license assignment status empty

Secure Infrastructure Blog

by the Secure Infrastructure team at Microsoft

Azure License Management with Microsoft Graph

Do you know how many users have a license in your Azure environment? Do you know if they have this license assigned directly or through a group(s) membership? How about duplicate assignments?

One way to answer this is by going to Azure Portal and looking at a user’s license details

Scaling this approach to thousands of users, however, is not ideal. Which is why PowerShell exists to help you administer at scale.

Using PowerShell, we have MSOnline online module (which is decommissioned) and cannot be used with Service Principals for unattended scripts.

A better way is to use Microsoft Graph. See below example,

The output includes a property, LicenseAssignmentStates , which has several entries for each license assignment for a user,

Translating the GUIDs

Starting with the groups, we first want to get the list of groups that are assigning licenses to get their display names.

For the license, we can get the names by going to Product names and service plan identifiers for licensing – Azure AD | Microsoft Docs which offers a helpful CSV that we can utilize.

You can also get the names of the licenses from Graph API by looking at Subscribed SKUs. This is useful as some display names are missing from the CSV and the Display Names are not included in Graph API (upvote here to get it: Include License Display Name in Subscribed SKU – Microsoft Tech Community )

Now, to put it all together, we list each license entry with information about the user and each assignment.

Below is the output as a CSV opened in Excel.

You can even take this step further and build an Azure function that collects this data frequently and visualizes it with a Power BI dashboard

If you want to see how this was built, leave a comment below!

Share this:

• Microsoft Graph

2 thoughts on “ Azure License Management with Microsoft Graph ”

Amazing post! Is it possible to see how you have build it in power BI?

• Pingback: Get Friendly License Name using Microsoft Graph PowerShell SDK in Microsoft 365 | Jeroen Cuijon

Leave a Reply Cancel reply

Discover more from secure infrastructure blog.

Subscribe now to keep reading and get access to the full archive.

Type your email…

Continue reading

You must be logged in to post a comment.

Check Microsoft 365 user license is direct assigned or inherited from group

• Updated on April 1, 2024
• Microsoft 365 , Microsoft Entra

There are two methods to assign a Microsoft 365 license. One way is to assign the license directly, and the other is to add the user to a group linked to the license, known as group-based licensing . The preferable method is group-based licensing because it’s easier to maintain and for auditing purposes. In this article, you will learn how to check if a Microsoft 365 user license is direct assigned or inherited from a group.

Table of contents

Check user license assignment type in microsoft entra admin center, step 1. install microsoft graph powershell, step 2. prepare get-licenseassignment powershell script, step 3. run get-licenseassignment powershell script, step 4. open license assignment report.

To check if the Microsoft 365 user license is direct assigned or inherited from a group in Microsoft Entra admin center, follow the below steps:

• Sign in to Microsoft Entra admin center
• Expand Identity > Billing > Licenses
• Click All products
• Click the Microsoft product name

• Check the column Assignment Paths if the user is direct assigned or inherited from a group

Note: It’s recommended to Assign Microsoft 365 licenses with group-based licensing and not direct so you can manage it easily.

Check user license assignment type with PowerShell

To check if the Microsoft 365 user license is direct assigned or inherited from a group with Microsoft Graph PowerShell, follow these steps:

Run Windows PowerShell as administrator and Install Microsoft Graph PowerShell .

Important: Always install the Microsoft Graph PowerShell and Microsoft Graph Beta PowerShell modules. That’s because some cmdlets are not yet available in the final version, and they will not work. Update both modules to the latest version before you run a cmdlet or script to prevent errors and incorrect results.

Create two folders on the (C:) drive:

Download the Get-LicenseAssignment.ps1 PowerShell script and place it in C:\scripts folder. The script will export the CSV file to the C:\temp folder.

Ensure the file is unblocked to prevent errors when running the script. Read more in the article Not digitally signed error when running PowerShell script .

Another option is to copy and paste the below code into Notepad. Give it the name Get-LicenseAssignment.ps1 and place it in the C:\scripts folder.

• Line 58: Edit the CSV file path

Run the below command to run the script Get-LicenseAssignment.ps1 .

The PowerShell output shows if the license is inherited by a group or is direct assigned.

Note: The output shows if there are multiple groups assigned to a user or if the user has both a license direct assigned and assigned by group. If both are assigned to a user, read the article Remove direct assigned licenses for users with group licenses .

An Out-GridView will show all the information you need.

The Get-LicenseAssignment.ps1 PowerShell script exports all Microsoft 365 users license assignments to CSV file.

Find the file LicenseAssignments.csv in the path C:\temp .

Open the CSV file with your favorite application. In our example, it’s Microsoft Excel.

The Microsoft 365 user license assignment type report looks great.

