId = ‘3b555118-da6a-4418-894f-7df1e2096870’} -RemoveLicenses @()

    $batchCount++
    }

    See Also

    How to Customize WooCommerce Shop Page - The Complete Guide
    1. 

       Tony Redmond 9 Oct 2023Reply

       Do you mean that you don’t want to see the Set-MgUserLicense cmdlet output anything? If so, just assign the output to a variable:

       $Status = Set-MgUserLicense -UserId “$($_.FirstName)@pbiclass.com” -Addlicenses @{SkuId = ‘3b555118-da6a-4418-894f-7df1e2096870’} -RemoveLicenses @()

       BTW, I cover bulk assignment in https://practical365.com/bulk-license-assignment-with-the-microsoft-graph-powershell-sdk/

11. 

    zen 27 Sep 2023Reply

    Hi,
    when I use this command:
    Set-MgUserLicense -UserId $user.Id -AddLicenses $addLicenses -RemoveLicenses @()

    I have this error:
    Set-MgUserLicense : License assignment failed because service plans 63038b2c-28d0-45f6-bc36-33062963b498,0a4983bb-d3e5-4a09-95d8-b2d0127b3df5 are mutually exclusive Status: 400 (BadRequest)

    1. 

       Tony Redmond 27 Sep 2023Reply

       What’s in $AddLicenses?

       What licenses are you attempting to assign?

12. 

    Mike Vega 2 Aug 2023Reply

    Hola Tony, una pregunta, como puedo asignar un único tipo de licencia a un listado CSV, tendrás ese ejemplo ? agradezco el apoyo.

    1. 

       Tony Redmond 3 Aug 2023Reply

       I’ve just written a script to read users in from a CSV to assign licenses. I need to add some error handling and I will post the results in an article soon.

    2. 

       Tony Redmond 18 Sep 2023Reply

       https://practical365.com/bulk-license-assignment-with-the-microsoft-graph-powershell-sdk/ is what you need.

13. 

    Ruth 1 Aug 2023Reply

    Great article! No questions here… everything worked as described. You’re my new hero!

14. 

    Shubhanshu 28 Jul 2023Reply

    Hi Tony, I’m trying to remove licenses for bulk deleted users, can you help if you have written something?

    1. 

       Tony Redmond 29 Jul 2023Reply

       I just deleted a user account by running Remove-MgUser. The license was removed from the account. Why do you think you need to remove licenses from bulk-deleted users?

       1. 

          Shubhanshu 1 Aug 2023Reply

          Hi Tony, When I checked the deleted users in admin portal I see licenses are tagged against that deleted user hence came the thought, is this expected behavior if you know?

          1. 

             Tony Redmond 1 Aug 2023Reply

             Licenses are noted for deleted accounts so that Microsoft 365 can reassign the license to an account if it is restored. However, once an account is deleted, any licenses it had prior to deletion are available for reassignment.

15. 

    Christopher 28 Jul 2023Reply

    Hi Tony,

    Can you help me here with error below.

    My command.

    $CSV = Import-CSV -Path C:\Temp\users5.csv #-Delimiter “;”

    ForEach ($Users in $CSV)

    {

    Set-MgUserLicense -UserId $User.UserId -AddLicenses @{SkuId = ‘c1821944-af26-46d5-ae15-4f65450761cc_66b55226-6b4f-492c-910c-a3b7a3c9d993’} -RemoveLicenses @()

    }

    Here’s the error

    Set-MgUserLicense : Cannot convert the literal ‘c1821944-af26-46d5-ae15-4f65450761cc_66b55226-6b4f-492c-910c-a3b7a3c9d993’ to the expected type ‘Edm.Guid’.
    Status: 400 (BadRequest)
    ErrorCode: Request_BadRequest
    Date: 2023-07-28T19:41:51
    Headers:
    Transfer-Encoding : chunked
    Vary : Accept-Encoding
    Strict-Transport-Security : max-age=31536000
    request-id : 3073e24e-5de4-4928-b509-116c8d0c96d8
    client-request-id : e084dd65-ea84-4cb4-8044-9b666aed98bf
    x-ms-ags-diagnostic : {“ServerInfo”:{“DataCenter”:”South Central US”,”Slice”:”E”,”Ring”:”5″,”ScaleUnit”:”004″,”RoleInstance”:”SA2PEPF0000110C”}}
    x-ms-resource-unit : 1
    Cache-Control : no-cache
    Date : Fri, 28 Jul 2023 19:41:50 GMT
    At line:7 char:1

    1. 

