Remove Direct Licenses for Group-Licensed Users in Microsoft 365

Nowadays, many organizations are shifting towards group-based licensing to simplify Microsoft 365 license management and reduce redundancy. This approach assigns licenses to users automatically based on their membership in licensed groups, making it easier to manage large number of users. However, problems arise if a user is assigned the same license both directly and inherited from a group. It creates unnecessary duplication and increased administrative overhead.

For example, when offboarding a Microsoft 365 user, you might remove them from all relevant groups, expecting that their licenses will be revoked automatically. But if that user was also assigned a license directly, they would still have access to Microsoft 365 services even after being removed from the group. This not only leads to confusion but also wastes valuable resources, as you’re paying for a license that should have been freed up.

To effectively manage your licenses and avoid these issues, it’s important to review and remove any direct license assignments before you prioritize group-based licensing!

Starting September 1, 2024, all license management will be centralized in the Microsoft 365 admin center. Although you can still view license assignments and paths in Entra ID, the removal of direct licenses must now be done through the Microsoft 365 admin center.

Here’s how to remove licenses in Microsoft 365 admin center,

Before this process, you must look into license assignment path in Entra admin center to check if users have direct, inherited, or both types of assignments.

1. Sign in to the Microsoft 365 admin center.
2. Navigate to Billing –> Licenses –> Subscriptions.
3. Select the required Microsoft product license.
4. Under ‘Users’ pivot, select the users with direct licenses one by one.
5. Select ‘Unassign licenses’.
6. Confirm by clicking Unassign to remove direct license assignment.

You will get confirmation that you have unassigned licenses in a few seconds.

Challenges:

Juggle Between Multiple Portals: To identify duplicate license assignments, you need to use the Entra admin center, but to remove a license, you’ll need to switch back to the M365 admin center.

Manual Effort: You will need to manually find users with direct licenses and remove them, which is error-prone and time-consuming.

To address these challenges, we have developed a PowerShell script that reports users with overlapping direct and group-based license assignments and removes direct licenses from Microsoft 365 users. This script enables you to delete direct licenses with just a few clicks.

Download Script: DirectLicenseCleanup

• This script generates reports on users with overlapping direct & group-based license assignments.
• The script removes direct assigned license(s) if the same license inherited via groups too.
• This script installs MS Graph PowerShell SDK (if not installed already) upon your confirmation.
• The script can be executed with an MFA-enabled account too.
• The script is schedular-friendly.
• It can be executed with certificate-based authentication (CBA) too.

The script generates two output files: one with a detailed report on Microsoft 365 users who have overlapping direct and group-based licenses, and another with a log documenting the removal of duplicate direct licenses.

1. Users with Overlapping License Report

Report attributes include:

• Display Name
• UPN
• Directly Assigned Licenses
• Group Based Licenses
• Duplicate License(s)
• Duplicate License Count
• Friendly Name of Directly Assigned Licenses
• Friendly Name of Group Based Licenses
• Account Status

2. Direct License Removal Log File

1. Download the script.
2. Start the Windows PowerShell.
3. Select any of the methods provided to execute the script.

Method 1: You can run the script with MFA and non-MFA accounts.

To delete directly assigned licenses for users with group licenses, run the following.

The script will list users who have the same license assigned via both direct licensing and groups. Then the script will remove the duplicate direct licenses from Microsoft 365 users.

Note – Additionally, if licensed users have not logged in for an extended period, you can remove the user from the group. Entra ID will automatically revoke the associated licenses inherited through groups from those Microsoft 365 inactive users’ accounts.

Method 2: Run the script using certificates-based authentication.

To use certificates, you must register the app in Entra which helps to connect to MS Graph using certificate.

Note – Depending on your requirements, you can create a self-signed certificate.

This method is schedular-friendly. When you want to run the script unattended, you can choose this method. To bypass license removal confirmation, include –Force param while schedule the script.

Take advantage of the script’s preset filtering options designed for various scenarios. Here’s how to use them effectively.

• Generate users with duplicate licenses in Microsoft 365
• Bulk removal of direct licensing in Microsoft 365

Tip: Regular review of cost spent on users’ licenses also help optimize license usage across the organization.

The general property of this script is to delete direct licensing for users who also have group licenses, following confirmation. However, if you only want to generate a report of Microsoft 365 duplicate licenses without having them removed, use the following command with the –GenerateReportOnly parameter.

This report details license assignments in Microsoft 365, including duplicate licenses and the license assignment path, showing if a license is assigned directly or through a group.

When you schedule the script using Task Schedular or Azure Automation, the confirmation prompt must be bypassed to allow the script to run without manual interaction. In this case, use the –Force parameter to automate direct license removals without requiring confirmation.

This approach saves time and ensures smooth, error-free execution of license removals.

Managing Microsoft 365 licenses can be overwhelming. While PowerShell is useful, it often involves complex scripting and ongoing maintenance. Fortunately, there’s a simpler solution!

AdminDroid offers a powerful, no-cost Office 365 license reporting tool that delivers license usage insights through smart dashboards and 120+ comprehensive reports. Free license reports in AdminDroid are categorized based on,

Users and licenses

• Licensed users
• Unlicensed users
• Regainable licenses
• Users with specific/free/trial subscription

Audit license changes

• Audit license assignment
• Audit license removal

License expiry

• Purchased subscription expiring/expired users
• Trial-expiring & expired users
• Users with suspended subscription

Subscription reports

• Subscription usage report
• Expired subscription
• Unused subscription
• Purchased subscription
• Trial subscription

Additionally, AdminDroid Office 365 reporting tool provides 1800+ pre-built and 30+ smart visually appealing dashboards to know your Office 365 environment at a glance. This tool provides reports on Microsoft 365 reporting, auditing, analytics, alerting, usage statistics, security & compliance, etc. Download AdminDroid and transform your Microsoft 365 management experience!

We hope that this blog has helped you find and eliminate overlapping direct licenses for users with group assignments, thereby simplifying the Microsoft 365 license management. If you have any further queries, feel free to reach out to us through the comment section.