Assign Microsoft 365 licences to users and groups
At the end every user who needs one will have a Microsoft 365 licence, assigned directly or through group membership, with a usage location set so the assignment succeeds.
What you need before step 1
Applies to: Microsoft 365, Office 365 and Microsoft Entra ID licences in a commercial tenant (as documented). Not for self-service purchases made by users, which admins cannot assign until they take them over.
Admin roles you need
- License Administrator or User Administrator to assign licences to users (Microsoft 365 admin center)
- Groups Administrator, License Administrator or User Administrator to assign licences to a group
Licences
- Unassigned licences in the subscription you want to use. Check Billing > Licenses for available counts.
Install instructions
https://learn.microsoft.com/graph/powershell/installationOur step-by-step →Install stepsWeb portals you will use (nothing to install)
https://admin.microsoft.comOpenhttps://entra.microsoft.comOpenAlso have ready
- The users already exist (created in the admin center, by CSV import or synced from Active Directory).
- Each user's usage location as a two-letter ISO 3166-1 country code (for example AU, NZ, GB, US). Microsoft states you cannot assign a licence to an account without one. Some services are not available in every country or region.
- For group-based licensing: a security group, mail-enabled security group or Microsoft 365 group containing the users directly. Nested groups are not supported; only first-level members get licences.
8 steps
- 1
Check available licences
Where: Microsoft 365 admin center > Billing > LicensesSign in at
https://admin.microsoft.comand go to Billing > Licenses. Note how many licences of each product are available.You should see: Each subscription is listed with assigned and available counts. - 2
Set the usage location
Where: Microsoft 365 admin center (Licenses step when adding a user), or PowerShell 7 on your admin PCWhen you add users in the admin center, the Assign product licenses or Licenses step asks you to select the location. For existing users missing one, find and fix them with Microsoft Graph PowerShell. Connect and sign in as a License or User Administrator.
Connect-MgGraph -Scopes User.ReadWrite.All, Organization.Read.All Get-MgUser -Select Id,DisplayName,UserPrincipalName,UsageLocation,UserType -All | Where-Object { $_.UsageLocation -eq $null -and $_.UserType -eq "Member" } Update-MgUser -UserId user@contoso.com -UsageLocation AUYou should see: The first command lists members with no usage location; after Update-MgUser that user drops off the list. - 3
Assign a licence to one user
Where: Microsoft 365 admin center > Users > Active usersSelect the user's row. In the right pane select Licenses and apps, expand Licenses, tick the licences to assign, then select Save changes.
You should see: The pane confirms the change and the user's Licenses column shows the product. - 4
Assign licences to several users at once
Where: Microsoft 365 admin center > Billing > Licenses > select a productSelect the product, then Assign licenses. In the Assign licenses panel type a user or group name and pick it from the results; you can add up to 20 users or groups at a time. Optionally select Turn apps and services on or off. Select Assign.
You should see: The users appear in the product's list of assigned users. - 5
Assign a licence to a group (group-based licensing)
Where: Microsoft 365 admin center > Billing > LicensesMicrosoft's current group-based licensing article documents assignment in the Microsoft 365 admin center. Go to Billing > Licenses, select Assign licenses, search for the group and select it, choose the subscription, optionally use Turn apps and services on or off, then select Assign licenses. Users without a usage location inherit the tenant's location for group-based licensing. You can assign to up to 20 groups at a time.
You should see: The group appears on the product details page and members receive the licence. Large groups take longer. - 6
Check for group licensing errors
Where: Microsoft Entra admin center > Billing > Licenses > Overview, or GroupsSign in at
https://entra.microsoft.com, select Billing > Licenses > Overview. If any group has licensing errors an information box appears; select it to see the groups. You can also open Groups, select the group and select the error notification to see affected users. In the Microsoft 365 admin center the same detail is on the product's Errors & issues tab. Fix the cause, then select the group or user and choose Reprocess.You should see: No information box or error notification is shown, and the Errors & issues tab is empty. - 7
Assign licences with PowerShell
Where: PowerShell 7 on your admin PC, connected with Connect-MgGraph as aboveList your subscriptions to find the
SkuPartNumber(for exampleSPE_E3orSPE_E5), then assign. Available licences are ActiveUnits minus WarningUnits minus ConsumedUnits.Get-MgSubscribedSku | Select-Object SkuPartNumber, SkuId, ConsumedUnits $sku = Get-MgSubscribedSku -All | Where-Object SkuPartNumber -eq "SPE_E3" Set-MgUserLicense -UserId user@contoso.com -AddLicenses @{SkuId = $sku.SkuId} -RemoveLicenses @()You should see: Set-MgUserLicense returns the user object without errors. - 8
Move a user from one licence to another
Where: PowerShell 7 on your admin PCRemove the old SKU and add the new one. For group-based licensing, Microsoft's order is: add the user to the new group, confirm the new licence on the user's Licenses page, then remove them from the old group.
