Find Unlicensed Users in Microsoft 365 Using PowerShell

As an administrator, you might occasionally create user accounts in Microsoft 365 without immediately assigning licenses. This could be for reasons such as testing, future use, or managing external users. However, there may be times when you need to quickly allocate licenses to these unlicensed users, such as when new team members join, project requirements change, or temporary external collaborators require access. Therefore, knowing precisely who requires a license is essential for efficient management. In this blog, we’ll explore different methods to report on unlicensed users in Microsoft 365, helping you streamline your license management process and ensure no user is overlooked.

You can use the following methods to find how many unlicensed users are there in Office 365.

Microsoft 365 Admin Center: Log in to the Microsoft 365 admin center -> Users -> Active users. Click on the ‘Filters’ option. In the filter pane, check the box for ‘Unlicensed users’. The list will display users who do not have any licenses assigned. This method is straightforward, but it may not be the best option as it includes former employees too.

Graph PowerShell: By running the ‘Get-MgUser’ cmdlet with the appropriate filter, you can list all users who do not have any licenses assigned. While this method is more scalable than manual checking, it requires some PowerShell knowledge to obtain the desired results.

To make this process easier, we’ve developed a PowerShell script that efficiently identifies unlicensed users across your organization.

Download Script: GetUnlicensedUsers.ps1

1. The script uses MS Graph PowerShell and installs MS Graph PowerShell SDK (if not installed already) upon your confirmation.
2. The script can be executed with MFA enabled account too.
3. Exports both disabled and enabled user accounts without licenses.
4. Exports unlicensed member accounts only, excluding guests.
5. Identifies unlicensed users within specific departments.
6. Filters unlicensed users based on job title.
7. Exports report results as a CSV file.
8. The script is scheduler friendly.
9. It can be executed with certificate-based authentication (CBA) too.

The script exports all Microsoft 365 unlicensed users with the following attributes.

• UPN
• Department
• Job Title
• Creation Time
• User Type
• Account Status

The exported report on Office 365 unlicensed users looks like the screenshot below.

1. Download the script.
2. Start the Windows PowerShell.
3. Select any of the methods provided to execute the script.

Method 1: You can run the script with MFA and non-MFA accounts.

The script exports all the unlicensed users whose accounts are enabled, excluding any disabled accounts. However, it’s equally important to monitor licensed users by exporting a user license report using PowerShell.

Additionally, tracking the license assignment path is essential to determine if licenses are directly assigned or inherited from a licensed group.

Method 2: You also have the option to run the script using certificate-based authentication, which is scheduler-friendly. When you want to run the script unattended, you can choose this method.

To use certificates, you must register the app in Microsoft Entra which helps to connect to MS Graph using certificate. Depending on your requirements, you can create a self-signed certificate.

The method is scheduler-friendly. You can schedule the script using Task scheduler or Azure Automation.

The script offers a range of preset filtering options designed to cater to various needs. Here’s how you can utilize its features effectively:

• Retrieve all unlicensed users including disabled accounts
• View unlicensed member accounts only (Excluding guests)
• Filter unlicensed users by department
• Identify unlicensed users by job title

By default, the script generates a report only for unlicensed users with enabled accounts. However, during offboarding, user accounts are typically disabled and licenses are removed, so these disabled accounts are excluded from the default report. To address scenarios such as auditing or cleaning up old accounts, you can include disabled users in your report by using the -IncludeDisabledUsers parameter. This will provide a comprehensive list of all unlicensed accounts, regardless of their status.

The resulting report will list all unlicensed users, including enabled and disabled accounts.

if you’re preparing for a license optimization review or conducting an internal audit to ensure that your core team is fully licensed and compliant, excluding guest accounts from your report helps you avoid confusion and ensures you are addressing the needs of internal employees. Use the -ExcludeGuests parameter to target unlicensed users who are regular members of your organization.

The resulting report will list only unlicensed member accounts, omitting any guest accounts.

To generate a report that focuses on unlicensed users within a specific department, use the -Department parameter. This filter helps you drill down into unlicensed users based on their departmental affiliation, making it easier to manage and review licenses within different groups.

The resulting report will list unlicensed users belonging to the ‘Marketing’ department.

To find unlicensed users with a specific job title, use the -JobTitle parameter. This filter allows you to generate a report focusing on unlicensed users based on their job titles, which can be useful for targeted license management and role-based reporting.

The resulting report will list unlicensed users with the job title ‘Recruiter’.

AdminDroid offers a powerful, no-cost Office 365 license reporting tool that delivers detailed insights into license usage through smart dashboards and over 120 comprehensive reports. The tool provides an easy way to monitor and manage your Microsoft 365 licenses with reports categorized into:

Users and Licenses:

• Licensed users
• Unlicensed users
• Users with specific subscriptions
• Users with free or trial subscriptions
• License changes

License expiry details

• Purchased subscription expiring users
• Purchased subscription expired users
• Trial expiring users
• Trial expired users

Subscription Management:

• Subscription usage
• Unused subscriptions
• Expired subscription
• Purchased subscription
• Trial subscription
• Suspended subscription

AdminDroid’s Office 365 reporting tool offers over 1800 pre-built reports and 30+ interactive dashboards, giving you a comprehensive view of your Office 365 environment. It covers key areas including reporting, auditing, analytics, usage statistics, and security & compliance.

With AdminDroid, you can efficiently manage Exchange Online, SharePoint Online, Microsoft Teams, OneDrive for Business, and more.

Start optimizing your Microsoft 365 management today with AdminDroid. Enjoy a 15-day free trial to see the benefits firsthand. Download AdminDroid now and enhance your SharePoint monitoring and management!

We hope that this blog has provided you with the PowerShell script to retrieve unlicensed users in Microsoft 365, thereby simplifying Microsoft 365 license management. Thanks for reading. If you have any further queries, feel free to reach out to us through the comment section.