Read more: Create Microsoft Entra ID Users from CSV with PowerShell »

You learned how to check if the Microsoft 365 user license is direct assigned or inherited from a group. There are two methods to get the details, which is in Microsoft Entra admin center or with the PowerShell script. Both are excellent to retrieve the information.

Did you enjoy this article? You may also like Export Microsoft 365 inactive users report . Don’t forget to follow us and share this article.

ALI TAJRAN is a passionate IT Architect, IT Consultant, and Microsoft Certified Trainer. He started Information Technology at a very young age, and his goal is to teach and inspire others. Read more »

What Others Are Reading

Microsoft Outlook mobile app for iOS and Android is free and excellent. But how does…

The default calendar sharing permissions in Exchange Online are set as AvailabilityOnly. What if you…

How to permanently delete users from Office 365/Microsoft 365? When you remove users from Microsoft…

This Post Has 4 Comments

Thanks Ali, the powershell script, doesn’t show which “MS Product name” is checking. I’ve added $user.AssignedLicenses columns, but doesn’t work. Have you any solution ?

Thanks Ali, I was just looking for something like this. Works perfectly!

Thank you Ali, for the consistency and update you provide. I am always motivated to push more on my Tech career each time I see you post. Great job Man.

Keep pushing, Augustine. You got this!

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

• previous post: How to Setup DNS Aging and Scavenging in Active Directory
• next post: How to Install Microsoft PowerShell PSResourceGet module

Subscribe for Practical 365 updates

Please turn off your ad blocker and refresh the page to subscribe.

You may withdraw your consent at any time. Please visit our Privacy Statement for additional information

Azure Active Directory / Microsoft 365

Microsoft 365 license management for user accounts with the microsoft graph powershell sdk.

Table of Contents

Covering Microsoft 365 License Management Basics

Updated 11-Jul-2023 for Microsoft Graph PowerShell SDK V2

Microsoft’s revised schedule to retire the AzureAD and Microsoft Online Services (MSOL) PowerShell modules gives tenant administrators a little extra time to upgrade scripts before support ceases on March 30, 2024. Time is slipping away to inventory and update license management scripts.

Microsoft’s suggests that tenant use cmdlets from the Microsoft Graph PowerShell SDK to replace those from the two deprecated modules. I show how to approach using the SDK for license management in an example which creates a licensing report for a tenant . It’s evident from the questions I received since and what I see in internet searches that the basics of license assignment and removal needs more discussion and examples, which is what I attempt here.

To start off, connect to the Microsoft Graph using the Connect-MgGraph cmdlet. You need to sign into an administrator account with at least the Directory.Read.All permission to have full access to license information.

Assign a New Microsoft 365 License

The most basic operation is to assign a license to a user account using the Set-MgUserLicense cmdlet. You need to know:

• The UPN or object identifier of the target account.
• The SKU identifier of the product you wish to license for the account. The Get-MgSubscribedSku cmdlet returns the set of products the tenant has subscriptions for (now or at some time in the past). See the article about creating a licensing report for information about how to use this data.

Equipped with this information, we can assign a license. In this case, we’re assigning a Viva Topics license (the SkuID is 4016f256-b063-4864-816e-d818aad600c9).

Note that you must pass a null array in the RemoveLicenses parameter. This applies even if you don’t want the command to remove any licenses.

Table 1 lists some reasons why a license assignment will fail.

If the Set-MgUserLicense cmdlet doesn’t report an error, the license assignment worked (or you attempted to assign a license to an account which it already had). To check, run the Get-MgUser cmdlet to examine the AssignedLicenses property for the account.

Assigning Compound Licenses

Microsoft 365 products can cover a single piece of functionality (like Viva Topics) or they can be a compound product/SKU where a single license covers multiple service plans. Each service plan allows the user to access specific functionality, like Yammer or Planner. Office 365 E3 and E5 are examples of compound SKUs. Microsoft publishes full details of the service plans included in compound SKUs online .

You can assign a license for a compound SKU and remove access to one or more service plans to deny access to that functionality. Educational establishments often do this to limit access to features that they don’t want students to use.

In this example, we assign an Office 365 A1 (student) license to an account with several disabled service plans. The license information is held in a hash table, which is then passed in the AddLicenses parameter for the Set-MgUserLicense cmdlet. Hash tables are commonly used to pass information to SDK cmdlets. The hash table defines:

• The SKU identifier of the compound license (SkuId).
• A list of the identifiers for the service plans to disable (DisabledPlans). This includes Teams (57ff2da0-773e-42df-b2af-ffb7a2317929), Yammer for Education (2078e8df-cff6-4290-98cb-5408261a760a), and Exchange standard (9aaf7827-d63c-4b61-89c3-182f06f82e5c).

Another way of passing the information is to create an array for the service plans you want to disable. In this example, we assign an Office 365 E3 license and disable the Sway and Yammer service plans:

Running Get-MgUser to examine the assigned licenses reveals the disabled service plans.