$old = Get-MgSubscribedSku -All | Where-Object SkuPartNumber -eq "SPE_E3" $new = Get-MgSubscribedSku -All | Where-Object SkuPartNumber -eq "SPE_E5" Set-MgUserLicense -UserId user@contoso.com -AddLicenses @{} -RemoveLicenses @($old.SkuId) Set-MgUserLicense -UserId user@contoso.com -AddLicenses @{SkuId = $new.SkuId} -RemoveLicenses @()You should see: The user holds only the new licence.
Expert tips
A missing usage location is the most common reason assignment fails. Run the Get-MgUser filter from step 2 across all users, then set the location with Update-MgUser in a loop. Group-based licensing falls back to the tenant's location, which can be wrong for staff in other countries, so set it explicitly for them.
Create one security group per migration wave and license the group. Adding a user to the group licenses them; removing them from it takes the licence away. Members must be direct members, because nested groups are not supported. After you fix an error, select Reprocess rather than removing and re-adding the user.
When moving from one plan to another in PowerShell, pass both changes to a single command: Set-MgUserLicense -UserId user@contoso.com -AddLicenses @{SkuId = $new.SkuId} -RemoveLicenses @($old.SkuId). For groups, follow Microsoft's order: add to the new group, confirm the licence, then remove from the old group. Removing a licence first can remove access to data such as the mailbox.
In Assign licenses, Turn apps and services on or off lets you assign the licence now but leave a service plan off until its migration wave. Conflicting service plan errors also come from overlapping plans, so check what a user already holds with Get-MgUserLicenseDetail before adding a second suite.
Available licences are ActiveUnits minus WarningUnits minus ConsumedUnits, not just the purchased total. Check this before a large group assignment, because a group that runs out leaves the remaining members in error with Not enough licenses until you buy more and reprocess. Microsoft gives you 30 days to license an account after creating it, which is your window for migrated mailboxes.
How to confirm it worked
In the Microsoft 365 admin center, open Users > Active users, select the user and check Licenses and apps shows the licence.
In PowerShell:
Get-MgUserLicenseDetail -UserId user@contoso.com | Select-Object SkuPartNumberlists the SKU you assigned.For groups: Billing > Licenses > the product > Errors & issues shows no users.
How to reverse it
Clear the licence in Licenses and apps and select Save changes, select Unassign on the group's row on the product page, or run Set-MgUserLicense -UserId user@contoso.com -AddLicenses @{} -RemoveLicenses @($sku.SkuId). Warning: removing a licence can remove the user's access to that service's data, such as their mailbox. Back up or convert anything you need first.
Errors you might see
An invalid usage locationCause: The user has no usage location or one where the service is not offered.
Fix: Set UsageLocation with Update-MgUser and assign again, or select Reprocess for group assignments.
Not enough licensesCause: The subscription has no unassigned licences left.
Fix: Buy more licences or free some up, then select Reprocess.
Conflicting service plansCause: The user already has a licence with a service plan that conflicts with the new one.
Fix: Remove the conflicting licence or turn off the conflicting service plan, then reprocess.
Duplicate proxy addressesCause: Another object already uses one of the user's email addresses.
Fix: Remove the duplicate address from the other object, then reprocess.
Add-on licence fails when assigned aloneCause: Some add-ons need a prerequisite service plan, for example Microsoft Workplace Analytics needs Exchange Online Plan 1 or Plan 2.
Fix: Assign the prerequisite licence in the same group or to the user first.
Questions
Why can't I assign a licence to a new user?
The most common reason is a missing usage location. Microsoft states a licence cannot be assigned without it.
Does group-based licensing work with nested groups?
No. Only users who are direct members of the licensed group get the licence.
How long do I have to license a migrated mailbox?
Microsoft gives you 30 days to license a user account after you create it.
Can I assign licences from a self-service purchase?
No. Admins cannot assign licences for a subscription a user bought for themselves until an admin takes over that subscription.
Official sources
Vendors change menus and requirements. Confirm on the source before you rely on a detail. Last checked 4 Nov 2026.