       Tony Redmond 28 Jul 2023Reply

       The SKU id that you’re trying to use is not a valid GUID (it’s too long). Where did you get it?

16. 

    Nei Venturini 19 Jul 2023Reply

    Hello,

    $st = New-Object -TypeName Microsoft.Online.Administration.StrongAuthenticationRequirement
    $st.RelyingParty = “*”
    $st.State = “Enforced”
    $sta = @($st)

    Update-MgUser -UserId $line.username -StrongAuthenticationRequirements $sta

    I used the above command to enable MFA after creating the account. Please, how can I do it using Update-MgUser?

    Thank you,

    1. 

       Tony Redmond 19 Jul 2023Reply

       You can’t enforce MFA using the Update-MgUser cmdlet. This is an acknowledged gap with the Graph (add your comments at https://feedbackportal.microsoft.com/feedback/idea/9b1b2216-9ab2-ed11-a81b-002248519701).

       Microsoft knows this is an API parity issue and will fix it in time. In the interim, continue using the MSOL cmdlet or (better) enforce MFA using a conditional access policy.

17. 

    Elijah 19 Jul 2023Reply

    I having issues adding BULK license. How do I do that?

    1. 

       Tony Redmond 19 Jul 2023Reply

       You don’t give enough detail in your question to allow any sort of a reasonable response.

       In general, if you want to assign licenses to several accounts, you’d loop through each account and add the license to the account.

18. 

    Morgan Nec 23 Sep 2022Reply

    Great article! This is extremely helpful, but how you would pull when a license was assigned to an individual? Thanks!

    1. 

       Tony Redmond 23 Sep 2022Reply

       That information isn’t kept with the license data for an account. It is captured in Azure AD “update user” records and you could search for those events in either Azure AD or the Unified audit log and report license assignments that way.

19. 

    Frank 21 Jul 2022Reply

    Hello, I am very new to Graph and am having an issue working with Bulk License removals from a CSV user list.
    In the CSV (header “Users” and the UPNs under) i have the UPN of the users. This is what i am trying to do.

    $Users = Import-csv “C:\Removals\removal_audioconferencing.csv”
    $SkuToRemove = “0c266dff-15dd-4b49-8397-2bb16070ed52”
    $users |ForEach-Object {Set-MgUserLicense -UserId $Users.id -RemoveLicenses $SkuToRemove -AddLicenses @()}

    1. 

       Tony Redmond 21 Jul 2022Reply

       Do you have the user identifier in the CSV?

       Also, $Users.Id refers to the set of values in the Id property of the $Users array.

       Maybe try:

       ForEach ($User in $Users) {
       Set-MgUserLicense -UserId $User.Id -RemoveLicenses $SkuToRemove -AddLicenses @() }

       1. 

          Frank 21 Jul 2022Reply

          No the only entry in the CSV is the UPN –
          Basically i am doing a dump to CSV for the licensed users and want to use that CSV to inject the UserID. Does that need to be the ID now instead of the UPN?

          I can use the UPN for a single removal with Set-MgUserLicense -UserId “user@domain.com” -RemoveLicenses @($MCOMEETADV.SkuId) -AddLicenses @{}

          1. 

             Tony Redmond 21 Jul 2022Reply

             What’s the column name? Is it ID or something else? Whatever it is, you need to reference the column name in what you feed to Set-MgUserLicense (the identity used can be either the UPN or the object identifier). For instance, if the column name is Id, then it’s Set-MgUserLicense -UserId $User.Id, if it’s UPN, then it’s Set-MgUserLicense -UserId $User.UPN.

          2. 

             Tony Redmond 21 Jul 2022Reply

             If there’s only one value per user in the CSV, then this should work:

             ForEach ($User in $Users) {
             Set-MgUserLicense -UserId $User -RemoveLicenses $SkuToRemove -AddLicenses @() }

             1. 

                Frank 21 Jul 2022

                That was it Thanks a Bunch!

20. 

    EricM 30 Jun 2022Reply

    Hi, Tx for this great read.

    What about getting the licenses including the commitment term (NCE) Year/Month.

21. 