Another way to see the licenses assigned to an account is with the Get-MgUserLicenseDetail cmdlet:

The disabled service plans are not obvious in the listing, but we can see them by running:

Removing Licenses

To remove licenses, include the license identifiers in an array and pass the array in the RemoveLicenses parameter. This example command removes the two licenses we assigned earlier.

To remove all licenses from an account, create an array of license identifiers from the current set of licenses from the account and pass it as the value of the RemoveLicenses parameter:

Set-MgUserLicense cannot remove a license from an account if the assignment is via group membership .

Assigning Multiple Licenses in One Operation

To add multiple Microsoft 365 licenses in a single operation, create a hash table containing details of the licenses to add and pass the hash table in the BodyParameter parameter for Set-UserMgLicense instead of using the AddLicenses parameter.

As before, you can disable service plans when you assign licenses. In this example, we assign licenses for Enterprise Mobility and Security (EMS) E5 and Viva Topics and disable the Intune plan included in EMS E5.

The same technique can remove multiple licenses in one operation. This command removes the licenses for Power BI (standard) and Viva Topics:

You can combine license assignments and removals in a single command by populating the appropriate data in the hash table.

Finding Users with Licenses

To find accounts assigned a specific license, use a filter with a lambda operator with Get-MgUser . This command finds users assigned an Office 365 E3 license:

Another way is to find all tenant accounts and filter against the AssignedLicenses property:

Being able to search for Microsoft 365 license assignments means that we can create a simple licensing report by looping through the subscribed licenses in the tenant and retrieving the set of accounts which hold each license.

The result is shown in Figure 1.

The Same but Different

Managing Microsoft 365 licenses for Entra ID user accounts using the Microsoft Graph PowerShell SDK follows the same principles as before. Accounts receive product licenses, some of which allow access to multiple service plans. Individual service plans can be disabled. Cmdlets exist to assign and remove licenses, and you can assign or remove multiple licenses in a single operation. The cmdlets and syntax are different, but it shouldn’t be a huge task to move from older MSOL and AzureAD cmdlets to embrace the new paradigm.

About the Author

Tony Redmond

Thank you for your examples, Tony. I am trying to find the best way to export SKU, UPN, Display Name, and Department to one CSV file, but no amount of manipulation gives me the right results. Do you know of the best method to achieve this?

I have seen a lot of examples of how to assign skus and disable service plans, I am yet to see an example on how to enable disabled service plans. I can’t seem to get the right syntax for it.

The Real Person!

When you run Set-MgUserLicense to disable service plans for a license, you pass two values in a hash table to the AddLicenses parameter. One is the product (SKU) id for the license, the other is an array of disabled service plans. To reenable a service plan, run Set-MgUserLicense again after removing its service plan identifier from the array of disabled service plans. All explained in detail in the Office 365 for IT Pros eBook (;-)

Tony, I have looked high and low and cannot find a command that says if you have both SkuId X and SkuId Y assigned to your account, remove the Y license. Is this possible with Graph? Just to clarify, we recently got Microsoft 365 E3 licenses and assigned them via groups. I need to go back and remove the Exchange Online Plan 2 license from their account. Doing this with Graph would probably be the best way to do it, but I can’t seem to find the right commands for it. It may not even be possible but it probably is. Have you seen this type of scenario before?

Seems straightforward enough. Find the users with the Microsoft 365 E3 licenses (SKUId = 05e9a617-0261-4cee-bb44-138d3ef5d965) and check each account to see if they have a separate Exchange Online Plan 2 license (SKUId = 19ec0d23-8335-4cbd-94ac-6050e30712fa). If true, remove the Exchange Online Plan 2. Is that what you want to do?

That’s what I am looking for, so i can do this for 2000 or so users.

Should be quick and easy.

Run Get-MgUser to find the users with the Microsoft 365 E3 license. ForEach user check the AssignedLicenses property to see if Exchange Online Plan 2 is present. If it is, run Set-MgUserLicense to remove the Exchange Online license.

And I am literally running out of the house to the airport else I would write the code… But it is simple enough. You might want to add some logging etc. to track the removals of the licenses. Remember to stop paying Microsoft for the Exchange Online P2 licenses!

I will see if I can figure out how to write this. hopefully with some whatif statements! Thanks!

I remembered that I wrote this article https://practical365.com/switch-microsoft-365-licenses/ about approximately the same situation. Perhaps it will help.

Did you get your licenses reassigned?

I am working on that now! This is a script I wrote that pulls the userid’s from a CSV file. I did it this way because I can run a report to show who has the E3 and the Exchange Online Plan 2 license, and I know for certain I am pulling an EP2 license away from an E3. You just put the userid’s in the CSV file, with the first line being called UserId, and all the lines below are the UPN’s of the users that you want to remove the license from. Not as complex of a script like yours but hey it works!

