Microsoft 365 Licensing

Microsoft 365 Licensing

Overview

M365 licensing is a top billing concern for MSPs. Licenses are purchased as SKU subscriptions, each containing bundles of service plans (Exchange, Teams, SharePoint, etc.). Efficient license management — finding unused seats, rightsizing SKUs, ensuring all users have what they need — directly impacts both the MSP's margin and the customer's costs.

Anti-triggers

Assigning a seat and buying a seat are different systems, and the word "license" covers both:

• Buying, cancelling, or repricing subscriptions — changing what the tenant owns happens at the distributor, not in Graph. subscribedSkus only reports what was already purchased. Use pax8 (pax8-subscriptions), sherweb, or cipp for CSP licences.
• License cost, margin, or invoice reconciliation — commercial data lives with the distributor and in the PSA contract, not in Entra; use pax8 (pax8-invoices) or the finance-pack.
• A licence audit across every customer tenant — use the cipp plugin (cipp-licenses).
• Reading seat utilisation without changing assignments — the vetted query catalogue answers this without composing a $filter; use the microsoft-graph plugin's microsoft-graph-querying skill.

Core Concepts

Subscription → SKU → Service Plans

M365 Business Premium (subscription)
  └── GUID: cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46
       ├── Exchange Online (service plan)
       ├── Microsoft Teams (service plan)
       ├── SharePoint Online (service plan)
       ├── Intune (service plan)
       └── Entra ID P1 (service plan)

License States

Graph API Patterns

Get All SKUs Available in Tenant

GET /v1.0/subscribedSkus?$select=skuPartNumber,skuId,consumedUnits,prepaidUnits,servicePlans

Response:

{
  "value": [
    {
      "skuPartNumber": "SPE_E3",
      "skuId": "05e9a617-0261-4cee-bb44-138d3ef5d965",
      "consumedUnits": 42,
      "prepaidUnits": {
        "enabled": 50,
        "suspended": 0,
        "warning": 0
      },
      "servicePlans": [...]
    }
  ]
}

Available seats = prepaidUnits.enabled - consumedUnits

Get All Users With Their Assigned Licenses

GET /v1.0/users?$select=id,displayName,userPrincipalName,accountEnabled,assignedLicenses,usageLocation&$top=999

Find Users With a Specific License

Filter by SKU GUID:

GET /v1.0/users?$filter=assignedLicenses/any(x:x/skuId eq cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46)&$select=id,displayName,userPrincipalName,accountEnabled

Find Unlicensed Users

GET /v1.0/users?$filter=assignedLicenses/$count eq 0&$count=true&$select=id,displayName,userPrincipalName,accountEnabled

Requires ConsistencyLevel: eventual header and $count=true

Assign a License to a User

POST /v1.0/users/{userId}/assignLicense
Content-Type: application/json

{
  "addLicenses": [
    {
      "skuId": "cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46",
      "disabledPlans": []
    }
  ],
  "removeLicenses": []
}

usageLocation must be set on the user before assigning. Use PATCH /v1.0/users/{id} with "usageLocation": "US" first.

Remove a License from a User

POST /v1.0/users/{userId}/assignLicense
Content-Type: application/json

{
  "addLicenses": [],
  "removeLicenses": ["cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46"]
}

Disable Specific Service Plans (Partial License)

Assign a license but disable specific plans (e.g., give E3 without Teams):

POST /v1.0/users/{userId}/assignLicense
Content-Type: application/json

{
  "addLicenses": [
    {
      "skuId": "05e9a617-0261-4cee-bb44-138d3ef5d965",
      "disabledPlans": ["57ff2da0-773e-42df-b2af-ffb7a2317929"]
    }
  ],
  "removeLicenses": []
}

License Audit Workflow

Step 1: Inventory Available SKUs

Pull subscribedSkus and calculate:

• Total purchased per SKU
• Consumed seats
• Available seats
• SKUs in warning state (near renewal, overallocated)

Step 2: Cross-Reference With Active Users

Find licenses assigned to disabled accounts — these are reclaim candidates:

GET /v1.0/users?$filter=accountEnabled eq false and assignedLicenses/$count ne 0&$count=true&$select=id,displayName,userPrincipalName,assignedLicenses

Step 3: Find Inactive Licensed Users

Users licensed but not signing in (90+ days):

GET /v1.0/users?$filter=accountEnabled eq true&$select=id,displayName,userPrincipalName,assignedLicenses,signInActivity

Filter results where signInActivity.lastSignInDateTime < (today - 90 days).

Step 4: Produce Optimization Report

Common SKU GUIDs Reference

Error Handling

Permissions Required

Related Skills

• M365 Users - User management and usageLocation
• M365 Security - License impact on security features (P1/P2)
• M365 API Patterns - Advanced filter, count queries