    George Botelho 14 Jun 2022Reply

    Hi Tony,

    You provide examples of disabling service plans when assigning licenses. How about an example of a script that ENABLES service plans that the user currently has disabled?

    1. 

       Tony Redmond 14 Jun 2022Reply

       Geez… I have to leave something out that forces people to buy the Office 365 for IT Pros eBook!

       In any case, simply omit the service plan identifier from the list of identifiers passed in the DisabledPlan element, and run Set-MgUserLicense again. I just did this by removing a service plan from the $DisabledServicePlans variable shown below and running the command. The removed service plan is reenabled because it is part of the Office 365 E3 product.

       $DisabledServicePlans = @(“7547a3fe-08ee-4ccb-b430-5077c5041653”)
       Office365E3Sku = “6fd2c87f-b296-42f0-b197-1e91e994b900”
       Set-MgUserLicense -UserId Terry.Hegarty@Office365itpros.com -AddLicenses @{SkuId = $Office365E3Sku; DisabledPlans = $DisabledServicePlans} -RemoveLicenses @()

       1. 

          Daniel S. Gurrola II 2 Feb 2024Reply

          I read this comment, and I went and looked at the book (https://office365itpros.com/book-versions-and-prices) and I do not see how or why anyone that does anything more than casual scripting for Office 365 would NOT have this book.

          I bought mine! Did not even know you had this out there, I came here for the food…wait…the need to answer a Microsoft Graph and Powershell question for something I was working on…no answer here, but some hints and clues got me there.

          Just in case you’re the curios type Tony, Invoke-MgReplyUserMessage is where I landed eventually, and I figured it out, but I still want to know more about this than what I can find about this as well as the other Powershell Graph message send cmdlets (or API wrappers) – like what in the heck is the difference between the message body param and comment!!!!?

          Anyway, thanks for the posts here, been following your public posts for a dang long time…makes me feel old long time! end of NT 3.51 and start of NT 4 days…ouch…that hurt to type!

          1. 

             Tony Redmond 2 Feb 2024Reply

             Thanks Daniel. The Office 365 for IT Pros eBook has been around since 2015 and is updated monthly. We just issued monthly update #104. PowerShell is the largest chapter at some 142 pages.

             I must admit that Invoke-MgReplyUserMessage is not a cmdlet I am familar with. But like many of the SDK cmdlets, finding out how to use it is a matter of starting with the underlying Graph API and understanding how it has transitioned to a PowerShell cmdlet. That usually helps to identify what parameters are and how they should be passed. In many cases, it ends up as a hash table with keys and values.

             And I have been writing about technology for a very long time. I think the first magazine article I had published was in 1986…

             1. 

                Daniel S. Gurrola II 2 Feb 2024

                Well I could share my script, but it would look horrible here without your authoring tools to clean up the code 🙂

                I had >48K email messages that required a somewhat personal and individual reply. I also had to include the original message in the body of the reply as well as an acknowledgement of the specific time that message was received.
                Also had to reply to them in the order they were received – oldest first to newest last.

                Invoke-MgReplyUserMessage in PowerShell clearly does some of the heavy lifting for you – recipient = sender of source message and copy of sent message automatically dropped in the sent items folder: As long as you use the comment instead of the arduous task of building out the message body param, your reply automatically:
                1) Will be sent in HTML format.
                2) Includes original message in reply message body.
                The comment can be built out in a variable hash table with HTML4 tags or HTML5 inline CSS and then have that variable = that variable piped to Out-String…now comment: $var and your message body is done.
                I am not a true developer, so I find looking at the SDK API documentation hard to marry back to PowerShell unless they help me – like the REST API “message: reply” page (https://learn.microsoft.com/en-us/graph/api/message-reply?view=graph-rest-1.0&tabs=powershell) shows several code language examples, the syntax shown typically is hint enough for me to go digging, but figuring out how in the world which PowerShell cmdlet does which thing(s) in the Microsoft Graph API is challenging sometimes.

                Digging into the PowerShell command yielded little results. Even my long dear friend – I kid you not, this guy knows everything – Google, was stumped 🙂

             2. 

                Tony Redmond 2 Feb 2024

                We’re still in the early days of the Graph and finding examples for little used cmdlets derived from Graph APIs will always be difficult to find. Documentation is getting better, but solid examples covering all situations are still not available.