$users= Import-Csv “C:\temp\userlist.csv” $ep2Sku = Get-MgSubscribedSku -All | Where SkuPartNumber -eq ‘EXCHANGEENTERPRISE’ foreach ($user in $users) { Set-MgUserLicense -UserId $user.userid -RemoveLicenses $ep2Sku.SkuId -AddLicenses @() }

Whatever works… works… that’s the beauty of PowerShell.

I appreciate the help!

Why not simply show how to script the removal of a single or all lics assigned to a departed user?

Here is how I do this using MSOL:

$upn = “someupn” #this is trivial

(get-MsolUser -UserPrincipalName $upn).licenses.AccountSkuId | foreach-object{ Set-MsolUserLicense -UserPrincipalName $upn -RemoveLicenses $_ Set-MsolUser -UserPrincipalName $upn -BlockCredential $true }

This used to work like a charm before Graph.

does anyone here know how to do the exsact same action using Mg-GRaph? Thanks

It’s even easier to remove all the licenses from a user account using the Graph SDK. I’ve updated the post to show how.

Hello Tony,

I find myself in a somewhat complicated situation at my company, and I believe your expertise could be very helpful. We regularly need to make license changes in Microsoft 365, for example, switching from an EOP2 to an M365 E3. The main challenge is managing services during these transitions.

To give you a clearer picture, consider this example: a user currently has the ENTERPRISEPACK license with the BPOS_S_TODO_2 service active. When changing their license to ENTERPRISEPREMIUM, I want to ensure that the equivalent service in the new license remains active, which in this case would be BPOS_S_TODO_3.

Although I can set up a logic to handle these changes based on service nomenclature, this method isn’t entirely accurate or reliable. I wonder if you know of any more robust and precise solution to maintain the equivalence of activated or deactivated services when switching between different Microsoft 365 licenses.

Any guidance or suggestion you could provide would be immensely appreciated.

Thank you for your time and help. Nick Castle

Interesting question. It should be possible to compare the set of service plans for the original SKU with those for the new SKU and figure out matching plans. After that, it’s a matter of making sure to disable the correct service plans when assigning the new license to make sure that you end up with equivalence. I’ll think about this a bit more and see if I can do any better.

Hi Tony, Thanks for the script that is bit helpful to move from MSOL to Graph. I have only one difficulty, how do I get total license count by MS Graph (Previously called “ActiveUnits” in MSOL) ? From your script I can get ConsumedUnits but how do I get ActiveUnit count ? Actually we have Report License script that runs based on MSOL and sends us a report of every product’s name, total license count and consumed unit count – facing difficulity with Graph to get it.

You mean like the code explained in https://office365itpros.com/2023/07/06/microsoft-365-subscriptions-ps/ ?

Wow, Thanks a ton, Tony. I Appreciate your quick response. Your referred link solved my issues with the report. I was actually after this below two lines –

ActiveUnits = $Sku.PrepaidUnits.Enabled WarningUnits = $Sku.PrepaidUnits.Warning

Thank you very much once again. I am converting our legacy MSOL scripts into Graph but as I am not that expert I may come back again for help. Thank you very much.

Amazing what you can find on the internet 😉

can you give the github link to this script

There is no link. There are only code examples.

Hey i need to assign licenses to multiple users , using csv,can give me the scripts for that

Whatever happened to the “new license management platform” announced by Alex Simonds here:

https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/migrate-your-apps-to-access-the-license-managements-apis-from/ba-p/2464366

in which he says: “Group licensing will be extended. In the new licensing platform, Azure AD Premium or Office 365 E3 will no longer be required to use group-based licensing for license assignments”

I asked Alex Simons about this recently. The answer from his team is that work is still ongoing to finalize the new product license management platform. When that’s done, they’ll remove the P1 requirement.

I have a script that pulls from a csv file where I create temp student accounts. I have the script create the account, then change the password, then add office license, then add PBI license. During each license phase assignment every piece of meta information about the account that was assigned a license is displayed. So, student 1 -10 shows me each account meta info and it happens twice since it runs through assigning one license then the other. Below is a snippet of the PBI assignment section (other license assignment section is the same). Looks the same as above in article other than the throttle control statement. Why would all that info be show after each assignment?

