Assign Microsoft 365 Licenses to Users with MS Graph PowerShell

In the Microsoft 365 license management series, this blog will explore various scenarios for assigning licenses to Microsoft 365 users.

With the retirement of legacy license assignment cmdlets like ‘Set-MsolUserLicense‘ and ‘Set-AzureADUserLicense,’ administrators have transitioned to different methods. These include:

• Assigning licenses through the admin portal
• Using the Graph API for license assignments
• Employing MS Graph PowerShell

While the admin portal may not be ideal for bulk license assignments, and the Graph API can be challenging—especially for admins less familiar with web development and API usage. Hence, this blog focuses on a user-friendly approach. It provides PowerShell scripts to assign licenses to Microsoft 365 users using MS Graph PowerShell SDK.

We’ve curated use cases considering various real-time scenarios. The scenarios include:

• Assign Microsoft 365 license to a user
• Assign multiple M365 licenses to a user
• Assign license(s) to bulk users (input CSV)
• Copy M365 license from one user to another
• Assign license with disabled plans
• Assign Microsoft 365 license to external users
• Assign Microsoft 365 license to a group

Note: You can also download the dedicated MS Graph PowerShell script to perform 10+ Microsoft 365 license management tasks, covering license assignment, removal, and reporting.

As part of the M365 onboarding process, employees require access to essential Microsoft 365 services like Exchange Online, SharePoint, and Teams. To streamline this, administrators can utilize the following code snippet to assign the necessary license to a user.

To identify the SkuId of a specific license, you can use the ‘Get-MgSubscribedSku’ cmdlet.

The above example retrieves the SkuId of the E3 license. You can use this SkuId to assign the E3 license to a user.
For example,

Microsoft 365 offers a variety of license plans, each providing access to specific services and applications. In situations where users need access to multiple services, administrators should assign multiple licenses efficiently to make sure users have the right tools for their roles.

When you want to assign bulk Microsoft 365 licenses to a user, you can use the below cmdlet.

For example,

The above code assigns Flow_Free and E5 licenses to the user John.

Note: You can retrieve license plans and their expiry dates information before assigning licenses to users for better planning.

Manually assigning licenses for each user can be time-consuming, especially in larger organizations. To assign multiple Office 365 licenses to a bulk of users, you need to prepare a CSV file containing users’ identities and run the code below.

Copying a license doesn’t mean transferring it from one user to another. This feature becomes handy when you want to assign the same set of licenses to another team member, especially someone who has recently joined.

To identify the user whose license needs to be copied, obtain details about Microsoft 365 users and their assigned licenses. Once you have these details, proceed with the code below.

For example,

Here, John’s assigned licenses are copied to Lisa. There may also be times when you need to quickly allocate licenses to unlicensed users, such as when new team members join. In such scenarios, having a script to list unlicensed users can be particularly helpful.

Often, admins want to disable access to specific Microsoft 365 services either these services are outdated, or the organization already relies on different software for that purpose. In such cases, admins can assign Microsoft 365 licenses with disabled plans. When the plans are disabled, users can’t access those services.

To disable service plans when assigning license to users, you can use the script below.

For example, the code below disables Yammer plan (Viva Engage) from E3 license using MS Graph PowerShell.

The given example assigns an E3 license and blocks Yammer access to John.

Note: You can refer to this MS doc to know more about the subscription name and associated service plan details.

As organizations increasingly engage with external partners, vendors, or clients, providing them with the necessary M365 licenses becomes essential for seamless collaboration. To assign license to an external user in Microsoft 365, you can choose any of the methods described in the blog.

For example, to assign a license to a guest user, run the below cmdlet.

The above code assigns an E3 license to the external user Mark from the Fabrikam organization.

Group-based license management simplifies the process of assigning licenses to users by allowing administrators to assign licenses based on group membership rather than individual users. This is particularly beneficial in large organizations with numerous users. Also, it’d be useful when you want to assign licenses to users based on their roles and requirements.

When you assign one or more licenses to a group, those licenses will be assigned to all members of the group. To perform group-based license assignment, you can use the Set-MgGroupLicense cmdlet.

