How-to · Microsoft 365 admin

Assign Microsoft 365 licences to users and groups

At the end every user who needs one will have a Microsoft 365 licence, assigned directly or through group membership, with a usage location set so the assignment succeeds.

Updated 8 steps5 official sources
Before you start

What you need before step 1

Applies to: Microsoft 365, Office 365 and Microsoft Entra ID licences in a commercial tenant (as documented). Not for self-service purchases made by users, which admins cannot assign until they take them over.

Admin roles you need

  • License Administrator or User Administrator to assign licences to users (Microsoft 365 admin center)
  • Groups Administrator, License Administrator or User Administrator to assign licences to a group

Licences

  • Unassigned licences in the subscription you want to use. Check Billing > Licenses for available counts.

Install instructions

Microsoft Graph PowerShell SDK (install instructions)Only for the PowerShell method. Microsoft recommends PowerShell 7 or later on all platforms.https://learn.microsoft.com/graph/powershell/installationOur step-by-step →Install steps

Web portals you will use (nothing to install)

Microsoft 365 admin centerBrowser-based, works on Windows and macOShttps://admin.microsoft.comOpen
Microsoft Entra admin centerUsed here to find group licensing errorshttps://entra.microsoft.comOpen

Also have ready

  • The users already exist (created in the admin center, by CSV import or synced from Active Directory).
  • Each user's usage location as a two-letter ISO 3166-1 country code (for example AU, NZ, GB, US). Microsoft states you cannot assign a licence to an account without one. Some services are not available in every country or region.
  • For group-based licensing: a security group, mail-enabled security group or Microsoft 365 group containing the users directly. Nested groups are not supported; only first-level members get licences.
Step by step

8 steps

  1. 1

    Check available licences

    Where: Microsoft 365 admin center > Billing > Licenses

    Sign in at https://admin.microsoft.com and go to Billing > Licenses. Note how many licences of each product are available.

    You should see: Each subscription is listed with assigned and available counts.
  2. 2

    Set the usage location

    Where: Microsoft 365 admin center (Licenses step when adding a user), or PowerShell 7 on your admin PC

    When you add users in the admin center, the Assign product licenses or Licenses step asks you to select the location. For existing users missing one, find and fix them with Microsoft Graph PowerShell. Connect and sign in as a License or User Administrator.

    Connect-MgGraph -Scopes User.ReadWrite.All, Organization.Read.All
    Get-MgUser -Select Id,DisplayName,UserPrincipalName,UsageLocation,UserType -All | Where-Object { $_.UsageLocation -eq $null -and $_.UserType -eq "Member" }
    Update-MgUser -UserId user@contoso.com -UsageLocation AU
    You should see: The first command lists members with no usage location; after Update-MgUser that user drops off the list.
  3. 3

    Assign a licence to one user

    Where: Microsoft 365 admin center > Users > Active users

    Select the user's row. In the right pane select Licenses and apps, expand Licenses, tick the licences to assign, then select Save changes.

    You should see: The pane confirms the change and the user's Licenses column shows the product.
  4. 4

    Assign licences to several users at once

    Where: Microsoft 365 admin center > Billing > Licenses > select a product

    Select the product, then Assign licenses. In the Assign licenses panel type a user or group name and pick it from the results; you can add up to 20 users or groups at a time. Optionally select Turn apps and services on or off. Select Assign.

    You should see: The users appear in the product's list of assigned users.
  5. 5

    Assign a licence to a group (group-based licensing)

    Where: Microsoft 365 admin center > Billing > Licenses

    Microsoft's current group-based licensing article documents assignment in the Microsoft 365 admin center. Go to Billing > Licenses, select Assign licenses, search for the group and select it, choose the subscription, optionally use Turn apps and services on or off, then select Assign licenses. Users without a usage location inherit the tenant's location for group-based licensing. You can assign to up to 20 groups at a time.

    You should see: The group appears on the product details page and members receive the licence. Large groups take longer.
  6. 6

    Check for group licensing errors

    Where: Microsoft Entra admin center > Billing > Licenses > Overview, or Groups

    Sign in at https://entra.microsoft.com, select Billing > Licenses > Overview. If any group has licensing errors an information box appears; select it to see the groups. You can also open Groups, select the group and select the error notification to see affected users. In the Microsoft 365 admin center the same detail is on the product's Errors & issues tab. Fix the cause, then select the group or user and choose Reprocess.

    You should see: No information box or error notification is shown, and the Errors & issues tab is empty.
  7. 7

    Assign licences with PowerShell

    Where: PowerShell 7 on your admin PC, connected with Connect-MgGraph as above

    List your subscriptions to find the SkuPartNumber (for example SPE_E3 or SPE_E5), then assign. Available licences are ActiveUnits minus WarningUnits minus ConsumedUnits.