#Add Office License $batchCount = 0 Import-Csv -Path .\PbiXX.csv | ForEach-Object { if ($batchCount -eq $batchSize){ Start-Sleep -Seconds $wait $batchCount = 0 } Set-MgUserLicense -UserId “$($_.FirstName)@pbiclass.com” -Addlicenses @{SkuId = ‘3b555118-da6a-4418-894f-7df1e2096870’} -RemoveLicenses @()

$batchCount++ }

Do you mean that you don’t want to see the Set-MgUserLicense cmdlet output anything? If so, just assign the output to a variable:

$Status = Set-MgUserLicense -UserId “$($_.FirstName)@pbiclass.com” -Addlicenses @{SkuId = ‘3b555118-da6a-4418-894f-7df1e2096870’} -RemoveLicenses @()

BTW, I cover bulk assignment in https://practical365.com/bulk-license-assignment-with-the-microsoft-graph-powershell-sdk/

Hi, when I use this command: Set-MgUserLicense -UserId $user.Id -AddLicenses $addLicenses -RemoveLicenses @()

I have this error: Set-MgUserLicense : License assignment failed because service plans 63038b2c-28d0-45f6-bc36-33062963b498,0a4983bb-d3e5-4a09-95d8-b2d0127b3df5 are mutually exclusive Status: 400 (BadRequest)

What’s in $AddLicenses?

What licenses are you attempting to assign?

Hola Tony, una pregunta, como puedo asignar un único tipo de licencia a un listado CSV, tendrás ese ejemplo ? agradezco el apoyo.

I’ve just written a script to read users in from a CSV to assign licenses. I need to add some error handling and I will post the results in an article soon.

https://practical365.com/bulk-license-assignment-with-the-microsoft-graph-powershell-sdk/ is what you need.

Great article! No questions here… everything worked as described. You’re my new hero!

Hi Tony, I’m trying to remove licenses for bulk deleted users, can you help if you have written something?

I just deleted a user account by running Remove-MgUser. The license was removed from the account. Why do you think you need to remove licenses from bulk-deleted users?

Hi Tony, When I checked the deleted users in admin portal I see licenses are tagged against that deleted user hence came the thought, is this expected behavior if you know?

Licenses are noted for deleted accounts so that Microsoft 365 can reassign the license to an account if it is restored. However, once an account is deleted, any licenses it had prior to deletion are available for reassignment.

Can you help me here with error below.

My command.

$CSV = Import-CSV -Path C:\Temp\users5.csv #-Delimiter “;”

ForEach ($Users in $CSV)

Set-MgUserLicense -UserId $User.UserId -AddLicenses @{SkuId = ‘c1821944-af26-46d5-ae15-4f65450761cc_66b55226-6b4f-492c-910c-a3b7a3c9d993’} -RemoveLicenses @()

Here’s the error

Set-MgUserLicense : Cannot convert the literal ‘c1821944-af26-46d5-ae15-4f65450761cc_66b55226-6b4f-492c-910c-a3b7a3c9d993’ to the expected type ‘Edm.Guid’. Status: 400 (BadRequest) ErrorCode: Request_BadRequest Date: 2023-07-28T19:41:51 Headers: Transfer-Encoding : chunked Vary : Accept-Encoding Strict-Transport-Security : max-age=31536000 request-id : 3073e24e-5de4-4928-b509-116c8d0c96d8 client-request-id : e084dd65-ea84-4cb4-8044-9b666aed98bf x-ms-ags-diagnostic : {“ServerInfo”:{“DataCenter”:”South Central US”,”Slice”:”E”,”Ring”:”5″,”ScaleUnit”:”004″,”RoleInstance”:”SA2PEPF0000110C”}} x-ms-resource-unit : 1 Cache-Control : no-cache Date : Fri, 28 Jul 2023 19:41:50 GMT At line:7 char:1

The SKU id that you’re trying to use is not a valid GUID (it’s too long). Where did you get it?

$st = New-Object -TypeName Microsoft.Online.Administration.StrongAuthenticationRequirement $st.RelyingParty = “*” $st.State = “Enforced” $sta = @($st)

Update-MgUser -UserId $line.username -StrongAuthenticationRequirements $sta

I used the above command to enable MFA after creating the account. Please, how can I do it using Update-MgUser?

You can’t enforce MFA using the Update-MgUser cmdlet. This is an acknowledged gap with the Graph (add your comments at https://feedbackportal.microsoft.com/feedback/idea/9b1b2216-9ab2-ed11-a81b-002248519701 ).

Microsoft knows this is an API parity issue and will fix it in time. In the interim, continue using the MSOL cmdlet or (better) enforce MFA using a conditional access policy.

I having issues adding BULK license. How do I do that?

You don’t give enough detail in your question to allow any sort of a reasonable response.

In general, if you want to assign licenses to several accounts, you’d loop through each account and add the license to the account.

Great article! This is extremely helpful, but how you would pull when a license was assigned to an individual? Thanks!

That information isn’t kept with the license data for an account. It is captured in Azure AD “update user” records and you could search for those events in either Azure AD or the Unified audit log and report license assignments that way.

Hello, I am very new to Graph and am having an issue working with Bulk License removals from a CSV user list. In the CSV (header “Users” and the UPNs under) i have the UPN of the users. This is what i am trying to do.

