Table of Contents
The Science of Licensing Microsoft 365 User Accounts
The basics of Office 365 licensing are well known. Users access services through service plans bundled in composite plans like Microsoft E3 or E5 or individual offerings like Entra P1. Users must have the relevant licenses to access a service like Exchange Online or Teams. Information about the licenses assigned to users are stored in their Entra ID accounts. This context helps us understand how to begin answering questions about licensing that isn’t available in the Microsoft 365 admin center (Figure 1).
The admin center tells you what licenses you have, the licenses assigned and available, and the accounts with assigned licenses. You can export lists of users with a selected license to a CSV file for reporting purposes or to import into Power BI for analysis. But one thing you can’t do is to find out what users have licenses for applications assigned through a composite license.
Individual Application Service Plans
Take the example of Teams, Exchange Online, SharePoint Online. These are core services bundled into products like Office 365 E3. You could assume that everyone with an E3 or E5 license can use these applications, but that’s not true because administrators can remove the service plans for applications from individual user accounts (a service plan is effectively a license for a specific application bundled into a plan; you can’t buy a service plan). Take the example shown in Figure 2. The user has an Office 365 E3 license but the service plans for Bookings, Forms, and Kaizala have been removed.
It’s relatively common to find that organizations remove individual service plans from users until they are ready to deploy an application. For instance, you might want to use Exchange, SharePoint, and OneDrive for Business immediately but want to block user access to Teams, Forms, Stream, and other applications bundled in Office 365 E3 or E5 until local support is ready and user training is available.
Accessing License Information with PowerShell
While the admin center doesn’t support reporting of service plans for individual applications, it’s possible to do this with some straightforward PowerShell. The key is to discover how to retrieve the licensing information from Entra ID accounts.
Licensing information is in the AssignedLicenses property of an Entra ID account. If we use the Get-MgUserLicenseDetail to extract the service plan information, you’ll see the service plans and their current identifier and status:
Get-MgUserLicenseDetail -UserId Andy.Ruth@office365itpros.com | Select-Object -ExpandProperty ServicePlans | Format-Table ServicePlanName, ServicePlanId, ProvisioningStatus ServicePlanName ServicePlanId ProvisioningStatus --------------- ------------- ------------------ EXCHANGE_S_FOUNDATION 113feb6c-3fe4-4440-bddc-54d774bf0318 Success RMS_S_ADHOC 7a39d7dd-e456-4e09-842a-0204ee08187b Success WORKPLACE_ANALYTICS_INSIGHTS_BACKEND ff7b261f-d98b-415b-827c-42a3fdf015af Success WORKPLACE_ANALYTICS_INSIGHTS_USER b622badb-1b45-48d5-920f-4b27a2c0996c Success COPILOT_STUDIO_IN_COPILOT_FOR_M365 fe6c28b3-d468-44ea-bbd0-a10a5167435c Success M365_COPILOT_SHAREPOINT 0aedf20c-091d-420b-aadf-30c042609612 Success
The ServicePlanId is the important piece of information because it stores the unique identifier (a GUID) for the plan. Microsoft publishes an online list of application service plan identifiers for reference. The point to remember is that the same service plan identifier is always used. For instance, 2789c901-c14e-48ab-a76a-be334d9d793a is always Forms Plan E3 (the license for the Forms application included in Office 365 E3).
To confirm this, let’s use the Get-MgSubscribedSku cmdlet to retrieve the set of licenses known in a tenant (using the cmdlet to create a more comprehensive view of licenses is described in this article).
$Licenses = (Get-MgSubScribedSku) $Licenses | Format-Table SkuPartNumber, ConsumedUnits SkuPartNumber ConsumedUnits ------------- ------------- STREAM 14 Microsoft_365_Copilot 25 ENTERPRISEPACK 24 O365_w/o_Teams_Bundle_M5 5 FLOW_FREE 20 POWER_BI_STANDARD 17 Microsoft_Teams_Rooms_Basic 1 Office_365_w/o_Teams_Bundle_E5 5 SMB_APPS 0 Microsoft_Teams_EEA_New 5 RMSBASIC 0 RIGHTSMANAGEMENT_ADHOC 40
The online documentation tells us that the name of the Office 365 E3 SKU is ENTERPRISEPACK. It is license number three in our list, so we can look at this object to find out what’s included. As expected, the Service Plan Identifier for FORMS_PLAN_E3 is 2789c901-c14e-48ab-a76a-be334d9d793a.