    Get-MgSubscribedSku | Select-Object SkuPartNumber, SkuId, ConsumedUnits
    $sku = Get-MgSubscribedSku -All | Where-Object SkuPartNumber -eq "SPE_E3"
    Set-MgUserLicense -UserId user@contoso.com -AddLicenses @{SkuId = $sku.SkuId} -RemoveLicenses @()
    You should see: Set-MgUserLicense returns the user object without errors.
  8. 8

    Move a user from one licence to another

    Where: PowerShell 7 on your admin PC

    Remove the old SKU and add the new one. For group-based licensing, Microsoft's order is: add the user to the new group, confirm the new licence on the user's Licenses page, then remove them from the old group.

    $old = Get-MgSubscribedSku -All | Where-Object SkuPartNumber -eq "SPE_E3"
    $new = Get-MgSubscribedSku -All | Where-Object SkuPartNumber -eq "SPE_E5"
    Set-MgUserLicense -UserId user@contoso.com -AddLicenses @{} -RemoveLicenses @($old.SkuId)
    Set-MgUserLicense -UserId user@contoso.com -AddLicenses @{SkuId = $new.SkuId} -RemoveLicenses @()
    You should see: The user holds only the new licence.
From experience

Expert tips

Fix usage location in bulk before you license anyone

A missing usage location is the most common reason assignment fails. Run the Get-MgUser filter from step 2 across all users, then set the location with Update-MgUser in a loop. Group-based licensing falls back to the tenant's location, which can be wrong for staff in other countries, so set it explicitly for them.

Use group-based licensing to license in waves

Create one security group per migration wave and license the group. Adding a user to the group licenses them; removing them from it takes the licence away. Members must be direct members, because nested groups are not supported. After you fix an error, select Reprocess rather than removing and re-adding the user.

Switch SKUs in one call so users never sit unlicensed

When moving from one plan to another in PowerShell, pass both changes to a single command: Set-MgUserLicense -UserId user@contoso.com -AddLicenses @{SkuId = $new.SkuId} -RemoveLicenses @($old.SkuId). For groups, follow Microsoft's order: add to the new group, confirm the licence, then remove from the old group. Removing a licence first can remove access to data such as the mailbox.

Hold back services you are not ready for

In Assign licenses, Turn apps and services on or off lets you assign the licence now but leave a service plan off until its migration wave. Conflicting service plan errors also come from overlapping plans, so check what a user already holds with Get-MgUserLicenseDetail before adding a second suite.

Count spare licences the way Microsoft does

Available licences are ActiveUnits minus WarningUnits minus ConsumedUnits, not just the purchased total. Check this before a large group assignment, because a group that runs out leaves the remaining members in error with Not enough licenses until you buy more and reprocess. Microsoft gives you 30 days to license an account after creating it, which is your window for migrated mailboxes.

Check it worked

How to confirm it worked

  • In the Microsoft 365 admin center, open Users > Active users, select the user and check Licenses and apps shows the licence.

  • In PowerShell: Get-MgUserLicenseDetail -UserId user@contoso.com | Select-Object SkuPartNumber lists the SKU you assigned.

  • For groups: Billing > Licenses > the product > Errors & issues shows no users.

Undo

How to reverse it

Rollback:

Clear the licence in Licenses and apps and select Save changes, select Unassign on the group's row on the product page, or run Set-MgUserLicense -UserId user@contoso.com -AddLicenses @{} -RemoveLicenses @($sku.SkuId). Warning: removing a licence can remove the user's access to that service's data, such as their mailbox. Back up or convert anything you need first.

Troubleshooting

Errors you might see

An invalid usage location

Cause: The user has no usage location or one where the service is not offered.

Fix: Set UsageLocation with Update-MgUser and assign again, or select Reprocess for group assignments.

Not enough licenses

Cause: The subscription has no unassigned licences left.

Fix: Buy more licences or free some up, then select Reprocess.

Conflicting service plans

Cause: The user already has a licence with a service plan that conflicts with the new one.

Fix: Remove the conflicting licence or turn off the conflicting service plan, then reprocess.

Duplicate proxy addresses

Cause: Another object already uses one of the user's email addresses.

Fix: Remove the duplicate address from the other object, then reprocess.

Add-on licence fails when assigned alone

Cause: Some add-ons need a prerequisite service plan, for example Microsoft Workplace Analytics needs Exchange Online Plan 1 or Plan 2.

Fix: Assign the prerequisite licence in the same group or to the user first.

FAQ

Questions

Why can't I assign a licence to a new user?

The most common reason is a missing usage location. Microsoft states a licence cannot be assigned without it.

Does group-based licensing work with nested groups?

No. Only users who are direct members of the licensed group get the licence.

How long do I have to license a migrated mailbox?

Microsoft gives you 30 days to license a user account after you create it.

Can I assign licences from a self-service purchase?

No. Admins cannot assign licences for a subscription a user bought for themselves until an admin takes over that subscription.

Sources

Official sources

Vendors change menus and requirements. Confirm on the source before you rely on a detail. Last checked 4 Nov 2026.