$Users = Import-csv “C:\Removals\removal_audioconferencing.csv” $SkuToRemove = “0c266dff-15dd-4b49-8397-2bb16070ed52” $users |ForEach-Object {Set-MgUserLicense -UserId $Users.id -RemoveLicenses $SkuToRemove -AddLicenses @()}

Do you have the user identifier in the CSV?

Also, $Users.Id refers to the set of values in the Id property of the $Users array.

ForEach ($User in $Users) { Set-MgUserLicense -UserId $User.Id -RemoveLicenses $SkuToRemove -AddLicenses @() }

No the only entry in the CSV is the UPN – Basically i am doing a dump to CSV for the licensed users and want to use that CSV to inject the UserID. Does that need to be the ID now instead of the UPN?

I can use the UPN for a single removal with Set-MgUserLicense -UserId “[email protected]” -RemoveLicenses @($MCOMEETADV.SkuId) -AddLicenses @{}

What’s the column name? Is it ID or something else? Whatever it is, you need to reference the column name in what you feed to Set-MgUserLicense (the identity used can be either the UPN or the object identifier). For instance, if the column name is Id, then it’s Set-MgUserLicense -UserId $User.Id, if it’s UPN, then it’s Set-MgUserLicense -UserId $User.UPN.

If there’s only one value per user in the CSV, then this should work:

ForEach ($User in $Users) { Set-MgUserLicense -UserId $User -RemoveLicenses $SkuToRemove -AddLicenses @() }

That was it Thanks a Bunch!

Hi, Tx for this great read.

What about getting the licenses including the commitment term (NCE) Year/Month.

You provide examples of disabling service plans when assigning licenses. How about an example of a script that ENABLES service plans that the user currently has disabled?

Geez… I have to leave something out that forces people to buy the Office 365 for IT Pros eBook!

In any case, simply omit the service plan identifier from the list of identifiers passed in the DisabledPlan element, and run Set-MgUserLicense again. I just did this by removing a service plan from the $DisabledServicePlans variable shown below and running the command. The removed service plan is reenabled because it is part of the Office 365 E3 product.

$DisabledServicePlans = @(“7547a3fe-08ee-4ccb-b430-5077c5041653”) Office365E3Sku = “6fd2c87f-b296-42f0-b197-1e91e994b900” Set-MgUserLicense -UserId [email protected] -AddLicenses @{SkuId = $Office365E3Sku; DisabledPlans = $DisabledServicePlans} -RemoveLicenses @()

I read this comment, and I went and looked at the book ( https://office365itpros.com/book-versions-and-prices ) and I do not see how or why anyone that does anything more than casual scripting for Office 365 would NOT have this book.

I bought mine! Did not even know you had this out there, I came here for the food…wait…the need to answer a Microsoft Graph and Powershell question for something I was working on…no answer here, but some hints and clues got me there.

Just in case you’re the curios type Tony, Invoke-MgReplyUserMessage is where I landed eventually, and I figured it out, but I still want to know more about this than what I can find about this as well as the other Powershell Graph message send cmdlets (or API wrappers) – like what in the heck is the difference between the message body param and comment!!!!?

Anyway, thanks for the posts here, been following your public posts for a dang long time…makes me feel old long time! end of NT 3.51 and start of NT 4 days…ouch…that hurt to type!

Thanks Daniel. The Office 365 for IT Pros eBook has been around since 2015 and is updated monthly. We just issued monthly update #104. PowerShell is the largest chapter at some 142 pages.

I must admit that Invoke-MgReplyUserMessage is not a cmdlet I am familar with. But like many of the SDK cmdlets, finding out how to use it is a matter of starting with the underlying Graph API and understanding how it has transitioned to a PowerShell cmdlet. That usually helps to identify what parameters are and how they should be passed. In many cases, it ends up as a hash table with keys and values.

And I have been writing about technology for a very long time. I think the first magazine article I had published was in 1986…

Well I could share my script, but it would look horrible here without your authoring tools to clean up the code 🙂

I had >48K email messages that required a somewhat personal and individual reply. I also had to include the original message in the body of the reply as well as an acknowledgement of the specific time that message was received. Also had to reply to them in the order they were received – oldest first to newest last.

Invoke-MgReplyUserMessage in PowerShell clearly does some of the heavy lifting for you – recipient = sender of source message and copy of sent message automatically dropped in the sent items folder: As long as you use the comment instead of the arduous task of building out the message body param, your reply automatically: 1) Will be sent in HTML format. 2) Includes original message in reply message body. The comment can be built out in a variable hash table with HTML4 tags or HTML5 inline CSS and then have that variable = that variable piped to Out-String…now comment: $var and your message body is done. I am not a true developer, so I find looking at the SDK API documentation hard to marry back to PowerShell unless they help me – like the REST API “message: reply” page ( https://learn.microsoft.com/en-us/graph/api/message-reply?view=graph-rest-1.0&tabs=powershell ) shows several code language examples, the syntax shown typically is hint enough for me to go digging, but figuring out how in the world which PowerShell cmdlet does which thing(s) in the Microsoft Graph API is challenging sometimes.

