๐ณ Recipe ยท Licensing & Cost Optimization
Remove a License from a Microsoft 365 User via Microsoft Graph
Safely unassign a specific SKU from a user account to reclaim licenses and reduce costs
Complexity
Beginner
Impact
licensing + cost-optimization + user-lifecycle + offboarding
Context
Why This Matters
License removal is one of the most common licensing hygiene tasks in Microsoft 365. Admins run this recipe when an employee changes roles, leaves the company, moves to a shared mailbox, or when reclaiming unused SKUs to lower monthly subscription costs.
Unassigning a license frees it in the tenant pool so it can be reassigned to another user without purchasing additional seats. When removing the last productivity license (e.g., Microsoft 365 Business or an E-plan), it also stops provisioning of dependent services such as Exchange Online mailbox, OneDrive, and Teams โ which has data retention implications you should understand before proceeding.
Use this recipe for targeted, single-SKU removals. For full offboarding (block sign-in, convert mailbox, transfer OneDrive, revoke sessions), use the dedicated offboarding recipe.
Expected Outcomes
After completing this recipe you will have:
- Identified the target user's Entra ID object and enumerated every license (SKU) currently assigned.
- Removed a specific SKU from the user while leaving other licenses intact.
- Verified the removal succeeded and confirmed the remaining license state.
- Freed one seat in the tenant's consumed-unit count for that SKU, available for reassignment.
Risks & Considerations
โ ๏ธ Warnings and gotchas
- Data loss risk: Removing the last Exchange-bearing license starts a 30-day grace period, after which the mailbox is permanently deleted. If the user still needs mail archival, convert to a shared mailbox before removing the license.
- OneDrive retention: OneDrive content enters retention (default 30 days) once the last SharePoint-bearing license is removed. Transfer critical files first.
- Group-based licenses: If the license was assigned via a group, direct removal via
assignLicensemay fail or be automatically re-applied. Remove the user from the licensing group instead. - Disabled service plans: Removing the parent SKU also removes any service plans within it. Reassigning later resets service-plan-level customizations.
- Dependent SKUs: Some add-ons (e.g., Teams Phone) require a base license. Removing the base may break the add-on without warning.
- Always confirm the exact
skuIdbefore executing โ SKU part numbers likeO365_BUSINESScan be ambiguous across tenants with legacy naming.
Required Permissions
| Permission | Why It's Needed |
|---|---|
| User.ReadWrite.All | Required to read user objects and modify license assignments via the assignLicense action. |
| Organization.Read.All | Useful for enumerating tenant subscribedSkus to resolve SKU display names from skuId. |
| Directory.Read.All | Alternative read scope for resolving users and SKUs when User.ReadWrite.All is not delegated. |
The fastest way to get this done: just ask Dex. Copy the prompt below and paste it into your Dex conversation.
For IT Admins
Paste into Dex Pro
Remove a license using the Microsoft 365 admin center
- Sign in to the at
https://admin.microsoft.comwith a License Administrator or User Administrator role. - In the left navigation, go to .
- Search for the target user (e.g., {user_displayName}) and click their name to open the user details pane.
- Select the tab.
- Review the list of assigned licenses. Uncheck the box next to the SKU you want to remove (e.g., Microsoft 365 Business Standard).
- Click Save changes at the bottom of the pane.
- Confirm the change by reopening the tab โ the removed SKU should no longer appear checked.
Verifying in the Licenses blade
- Navigate to .
- Select the SKU you just unassigned and confirm the Assigned count decreased by one.
Note: If the user's license shows a ๐ (inherited) icon, the assignment comes from a group. You must remove the user from the licensing group instead of unchecking the SKU.
Remove a license using Microsoft Graph
Step 1 โ Resolve the user's object ID
GET https://graph.microsoft.com/v1.0/users?$filter=startswith(displayName,'{displayName}')&$select=id,displayName,userPrincipalNameExample response:
{
"value": [{
"id": "d4a8b926-9c24-4be5-aa23-2c8711c5aec3",
"displayName": "Jane Doe",
"userPrincipalName": "jane.doe@contoso.com"
}]
}Step 2 โ Enumerate currently assigned licenses
GET https://graph.microsoft.com/v1.0/users/{userId}/licenseDetailsThe response returns each assigned SKU with skuId (GUID) and skuPartNumber (friendly code). Record the skuId you want to remove.
Step 3 โ Remove the license via the assignLicense action
POST https://graph.microsoft.com/v1.0/users/{userId}/assignLicense
Content-Type: application/json
{
"addLicenses": [],
"removeLicenses": ["cdd28e44-67e3-425e-be4c-737fab2899d3"]
}A 200 OK with the updated user object confirms success. To remove multiple SKUs in one call, include multiple GUIDs in the removeLicenses array.
Step 4 โ Verify
GET https://graph.microsoft.com/v1.0/users/{userId}/licenseDetailsConfirm the removed skuId no longer appears in the value array.
Common errors
| Status | Meaning |
|---|---|
403 | Missing User.ReadWrite.All scope โ request consent. |
400 โ UnableToRemoveInheritedLicense | License is inherited from a group; remove the user from the group. |
404 | User ID or SKU ID is incorrect. |
Remove a license using PowerShell
Use the Microsoft.Graph PowerShell SDK. This approach is ideal for scripting bulk removals or integrating with automation runbooks.
Prerequisites
- PowerShell 7.x recommended
Install-Module Microsoft.Graph -Scope CurrentUser- An account with License Administrator or User Administrator role
Quick interactive example
# Connect with the required scope
Connect-MgGraph -Scopes "User.ReadWrite.All","Organization.Read.All"
# Look up the user
$user = Get-MgUser -Filter "userPrincipalName eq 'jane.doe@contoso.com'"
# List current licenses with friendly names
Get-MgUserLicenseDetail -UserId $user.Id |
Select-Object SkuPartNumber, SkuId
# Remove a specific SKU (Microsoft 365 Business)
Set-MgUserLicense -UserId $user.Id \`
-AddLicenses @() \`
-RemoveLicenses @("cdd28e44-67e3-425e-be4c-737fab2899d3")What the script does
- Authenticates to Graph with delegated scopes that allow license writes.
- Resolves the user by UPN, display name, or object ID.
- Enumerates licenses so you can confirm the target SKU ID.
- Calls
Set-MgUserLicenseโ this wraps theassignLicenseGraph action.-AddLicenses @()is required even when only removing. - Verifies the final state by re-running
Get-MgUserLicenseDetail.
For production use, download the full script below, which adds parameter validation, group-assignment detection, dry-run mode, and logging.
Next steps