How to Assign Microsoft 365 Licenses to Users

Assigning a Microsoft 365 license sounds like a two-click job, and for a single new hire it basically is. The complications show up at scale: a department of forty people, a license that fails to apply for no obvious reason, or a user who somehow has the same product assigned twice and you can’t remove it. Knowing the few rules behind licensing turns those head-scratchers into quick fixes.

This guide covers the three ways you’ll actually assign licenses — the admin center, group-based licensing, and PowerShell/Graph — plus the usage location requirement that trips people up, how to read a license conflict, and how to remove a license without losing the user’s data by accident.

Assigning a license in the admin center#

For one or a handful of users, the Microsoft 365 admin center is the fastest route.

1. Go to the Microsoft 365 admin center → Users → Active users.
2. Select the user (or tick several to assign in bulk).
3. Open the Licenses and apps tab.
4. Pick the location if prompted, tick the license(s) to assign, and optionally expand Apps to turn individual service plans on or off.
5. Save.

When you assign interactively like this, the admin center sets the usage location for you based on the tenant or your selection, which is why direct assignment “just works” while scripts sometimes don’t.

Group-based licensing: the scalable way#

Assigning licenses one user at a time doesn’t hold up past a small team. Group-based licensing (managed in Entra ID) solves it: you assign the license to a security group, and every member inherits it automatically. Add someone to the group and they get the license; remove them and it’s revoked. New hires get fully licensed the moment they land in the right group.

To set it up:

1. In the Entra admin center, go to Billing → Licenses (or Groups then the licensing blade).
2. Select the license, choose Assign, and pick the security group.
3. Configure which service plans are enabled for that group.
4. Save. Entra processes the membership and applies the license to each member.

Group-based licensing also surfaces errors cleanly. If a member can’t be licensed — no seats left, a service plan conflict, missing usage location — Entra flags that group/user combination with the reason, so you can find and fix problem accounts instead of discovering them one support ticket at a time.

Don’t forget usage location#

This is the setting that quietly breaks scripted assignments. Microsoft 365 restricts some services by country, so Entra requires a usage location on the account before it will assign certain licenses. Assign through the admin center UI and it’s handled for you. Assign through PowerShell or Graph and you often have to set it first, or the call fails.

# Microsoft Graph PowerShell SDK
Connect-MgGraph -Scopes "User.ReadWrite.All", "Organization.Read.All"

# Set usage location (ISO 3166-1 alpha-2 country code, e.g. US, GB, DE)
Update-MgUser -UserId "[email protected]" -UsageLocation "GB"

Assigning licenses with PowerShell and Graph#

For bulk work, automation, or onboarding scripts, PowerShell is the tool. The older MSOnline (MsolUser) and AzureAD modules are deprecated — use the Microsoft Graph PowerShell SDK going forward.

The Graph approach uses SKU part numbers. First find the SKU you want to assign:

Connect-MgGraph -Scopes "Organization.Read.All"

# List the SKUs in your tenant with their IDs and available seats
Get-MgSubscribedSku | Select-Object SkuPartNumber, SkuId, `
  @{N='Consumed';E={$_.ConsumedUnits}}, `
  @{N='Enabled';E={$_.PrepaidUnits.Enabled}}

Then assign it. Set-MgUserLicense takes the SKU ID in its AddLicenses parameter:

Connect-MgGraph -Scopes "User.ReadWrite.All", "Organization.Read.All"

$user = "[email protected]"
$sku  = (Get-MgSubscribedSku | Where-Object SkuPartNumber -eq "SPE_E3").SkuId

# Usage location must be set first (see earlier) or this can fail
Set-MgUserLicense -UserId $user `
  -AddLicenses @{ SkuId = $sku } `
  -RemoveLicenses @()

To assign to many users, loop over a list or a CSV:

$sku = (Get-MgSubscribedSku | Where-Object SkuPartNumber -eq "SPE_E3").SkuId

Import-Csv .\users.csv | ForEach-Object {
    Update-MgUser -UserId $_.UPN -UsageLocation $_.Location
    Set-MgUserLicense -UserId $_.UPN -AddLicenses @{ SkuId = $sku } -RemoveLicenses @()
    Write-Host "Licensed $($_.UPN)"
}

License and service-plan conflicts#

Two kinds of conflict come up:

• License (SKU) conflict — a user is assigned the same product both directly and through a group. You can’t remove the group’s copy from that individual user; you remove them from the group or remove the direct assignment, depending on which you meant to keep.
• Service plan conflict — two different products include an overlapping service plan that can’t be enabled twice for the same user. Assigning the second product fails until you disable the conflicting plan on one of them.

The cleanest way to avoid the direct-plus-group tangle is to pick one model per license and stick to it. Use group-based licensing for standard role-based bundles, and reserve direct assignment for genuine one-offs. Mixing both for the same product on the same users is what creates the “can’t remove it” headaches.

Removing a license cleanly#

Removing a license isn’t just unticking a box — it starts retention clocks on the user’s data.

• In the admin center, open the user’s Licenses and apps tab, untick the license, and save. If it’s a group-based license, remove the user from the group instead.
• With Graph: Set-MgUserLicense -UserId $user -RemoveLicenses @($sku) -AddLicenses @{}.

Wrapping up#

Pick the assignment method that matches the scale: the admin center for a few users, group-based licensing for teams and departments, and the Microsoft Graph PowerShell SDK for bulk or automated work. Set usage location before scripted assignments so they don’t fail silently, keep each product on a single licensing model to avoid direct-plus-group conflicts, and treat removal as a data event, not just a checkbox.

Once accounts are licensed, the next steps are usually getting the rest of the tenant in order. If you’re standing up a new tenant, see how to add a custom domain to Microsoft 365, and lock down those freshly licensed accounts by enabling MFA for your users.