Digging into the PowerShell command yielded little results. Even my long dear friend – I kid you not, this guy knows everything – Google, was stumped 🙂

We’re still in the early days of the Graph and finding examples for little used cmdlets derived from Graph APIs will always be difficult to find. Documentation is getting better, but solid examples covering all situations are still not available.

Leave a Reply Cancel reply

Latest articles.

TEC Special: Microsoft 365’s Darkest Corners & PowerShell Scripting with Tony Redmond & Michel de Rooij – The Practical 365 Podcast S4 E26

This week on the Podcast we are joined by Paul Robichaux - as a guest alongside MVPs Tony Redmond and Michel de Rooij to discuss The Experts Conference (TEC) 2024 in Dallas, Texas!

Practical PowerShell: Output and Logging

In this installment of the Practical PowerShell series, we discuss some of the most common options for output and adding custom logging to your script.

Microsoft Enhances Message Recall for Exchange Online

Microsoft released the initial implementation of a cloud-based message recall feature last year. Now they're back with a set of enhancements to take the rough edges off, like explaining to users why messages disappear from the inbox and enabling support for external services like email hygiene and mail autosignature providers.

• Exchange Online

Get the Reddit app

Europe: 50 (+6) countries, 230 languages, 746M people… 1 subreddit.

Empty shelfs in Moscow Supermarket METRO

By continuing, you agree to our User Agreement and acknowledge that you understand the Privacy Policy .

Enter the 6-digit code from your authenticator app

You’ve set up two-factor authentication for this account.

Enter a 6-digit backup code

Create your username and password.

Reddit is anonymous, so your username is what you’ll go by here. Choose wisely—because once you get a name, you can’t change it.

Reset your password

Enter your email address or username and we’ll send you a link to reset your password

Check your inbox

An email with a link to reset your password was sent to the email address associated with your account

Choose a Reddit account to continue

• Stack Overflow for Teams Where developers & technologists share private knowledge with coworkers
• Advertising & Talent Reach devs & technologists worldwide about your product, service or employer brand
• OverflowAI GenAI features for Teams
• OverflowAPI Train & fine-tune LLMs
• Labs The future of collective knowledge sharing
• About the company Visit the blog

Collectives™ on Stack Overflow

Find centralized, trusted content and collaborate around the technologies you use most.

Q&A for work

Connect and share knowledge within a single location that is structured and easy to search.

Get early access and see previews of new features.

how to filter users by assigned license using ms-graph

I'm trying this request:

But I get this error:

BadRequest - ')' or ',' expected at position 71 in 'assignedLicenses/any(d: d/skuid eq 28d45cd1-ad8b-15cd-a9e1-52e6a5c24328'.

Am I doing anything wrong? is this query possible?

• microsoft-graph-api

4 Answers 4

Just an update that this is now a supported API call. The correct syntax is:

e578b273-6db4-4691-bba0-8d691f4da603 is Faculty A3 SKU in this example

In general, only those properties where the documentation says "supports $filter" can be filtered.

E.g. on the user object, accountEnabled can be filtered.

Since the assignedLicenses property doesn't say it, and the assignedLicense resource type doesn't have it documented on the skuId property, I don't think you can perform that query.

• I could not find such information on the Microsoft Graph documentation developer.microsoft.com/en-us/graph/docs/api-reference/v1.0/… . However I found it on the AzureAD Graph doc msdn.microsoft.com/en-us/Library/Azure/Ad/Graph/api/… . I suppose it's valid in this case. –  Traz Commented Apr 24, 2017 at 18:25
• I don't know of any documentation that states which properties support filtering, only that the "supports $filter" statement is present only on some properties. –  RasmusW Commented Apr 25, 2017 at 5:25
• I think that's poor from MS to not provide a clean API driven way to get report-worthy data. Asking which users have license X for auditing/reporting would be a valid concern from a business perspective. –  peteski Commented May 25, 2017 at 7:42

You can try this one

For more reference: https://learn.microsoft.com/en-us/graph/query-parameters#filter-using-lambda-operators

I tried something similar on "beta" version of GRAPH API. I need to filter by assignedPlan.

https://graph.microsoft.com/beta/users?&$filter=assignedPlans/any(d:d/service eq 'SharePoint')

and this is the error message which I got:

So i guess that there is no option to prefilter users by assignedLicenses or Plan. At least not yet...

• You need to include the consitencylevel eventual header –  sonicbabbler Commented Jan 17, 2023 at 14:40

Your Answer

Reminder: Answers generated by artificial intelligence tools are not allowed on Stack Overflow. Learn more

Sign up or log in

Post as a guest.

Required, but never shown

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy .

