Find Licensed Groups in Microsoft 365 Using PowerShell

Nowadays, admins prefer assigning licenses via groups to cut down on manual errors and save time. However, effective license management is crucial to optimize license costs. You can use the Microsoft 365 admin center or PowerShell to track groups that auto-assign licenses.

To identify group-based license assignments in the Microsoft 365 admin center,

1. Sign in to the Microsoft 365 admin center.
2. Navigate to Billing –> Licenses –> Subscriptions.
3. Select the required Microsoft product license.
4. Under the ‘Groups’ pivot, you can find the list of groups that have been assigned with respective licenses.

While the Microsoft 365 admin center provides a way to view which groups are assigned with licenses, the process comes with its own set of challenges. The UI does not display the number of users assigned a license through that specific group. It also makes it hard to check disabled plans or license assignment errors without extensive navigation. This can make large-scale license management frustrating and time-consuming.

To address these pain points and simplify Microsoft 365 license management, we’ve developed a PowerShell script that provides a comprehensive view of licensed groups. This script streamlines the process, making it easier to track licenses without the hassle of manual checking.

Download Script: FindGroupsWithLicense

• This script allows you to export groups with Microsoft 365 licenses in the organization.
• Helps to identify the friendly name of licenses assigned to a group.
• The script uses MS Graph PowerShell and installs MS Graph PowerShell SDK (if not installed already) upon your confirmation.
• Exports the report result to CSV.
• The script can be executed with an MFA enabled account too.
• It can be executed with certificate-based authentication (CBA) too.
• The script is schedular-friendly.

This script helps admins identify Microsoft Entra groups with assigned licenses with the following attributes:

• Group Display Name
• Description
• Assigned Licenses
• Friendly Name of Assigned Licenses
• Disabled Services
• Group User Count Total
• Member Count
• Owner Count
• Users With License Assignment Error
• State
• Assigned License SKUs
• Group Id

The exported groups with Microsoft 365 licenses will look like the screenshot below.

To run this script, you can choose any of the methods given below.

Method 1: Execute the script with MFA and non-MFA accounts.

This script will report groups that auto-assign licenses in the Microsoft 365 environment into CSV. Failing to monitor Microsoft 365 licensed groups can result in duplicate license assignments within the organization.

Method 2: Run the script using certificate-based authentication.

You also have the option to run the script using certificate-based authentication. When you want to run the script unattended, you can choose this method. To use certificates, you must register an app in Microsoft Entra that helps you connect to Graph using certificate.

Note: As this script is schedular friendly, you can schedule this script using Task schedular or Azure Automation.

In addition to licensed groups, we have also curated a PowerShell script to export group-based license assignment of users into a CSV file. The script generates a list of all users and their inherited licenses, detailing which group assigns each license. Additionally, it provides the license status and highlights any assignment errors, making it easier to troubleshoot group-license assignment issues.

Note: If your organization uses both direct and group-based licensing, you can check the Microsoft 365 license assignment path to identify how each user receives their license.

Group-Based License Assignment Report – Sample Output:

If you come across licensed users who haven’t logged in for a long time, you can remove the user from the group. Entra ID will automatically revoke the associated licenses inherited through groups from those Microsoft 365 inactive users’ accounts.

Managing Microsoft 365 licenses can feel overwhelming, especially with PowerShell’s complexity, which demands intricate scripting and constant maintenance. Thankfully, there’s an easier option!

AdminDroid provides a robust, free Office 365 license reporting tool that simplifies the process with insightful dashboards and over 120 detailed reports. These free license reports are neatly organized into categories like:

Users and Licenses

• Licensed users
• Unlicensed users
• Regainable licenses
• Users with specific/free/trial subscription

Audit License Changes

• Audit license assignment
• Audit license removal

License Expiry

• Purchased subscription expiring/expired users
• Trial-expiring & expired users
• Users with suspended subscription

Subscription

• Subscription usage report
• Expired subscription
• Unused subscription
• Purchased subscription
• Trial subscription

In addition to this, with over 1,800 ready-made reports and 30+ interactive dashboards, AdminDroid Office 365 reporting tool offers a highly visual and intuitive approach to your Office 365 environment. AdminDroid delivers comprehensive solutions for monitoring and managing your Microsoft 365 environment, including security and compliance tracking, user analytics, audit logs, and alerting. Download AdminDroid now to enhance your management capabilities!

We hope that this blog has helped you find licensed groups in Microsoft 365. If you have any further queries, feel free to reach out to us through the comment section.