๐ณ Recipe ยท Licensing & Cost Optimization
Check Assigned M365 Licenses for a User
Quickly identify which Microsoft 365 licenses and service plans are assigned to a specific user.
Complexity
Beginner
Impact
read-only + licensing + help-desk + user-lookup + low-risk
Context
Why This Matters
End users frequently ask IT which Microsoft 365 plan they are on โ usually because a feature is missing (Teams Phone, Power BI, Copilot, Project, Visio) or because they're trying to install an Office app and the download isn't offered. Before troubleshooting, administrators need a definitive answer to the question: what licenses does this account actually have assigned right now?
This recipe shows three ways to retrieve the list of Microsoft 365 (Entra ID) licenses assigned to a single user: through the Microsoft 365 admin center GUI, through the Microsoft Graph API, and through PowerShell. Use it for help desk tickets, license audits, pre-migration checks, or to confirm that a group-based licensing assignment actually landed on a user.
Expected Outcomes
After completing this recipe you will have:
- A list of every SKU (license) assigned to the target user, with friendly names.
- Visibility into whether the license was assigned directly or inherited from a group.
- The enabled and disabled service plans within each license (e.g., whether Teams or Exchange is turned on within an E3).
- The user's usage location โ required before any license can be assigned.
Risks & Considerations
Read-only operation โ low risk. That said, keep these in mind:
- SKU IDs vs. friendly names: The API returns GUIDs like
6fd2c87f-b296-42f0-b197-1e91e994b900(ENTERPRISEPACK = Office 365 E3). Always translate to friendly names before sharing with end users. Microsoft publishes the mapping at learn.microsoft.com/entra/identity/users/licensing-service-plan-reference. - Group-based licensing: If
assignedByGroupis populated, removing the user's direct license won't work โ you must change group membership or the group's license assignment. - Privacy: License data is considered user attribute data. Only query accounts you are authorized to support.
- Do not use this recipe as evidence of feature availability for compliance workloads (e.g., eDiscovery, Purview) without also checking role assignments and service plan state.
Required Permissions
| Permission | Why It's Needed |
|---|---|
| User.Read.All | Required to read another user's profile, including assignedLicenses and assignedPlans. |
| Directory.Read.All | Needed to resolve group-based license assignments (assignedByGroup references). |
| Organization.Read.All | Allows enumeration of tenant SKUs so GUIDs can be translated to friendly names. |
The fastest way to get this done โ just ask Dex. Copy the prompt below and paste it into your Dex conversation.
For IT Admins
Paste into Dex CoAdmin
For End Users
How an employee would ask Dex for help