💳 Recipe · Licensing & Cost Optimization
Check Assigned M365 Licenses for a User
Quickly identify which Microsoft 365 licenses and service plans are assigned to a specific user.
Complexity
Beginner
Impact
read-only + licensing + help-desk + user-lookup + low-risk
Context
Why This Matters
End users frequently ask IT which Microsoft 365 plan they are on — usually because a feature is missing (Teams Phone, Power BI, Copilot, Project, Visio) or because they're trying to install an Office app and the download isn't offered. Before troubleshooting, administrators need a definitive answer to the question: what licenses does this account actually have assigned right now?
This recipe shows three ways to retrieve the list of Microsoft 365 (Entra ID) licenses assigned to a single user: through the Microsoft 365 admin center GUI, through the Microsoft Graph API, and through PowerShell. Use it for help desk tickets, license audits, pre-migration checks, or to confirm that a group-based licensing assignment actually landed on a user.
Expected Outcomes
After completing this recipe you will have:
- A list of every SKU (license) assigned to the target user, with friendly names.
- Visibility into whether the license was assigned directly or inherited from a group.
- The enabled and disabled service plans within each license (e.g., whether Teams or Exchange is turned on within an E3).
- The user's usage location — required before any license can be assigned.
Risks & Considerations
Read-only operation — low risk. That said, keep these in mind:
- SKU IDs vs. friendly names: The API returns GUIDs like
6fd2c87f-b296-42f0-b197-1e91e994b900(ENTERPRISEPACK = Office 365 E3). Always translate to friendly names before sharing with end users. Microsoft publishes the mapping at learn.microsoft.com/entra/identity/users/licensing-service-plan-reference. - Group-based licensing: If
assignedByGroupis populated, removing the user's direct license won't work — you must change group membership or the group's license assignment. - Privacy: License data is considered user attribute data. Only query accounts you are authorized to support.
- Do not use this recipe as evidence of feature availability for compliance workloads (e.g., eDiscovery, Purview) without also checking role assignments and service plan state.
Required Permissions
| Permission | Why It's Needed |
|---|---|
| User.Read.All | Required to read another user's profile, including assignedLicenses and assignedPlans. |
| Directory.Read.All | Needed to resolve group-based license assignments (assignedByGroup references). |
| Organization.Read.All | Allows enumeration of tenant SKUs so GUIDs can be translated to friendly names. |
The fastest way to get this done: just ask Dex. Copy the prompt below and paste it into your Dex conversation.
For IT Admins
Paste into Dex Pro
For End Users
How an employee would ask Dex for help
Check a user's licenses in the Microsoft 365 admin center
- Sign in to as a User Administrator, License Administrator, or Global Reader.
- In the left navigation, go to .
- Search for the user by display name or UPN and click their row to open the flyout.
- Select the tab.
- Review the Licenses section — every checked box is an assigned SKU. A small Inherited tag next to a license indicates it came from group-based licensing.
- Expand Apps to see which service plans (Teams, Exchange, SharePoint, Intune, Copilot, etc.) are enabled or disabled within each SKU.
- For a richer view, go to , open a specific SKU, and use Assigned licenses to confirm the user appears there.
For deeper detail (assignment date, group source GUID), use the Entra admin center: .
Read assigned licenses via Microsoft Graph
Use the /users/{id} endpoint and request the license-related properties. Graph requires you to explicitly $select assignedLicenses and assignedPlans.
Request
GET https://graph.microsoft.com/v1.0/users/{userPrincipalName}?$select=id,displayName,userPrincipalName,usageLocation,assignedLicenses,assignedPlans,licenseAssignmentStates
Authorization: Bearer {access_token}Sample response (trimmed)
{
"id": "8a9...",
"displayName": "Jane Doe",
"userPrincipalName": "jane@contoso.com",
"usageLocation": "US",
"assignedLicenses": [
{ "skuId": "6fd2c87f-b296-42f0-b197-1e91e994b900", "disabledPlans": [] }
],
"licenseAssignmentStates": [
{
"skuId": "6fd2c87f-b296-42f0-b197-1e91e994b900",
"assignedByGroup": "d21a...",
"state": "Active"
}
]
}Translate SKU GUIDs to friendly names
Call the subscribed SKUs endpoint once and build a lookup map:
GET https://graph.microsoft.com/v1.0/subscribedSkus?$select=skuId,skuPartNumberThen map each skuId from the user to its skuPartNumber (e.g., ENTERPRISEPACK, SPE_E5, Microsoft_365_Copilot).
Notes
assignedLicensesgives the raw assignment.licenseAssignmentStatestells you how (direct vs. group) and whether it's in error.- If the user has
usageLocation: null, licenses cannot be assigned until it is set.
Check licenses with the Microsoft Graph PowerShell SDK
The legacy MSOnline and AzureAD modules are deprecated. Use Microsoft.Graph.
- Install the module (once per machine):
Install-Module Microsoft.Graph -Scope CurrentUser - Connect with the minimum required scopes:
Connect-MgGraph -Scopes "User.Read.All","Organization.Read.All" - Retrieve the user and their license assignment states:
$user = Get-MgUser -UserId "jane@contoso.com" ` -Property Id,DisplayName,UserPrincipalName,UsageLocation,AssignedLicenses,LicenseAssignmentStates $user.AssignedLicenses - Translate GUIDs to friendly names:
$skuMap = Get-MgSubscribedSku | Select-Object SkuId,SkuPartNumber $user.AssignedLicenses | ForEach-Object { $sku = $skuMap | Where-Object SkuId -eq $_.SkuId [pscustomobject]@{ Sku = $sku.SkuPartNumber; DisabledPlans = $_.DisabledPlans.Count } }
Use the downloadable script below for a hardened, parameterized version that prints a clean table including direct vs. group-inherited assignments.
Next steps