💳 Recipe · Licensing & Cost Optimization
List Available Microsoft 365 License SKUs and Usage in a Tenant
Enumerate subscribed SKUs, consumed units, and available seats across your tenant
Complexity
Beginner
Impact
read-only + audit + licensing + cost-optimization
Context
Why This Matters
Understanding what licenses your tenant owns — and how many are actually in use — is the foundation of sound license management. Microsoft 365 tenants accumulate SKUs over time: trials, add-ons, E3/E5 bundles, Power BI, Teams Phone, Defender, and more. Without periodic inventory, it is easy to over-purchase, miss expiring trials, or leave unassigned seats sitting idle.
Run this recipe when you need to:
- Audit license utilization before a renewal or true-up conversation with your reseller.
- Find unused seats to reclaim before buying more.
- Map friendly product names to the cryptic SKU part numbers (e.g.
SPE_E3= Microsoft 365 E3). - Produce a quick snapshot report for finance, compliance, or leadership.
Expected Outcomes
After completing this recipe you will have:
- A complete list of every SKU your tenant is subscribed to.
- For each SKU: the total
prepaidUnits(purchased),consumedUnits(assigned to users), and calculated available seats. - The
skuId(GUID) andskuPartNumberneeded for downstream automation (assignment, group-based licensing, reporting). - An optional CSV export suitable for sharing with finance or procurement.
Risks & Considerations
This is a read-only operation, but keep the following in mind:
- Permissions: The Graph endpoint requires
Organization.Read.All. Attempting the call without consent returns HTTP 403 — Insufficient privileges. - Part numbers are not friendly names.
SPE_E3,ENTERPRISEPACK, andSTANDARDPACKare examples — refer to Microsoft's product names and service plan identifiers reference for translation. - Suspended vs. warning units:
prepaidUnitsincludesenabled,suspended, andwarningcounts. Onlyenabledseats are assignable. Do not treat the total as available capacity. - Do not share raw output externally. SKU IDs are not secrets, but tenant license posture can be considered sensitive commercial information.
Required Permissions
| Permission | Why It's Needed |
|---|---|
| Organization.Read.All | Required to read tenant-wide subscription and SKU information via the subscribedSkus endpoint. |
| Directory.Read.All | Alternative scope that also grants read access to subscribedSkus; useful if Organization.Read.All is not available in your consent policy. |
The fastest way to get this done: just ask Dex. Copy the prompt below and paste it into your Dex conversation.
For IT Admins
Paste into Dex Pro
List licenses via the Microsoft 365 Admin Center
- Sign in to https://admin.microsoft.com as a Global Reader, License Administrator, or Global Administrator.
- In the left navigation, expand .
- The Licenses page displays every SKU your tenant owns with three columns:
- Assigned — seats in use (equivalent to
consumedUnits). - Available — unassigned seats.
- Total — purchased seats (equivalent to
prepaidUnits.enabled).
- Assigned — seats in use (equivalent to
- Click any SKU name to drill into individual users assigned that license.
- Use Export (top-right) to download the full list as CSV.
Alternative: Microsoft Entra admin center
- Go to https://entra.microsoft.com.
- Navigate to .
- The same SKU inventory is shown, with the additional ability to view group-based licensing assignments.
List SKUs with the Microsoft Graph API
The subscribedSkus endpoint returns every SKU the tenant has purchased or been assigned.
Request
GET https://graph.microsoft.com/v1.0/subscribedSkus
Authorization: Bearer <access_token>Example response (truncated)
{
"value": [
{
"id": "<tenantId>_c7df2760-2c81-4ef7-b578-5b5392b571df",
"skuId": "c7df2760-2c81-4ef7-b578-5b5392b571df",
"skuPartNumber": "ENTERPRISEPREMIUM",
"appliesTo": "User",
"capabilityStatus": "Enabled",
"consumedUnits": 42,
"prepaidUnits": {
"enabled": 50,
"suspended": 0,
"warning": 0
},
"servicePlans": [ ... ]
}
]
}Key fields
skuId— GUID used to assign/remove this license.skuPartNumber— human-ish identifier (e.g.ENTERPRISEPREMIUM= M365 E5).consumedUnits— seats currently assigned.prepaidUnits.enabled— seats available for assignment. Available = enabled - consumedUnits.servicePlans[]— individual service plans (Exchange, Teams, SPO, etc.) bundled into the SKU.
Permission errors
If you receive HTTP 403 — Insufficient privileges to complete the operation, the calling identity has not consented to Organization.Read.All. Grant admin consent in Entra → App registrations → API permissions, then retry.
List licenses with Microsoft Graph PowerShell
The Microsoft.Graph module provides Get-MgSubscribedSku, a thin wrapper over the Graph endpoint.
Prerequisites
# One-time install
Install-Module Microsoft.Graph -Scope CurrentUser
# Connect with the required scope
Connect-MgGraph -Scopes "Organization.Read.All"Basic query
Get-MgSubscribedSku |
Select-Object SkuPartNumber, SkuId,
@{N='Purchased';E={$_.PrepaidUnits.Enabled}},
ConsumedUnits,
@{N='Available';E={$_.PrepaidUnits.Enabled - $_.ConsumedUnits}} |
Sort-Object SkuPartNumber |
Format-Table -AutoSizeExport to CSV
Get-MgSubscribedSku |
Select-Object SkuPartNumber, SkuId,
@{N='Purchased';E={$_.PrepaidUnits.Enabled}},
ConsumedUnits,
@{N='Available';E={$_.PrepaidUnits.Enabled - $_.ConsumedUnits}} |
Export-Csv -Path .\tenant-licenses.csv -NoTypeInformationThe downloadable script below wraps this logic with parameters, friendly-name translation for the most common SKUs, and optional CSV export.
Next steps