$Licenses[2].ServicePlans | Format-Table ServicePlanName, ServicePlanId ServicePlanName ServicePlanId --------------- ------------- PLACES_CORE 1fe6227d-3e01-46d0-9510-0acad4ff6e94 GRAPH_CONNECTORS_SEARCH_INDEX a6520331-d7d4-4276-95f5-15c0933bc757 CLIPCHAMP a1ace008-72f3-4ea0-8dac-33b3a23a2472 Bing_Chat_Enterprise 0d0c0d31-fae7-41f2-b909-eaf4d7f26dba MESH_IMMERSIVE_FOR_TEAMS f0ff6ac6-297d-49cd-be34-6dfef97f0c28 MESH_AVATARS_ADDITIONAL_FOR_TEAMS 3efbd4ed-8958-4824-8389-1321f8730af8 MESH_AVATARS_FOR_TEAMS dcf9d2f4-772e-4434-b757-77a453cfbc02 M365_LIGHTHOUSE_CUSTOMER_PLAN1 6f23d6a9-adbf-481c-8538-b4c095654487 VIVAENGAGE_CORE a82fbf69-b4d7-49f4-83a6-915b2cf354f4 VIVA_LEARNING_SEEDED b76fb638-6ba6-402a-b9f9-83d28acb3d86 Nucleus db4d623d-b514-490b-b7ef-8885eee514de ContentExplorer_Standard 2b815d45-56e4-4e3a-b65c-66cb9175b560 POWER_VIRTUAL_AGENTS_O365_P2 041fe683-03e4-45b6-b1af-c0cdc516daee CDS_O365_P2 95b76021-6a53-4741-ab8b-1d1f3d66a95a PROJECT_O365_P2 31b4e2fc-4cd6-4e7d-9c1b-41407303bd66 DYN365_CDS_O365_P2 4ff01e01-1ba7-4d71-8cf8-ce96c3bbcf14 MICROSOFTBOOKINGS 199a5c09-e0ca-4e37-8f7c-b05d533e1ea2 KAIZALA_O365_P3 aebd3021-9f8f-4bf8-bbe3-0ed2f4f047a1 MICROSOFT_SEARCH 94065c59-bc8e-4e8b-89e5-5138d471eaff WHITEBOARD_PLAN2 94a54592-cd8b-425e-87c6-97868b000b91 MIP_S_CLP1 5136a095-5cf0-4aff-bec3-e84448b38ea5 MYANALYTICS_P2 33c4f319-9bdd-48d6-9c4d-410b750a4a5a BPOS_S_TODO_2 c87f142c-d1e9-4363-8630-aaea9c4d9ae5 FORMS_PLAN_E3 2789c901-c14e-48ab-a76a-be334d9d793a STREAM_O365_E3 9e700747-8b1d-45e5-ab8d-ef187ceec156 Deskless 8c7d2df8-86f0-4902-b2ed-a0458298f3b3 FLOW_O365_P2 76846ad7-7776-4c40-a281-a386362dd1b9 POWERAPPS_O365_P2 c68f8d98-5534-41c8-bf36-22fa496fa792 TEAMS1 57ff2da0-773e-42df-b2af-ffb7a2317929 PROJECTWORKMANAGEMENT b737dad2-2f6c-4c65-90e3-ca563267e8b9 SWAY a23b959c-7ce8-4e57-9140-b90eb88a9e97 INTUNE_O365 882e1d05-acd1-4ccb-8708-6ee03664b117 YAMMER_ENTERPRISE 7547a3fe-08ee-4ccb-b430-5077c5041653 RMS_S_ENTERPRISE bea4c11e-220a-4e6d-8eb8-8ea15d019f90 OFFICESUBSCRIPTION 43de0ff5-c92c-492b-9116-175376d08c38 MCOSTANDARD 0feaeb32-d00e-4d66-bd5a-43b5b83db82c SHAREPOINTWAC e95bec33-7c88-4a70-8e19-b10bd9d0c014 SHAREPOINTENTERPRISE 5dbe027f-2339-4123-9542-606e4d348a72 EXCHANGE_S_ENTERPRISE efb87545-963c-4e0d-99df-69c6916d9eb0
Reporting Accounts Licensed for an Application
Now that we know how service plan identifiers work and how to find their values, we can use this knowledge to build a script to interrogate user accounts to find license data for an application.
Not everyone likes inputting GUIDs, so we’ll make it easier by writing a script to do the work. You can input an application (service plan) name to be used for the query. The code creates a hash table of service plan identifiers and names (feel free to add more if you want). We ask the user to enter an application to check and validate the response against the hash table. Finally, we loop through the set of user accounts with the service plan in their set of assigned licenses and report the details. You can download the script from GitHub):
Processing Licenses in Different Plans
Because the script looks for a specific service plan identifier, it finds every instance of a licensed application. In other words, if you search for an application like Exchange Online, which included as EXCHANGE_S_ENTERPRISE (efb87545-963c-4e0d-99df-69c6916d9eb0) in both Office 365 E3 and E5), the report will list accounts enabled for Exchange in both plans. If you want to differentiate between the two plans, you need to check the AssignedLicenses property of each account for the identifier of the plan. For instance, looking at Microsoft’s reference list, we find that:
- 6fd2c87f-b296-42f0-b197-1e91e994b900 is the identifier for Office 365 E3.
- c7df2760-2c81-4ef7-b578-5b5392b571df is for Office 365 E5.
- 26d45bd9-adf1-46cd-a9e1-51e9a5524128 is for Office 365 E5 without audio conferencing.
The script available from GitHub includes code to output the names of license SKUs.
Outputting the License Data
The information in the report can be saved to a CSV file or viewed online. Figure 3 shows the result of the script as viewed through the Out-GridView cmdlet.
You might not need to interrogate Entra ID for details of individual licenses very often, but if you do (as when preparing to enable an application for a bunch of users), it’s much faster to get the information with PowerShell than using the admin center GUI.
For more great information about how licensing works, subscribe to the Office 365 for IT Pros eBook.
Outstanding article. Top Tier stuff!