๐Ÿ’ณ Recipe ยท Licensing & Cost Optimization

Remove a License from a Microsoft 365 User via Microsoft Graph

Safely unassign a specific SKU from a user account to reclaim licenses and reduce costs

Complexity

Beginner

Impact

licensing + cost-optimization + user-lifecycle + offboarding

Context

Why This Matters

License removal is one of the most common licensing hygiene tasks in Microsoft 365. Admins run this recipe when an employee changes roles, leaves the company, moves to a shared mailbox, or when reclaiming unused SKUs to lower monthly subscription costs.

Unassigning a license frees it in the tenant pool so it can be reassigned to another user without purchasing additional seats. When removing the last productivity license (e.g., Microsoft 365 Business or an E-plan), it also stops provisioning of dependent services such as Exchange Online mailbox, OneDrive, and Teams โ€” which has data retention implications you should understand before proceeding.

Use this recipe for targeted, single-SKU removals. For full offboarding (block sign-in, convert mailbox, transfer OneDrive, revoke sessions), use the dedicated offboarding recipe.

Expected Outcomes

After completing this recipe you will have:

  • Identified the target user's Entra ID object and enumerated every license (SKU) currently assigned.
  • Removed a specific SKU from the user while leaving other licenses intact.
  • Verified the removal succeeded and confirmed the remaining license state.
  • Freed one seat in the tenant's consumed-unit count for that SKU, available for reassignment.

Risks & Considerations

โš ๏ธ Warnings and gotchas

  • Data loss risk: Removing the last Exchange-bearing license starts a 30-day grace period, after which the mailbox is permanently deleted. If the user still needs mail archival, convert to a shared mailbox before removing the license.
  • OneDrive retention: OneDrive content enters retention (default 30 days) once the last SharePoint-bearing license is removed. Transfer critical files first.
  • Group-based licenses: If the license was assigned via a group, direct removal via assignLicense may fail or be automatically re-applied. Remove the user from the licensing group instead.
  • Disabled service plans: Removing the parent SKU also removes any service plans within it. Reassigning later resets service-plan-level customizations.
  • Dependent SKUs: Some add-ons (e.g., Teams Phone) require a base license. Removing the base may break the add-on without warning.
  • Always confirm the exact skuId before executing โ€” SKU part numbers like O365_BUSINESS can be ambiguous across tenants with legacy naming.

Required Permissions

PermissionWhy It's Needed
User.ReadWrite.AllRequired to read user objects and modify license assignments via the assignLicense action.
Organization.Read.AllUseful for enumerating tenant subscribedSkus to resolve SKU display names from skuId.
Directory.Read.AllAlternative read scope for resolving users and SKUs when User.ReadWrite.All is not delegated.

The fastest way to get this done โ€” just ask Dex. Copy the prompt below and paste it into your Dex conversation.

For IT Admins

Paste into Dex CoAdmin

Remove the {sku_name} license from {user}. First show me their current license assignments so I can confirm the right SKU, then unassign it and verify the removal.
Try in Dex CoAdmin