Assign Microsoft 365 licenses to user accounts with PowerShell
- 4 minutes to read
This article applies to both Microsoft 365 Enterprise and Office 365 Enterprise.
Users can't use any Microsoft 365 services until their account has been assigned a license from a licensing plan. You can use PowerShell to quickly assign licenses to unlicensed accounts.
Note
User accounts must be assigned a location. You can do this from the properties of a user account in the Microsoft 365 admin center or from PowerShell.
Use the Azure Active Directory PowerShell for Graph module
First, connect to your Microsoft 365 tenant.
Next, list the license plans for your tenant with this command.
Get-AzureADSubscribedSku | Select SkuPartNumber
Next, get the sign-in name of the account to which you want add a license, also known as the user principal name (UPN).
Next, ensure that the user account has a usage location assigned.
Get-AzureADUser -ObjectID <user sign-in name (UPN)> | Select DisplayName, UsageLocation
If there is no usage location assigned, you can assign one with these commands:
$userUPN="<user sign-in name (UPN)>"
$userLoc="<ISO 3166-1 alpha-2 country code>"
Set-AzureADUser -ObjectID $userUPN -UsageLocation $userLoc
Finally, specify the user sign-in name and license plan name and run these commands.
$userUPN="<user sign-in name (UPN)>"
$planName="<license plan name from the list of license plans>"
$License = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicense
$License.SkuId = (Get-AzureADSubscribedSku | Where-Object -Property SkuPartNumber -Value $planName -EQ).SkuID
$LicensesToAssign = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicenses
$LicensesToAssign.AddLicenses = $License
Set-AzureADUserLicense -ObjectId $userUPN -AssignedLicenses $LicensesToAssign
Use the Microsoft Azure Active Directory Module for Windows PowerShell
First, connect to your Microsoft 365 tenant.
Run the Get-MsolAccountSku command to view the available licensing plans and the number of available licenses in each plan in your organization. The number of available licenses in each plan is ActiveUnits - WarningUnits - ConsumedUnits. For more information about licensing plans, licenses, and services, see View licenses and services with PowerShell.
Note
PowerShell Core does not support the Microsoft Azure Active Directory Module for Windows PowerShell module and cmdlets with Msol in their name. To continue using these cmdlets, you must run them from Windows PowerShell.
To find the unlicensed accounts in your organization, run this command.
Get-MsolUser -All -UnlicensedUsersOnly
You can only assign licenses to user accounts that have the UsageLocation property set to a valid ISO 3166-1 alpha-2 country code. For example, US for the United States, and FR for France. Some Microsoft 365 services aren't available in certain countries. For more information, see About license restrictions.
To find accounts that don't have a UsageLocation value, run this command.
Get-MsolUser -All | where {$_.UsageLocation -eq $null}
To set the UsageLocation value on an account, run this command.
Set-MsolUser -UserPrincipalName "<Account>" -UsageLocation <CountryCode>
For example:
Set-MsolUser -UserPrincipalName "belindan@litwareinc.com" -UsageLocation US
If you use the Get-MsolUser cmdlet without using the -All parameter, only the first 500 accounts are returned.
Assigning licenses to user accounts
To assign a license to a user, use the following command in PowerShell.
Set-MsolUserLicense -UserPrincipalName "<Account>" -AddLicenses "<AccountSkuId>"
This example assigns a license from the litwareinc:ENTERPRISEPACK (Office 365 Enterprise E3) licensing plan to the unlicensed user belindan@litwareinc.com:
Set-MsolUserLicense -UserPrincipalName "belindan@litwareinc.com" -AddLicenses "litwareinc:ENTERPRISEPACK"
To assign a license to all unlicensed users, run this command.
Get-MsolUser -All -UnlicensedUsersOnly [<FilterableAttributes>] | Set-MsolUserLicense -AddLicenses "<AccountSkuId>"
Note
You can't assign multiple licenses to a user from the same licensing plan. If you don't have enough available licenses, the licenses are assigned to users in the order that they're returned by the Get-MsolUser cmdlet until the available licenses run out.
This example assigns licenses from the litwareinc:ENTERPRISEPACK (Office 365 Enterprise E3) licensing plan to all unlicensed users:
Get-MsolUser -All -UnlicensedUsersOnly | Set-MsolUserLicense -AddLicenses "litwareinc:ENTERPRISEPACK"
This example assigns those same licenses to unlicensed users in the Sales department in the United States:
Get-MsolUser -All -Department "Sales" -UsageLocation "US" -UnlicensedUsersOnly | Set-MsolUserLicense -AddLicenses "litwareinc:ENTERPRISEPACK"
Move a user to a different subscription (license plan) with the Azure Active Directory PowerShell for Graph module
First, connect to your Microsoft 365 tenant.
Next, get the sign-in name of the user account for which you want switch subscriptions, also known as the user principal name (UPN).
Next, list the subscriptions (license plans) for your tenant with this command.
Get-AzureADSubscribedSku | Select SkuPartNumber
Next, list the subscriptions that the user account currently has with these commands.
$userUPN="<user account UPN>"
$licensePlanList = Get-AzureADSubscribedSku
$userList = Get-AzureADUser -ObjectID $userUPN | Select -ExpandProperty AssignedLicenses | Select SkuID
$userList | ForEach { $sku=$_.SkuId ; $licensePlanList | ForEach { If ( $sku -eq $_.ObjectId.substring($_.ObjectId.length - 36, 36) ) { Write-Host $_.SkuPartNumber } } }
Identify the subscription the user currently has (the FROM subscription) and the subscription to which the user is moving (the TO subscription).
Finally, specify the TO and FROM subscription names (SKU part numbers) and run these commands.
$subscriptionFrom="<SKU part number of the current subscription>"
$subscriptionTo="<SKU part number of the new subscription>"
# Unassign
$license = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicense
$licenses = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicenses
$license.SkuId = (Get-AzureADSubscribedSku | Where-Object -Property SkuPartNumber -Value $subscriptionFrom -EQ).SkuID
$licenses.AddLicenses = $license
Set-AzureADUserLicense -ObjectId $userUPN -AssignedLicenses $licenses
$licenses.AddLicenses = @()
$licenses.RemoveLicenses = (Get-AzureADSubscribedSku | Where-Object -Property SkuPartNumber -Value $subscriptionFrom -EQ).SkuID
Set-AzureADUserLicense -ObjectId $userUPN -AssignedLicenses $licenses
# Assign
$license.SkuId = (Get-AzureADSubscribedSku | Where-Object -Property SkuPartNumber -Value $subscriptionTo -EQ).SkuID
$licenses = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicenses
$licenses.AddLicenses = $License
Set-AzureADUserLicense -ObjectId $userUPN -AssignedLicenses $licenses
You can verify the change in subscription for the user account with these commands.
$licensePlanList = Get-AzureADSubscribedSku
$userList = Get-AzureADUser -ObjectID $userUPN | Select -ExpandProperty AssignedLicenses | Select SkuID
$userList | ForEach { $sku=$_.SkuId ; $licensePlanList | ForEach { If ( $sku -eq $_.ObjectId.substring($_.ObjectId.length - 36, 36) ) { Write-Host $_.SkuPartNumber } } }
See also
Manage user accounts, licenses, and groups with PowerShell