For example,

In the GroupId, you need to pass the GUID of the group. To find the group id, you can use the Get-MgGroup cmdlet.

After assigning licenses to users via a group, you need to monitor them to ensure that only authorized groups and their members have access. The easiest way to do this is to rely on the PowerShell script that exports all group-based licensing assignments of Office 365 users.

Note: Sometimes, license mistakes can occur with group-based licensing for Exchange Online mailboxes. In such cases, Microsoft’s delicensing resiliency extends a grace period of up to 60 days, helping prevent data loss from these accidental license removals.

1. Set-MgUserLicense: License assignment cannot be done for user with invalid usage location.
Reason: When you assign a Microsoft 365 license to a user whose usage location is invalid or not set, you will get the above error.
Solution: In such cases, you can set the usage location for the Microsoft 365 user using the below cmdlet.

2. Set-MgUserLicense: Insufficient privileges to complete the operation.
Reason: Even if you are a global admin, you might encounter the above error when you try to connect to Microsoft Graph PowerShell without the required scope.
Solution: You must specify the scope correctly in order to perform the license assignment without any error.

• To perform user-based license assignment, connect to MS Graph using the below scope.

• To perform group-based license assignment, use the below scope.

3. User license is inherited from a group membership, and it cannot be removed directly from the user.
Reason: When attempting to switch from a group-based license to a user-based license or when removing a license from a user, you may encounter this error. You cannot directly remove licenses that a user inherits from a group.
Solution: You must remove the user from the group that serves as the source of the inherited license. You can also use the M365 user license assignment path report to compare licenses assigned directly vs via group to take necessary actions.

4. CountViolation – Not enough licenses.
Reason: When you automate license assignment through group-based licensing, you might face this error. This issue arises when there are not enough licenses available for one of the products included in the group.
Solution: You can buy more licenses for the product or reclaim unused licenses from other users or groups.

5. MutuallyExclusiveViolation – Conflicting service plans.
Reason: Certain service plans are designed to be mutually exclusive, preventing simultaneous assignment to the same user.
For example, Earlier Exchange Online Plan 1 and Plan 2 were unique and couldn’t be assigned to the same user. However, there has been a recent change allowing for duplication.
Solution: The administrator must decide which one to assign and which one to remove.

There are a few more errors like ‘DependencyViolation,’ ‘ProhibitedInUsageLocationViolation,’ ’One or more errors occurred’, etc. Even if you encounter any other errors, share them with us, and we will guide you with the solution.

Suppose, you are a newbie to PowerShell and feels like it is hard to grab the cmdlets, scripts, and errors, you can assign licenses to bulk users using the Microsoft365DSC tool.

When it comes to license assignment, it can be accomplished with just one or two lines of PowerShell code. However, license reporting is a different story, requiring a block of code to generate the report in the required format. To bridge this gap, AdminDroid offers a Free Microsoft 365 reporting tool to get reports in desired formats. It offers a handful of dashboards and 120+ free Office 365 reports including comprehensive license reports. Below are some of the M365 license reports available under the free category.

Users and licenses reports

• Licensed users
• Unlicensed users
• Regainable licenses
• Users with specific subscription
• Users with free & trial subscription

Audit license changes

• Audit license assignment
• Audit license removal

License expiry reports

• Purchased subscription expiring users
• Purchased subscription expired users
• Trial expiring & expired users
• Users with suspended subscription

Subscription reports

• Subscription usage report
• Expired subscription
• Unused subscription
• Purchased subscription
• Trial subscription

Additionally, AdminDroid provides 1800+ pre-built reports and 30+ dashboards to know more about your Microsoft environment at a glance. Download AdminDroid now and witness effortless Microsoft 365 management.

I hope this blog will guide you on various Microsoft 365 license assignment scenarios. Microsoft also introduced the Entra License utilization portal, which allows you to view Entra license usage and the usage of key features associated with the license type. Additionally, Microsoft plans to include the usage of other SKUs in this portal. With this, you can manage all your Entra licenses effectively. If you have any other requirements, reach us through the comment section. We are happy to assist you.