Not the answer you're looking for? Browse other questions tagged microsoft-graph-api or ask your own question .

• The Overflow Blog
• At scale, anything that could fail definitely will
• Best practices for cost-efficient Kafka clusters
• Featured on Meta
• Announcing a change to the data-dump process
• Bringing clarity to status tag usage on meta sites
• What does a new user need in a homepage experience on Stack Overflow?
• Feedback requested: How do you use tag hover descriptions for curating and do...
• Staging Ground Reviewer Motivation

Hot Network Questions

• Fill the grid with numbers to make all four equations true
• Calculating area of intersection of two segmented polygons in QGIS
• Do all instances of a given string get replaced under a rewrite rule?
• If a Palestinian converts to Judaism, can they get Israeli citizenship?
• Can it be acceptable to take over CTRL + F shortcut in web app
• Can Christian Saudi Nationals Visit Mecca?
• Is loss of availability automatically a security incident?
• Does it make sense for the governments of my world to genetically engineer soldiers?
• Does proficiency with an ability check that uses a tool but not with the tool itself give any advantages for D&D 5.24?
• What does "if you ever get up this way" mean?
• Is it a date format of YYMMDD, MMDDYY, and/or DDMMYY?
• Using ON-ON switch instead of ON-OFF switch?
• Can a British judge convict and sentence someone for contempt in their own court on the spot?
• Whats the safest way to store a password in database?
• How would humans actually colonize mars?
• Are all citizens of Saudi Arabia "considered Muslims by the state"?
• Does a representation of the universal cover of a Lie group induce a projective representation of the group itself?
• Unable to upgrade from Ubuntu Server 22.04 to 24.04.1
• The state of the art on topological rings - the Jacobson topology
• Light switch that is flush or recessed (next to fridge door)
• "The earth was formless and void" Did the earth exist before God created the world?
• Geometry nodes: Curve caps horizontal
• In roulette, is the frequency of getting long sequences of reds lower than that of shorter sequences?
• Why are poverty definitions not based off a person's access to necessities rather than a fixed number?

This browser is no longer supported.

Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.

Microsoft 365 Apps activation error: "You currently have not been assigned an office license that includes the Office desktop apps"

• 4 contributors
• Applies to: Microsoft 365

When you try to activate Microsoft 365 apps, you encounter the error message:

You currently have not been assigned an office license that includes the Office desktop apps.

Try the following troubleshooting methods to solve the problem.

Note Some of these troubleshooting methods can only be performed by a Microsoft 365 admin. If you aren't an admin, see How do I find my Microsoft 365 admin?

• Go to the Microsoft 365 portal: https://portal.office.com/account/?ref=MeControl#installs
• If you see the message "You currently have not been assigned an Office license that includes the Office desktop apps" this means that you aren't eligible to install Microsoft 365 Apps.
• If you see "Office" listed with an "Install Office" button, you're eligible for Microsoft 365 Apps.

Go to https://portal.office.com/account to check which Office version and edition you have available.

If no Office version is shown, you don't have an Office license assigned to the account you're signed in with. If you're signed in with your Work or School account, and don't have a license assigned, contact your Microsoft 365 Administrator to get a license assigned. How do I find my Microsoft 365 admin?

If you have Microsoft 365 for Business Basic, you won't have any Office applications to install. You can use Office Online apps at https://office.com .

Make sure that the version listed (32-bit or 64-bit) matches your version of Windows. To check what version of Windows you have installed, go to Start > Settings (gear icon) > System > About , and check the System type .

If you have a different edition or version installed on your device, run the SaRA package to uninstall Office. Restart the device, and install from https://portal.office.com/account to get the correct version.

• Open an Office app, such as Word.
• Select your name and profile picture or icon at the top.
• Select Sign out .
• Select Sign in .
• Make sure you're signed in with your Work or School account, not your personal Microsoft account.
• Try activating Microsoft 365 again.
• In the Microsoft 365 Admin Center , go to the Users > Active users page.
• Select the row of the user that you want to assign a license to.
• In the right pane, select Licenses and Apps .
• Expand the Licenses section, select the boxes for the licenses that you want to assign, then select Save changes .
• If the license is already assigned, uncheck it, select Save changes , then check it again and select Save changes again.
• A Microsoft 365 admin needs to go to https://admin.microsoft.com/Adminportal/Home?source=applauncher#/users
• Make sure necessary sublicenses are checked. For example, if Microsoft 365 Apps for Enterprise is checked, make sure the Office 365 sublicense is checked.
• Open a browser in InPrivate mode (Microsoft Edge) or Incognito mode (Google Chrome) and go to https://office.com .
• Install Microsoft 365 Apps and try to activate.
• Try or buy a Microsoft 365 for business subscription
• Assign licenses to users
• Add users and assign licenses at the same time

Was this page helpful?

Additional resources