Automate License Assignment and Removal Using Graph PowerShell

Managing Microsoft 365 license assignments manually is tedious—especially when dealing with hundreds or thousands of users. This script simplifies the process by automating bulk license assignment and removal using Graph PowerShell.

With just a few lines of code, you can assign a new license (like Office 365 E3) and remove an old or unnecessary one (like Power Automate Free), saving you the time and hassle of navigating the Microsoft 365 admin center for each user.

The Script

Connect to Microsoft Graph with required scopes
Connect-MgGraph -Scopes "User.ReadWrite.All", "Directory.ReadWrite.All"
                                
# Get the SKU IDs for the licenses you want to assign/remove
$licenseToAssign = Get-MgSubscribedSku | Where-Object { $_.SkuPartNumber -eq "ENTERPRISEPACK" }  # Example: Office 365 E3
$licenseToRemove = Get-MgSubscribedSku | Where-Object { $_.SkuPartNumber -eq "FLOW_FREE" }       # Example: Power Automate Free
                                
# Define users (can be replaced with CSV import or dynamic query)
$users = Get-MgUser -Filter "accountEnabled eq true" -All
                                
foreach ($user in $users) {
    try {
        Set-MgUserLicense -UserId $user.Id `
        -AddLicenses @(@{SkuId = $licenseToAssign.SkuId}) `
        -RemoveLicenses @($licenseToRemove.SkuId)
                                    
        Write-Host "✅ Updated licenses for $($user.DisplayName)"
    }
    catch {
        Write-Warning "⚠️ Failed to update $($user.DisplayName): $_"
    }
}
                            

How the Script Works

1. Connect-MgGraph: Authenticates to Microsoft Graph with the necessary permissions to read and modify user and directory data.
2. Get-MgSubscribedSku: Queries all subscribed SKUs in the tenant. You select the ones to assign or remove using the SkuPartNumber.
3. Get-MgUser: Retrieves all enabled users in your tenant.
4. Set-MgUserLicense: Loops through each user and assigns the specified license while removing the other in one atomic operation.

📌 Note: To find the available SkuPartNumber values in your tenant, run:

Get-MgSubscribedSku | Select-Object SkuId, SkuPartNumber

This will help you identify the correct license strings like ENTERPRISEPACK, E5, or FLOW_FREE for use in your script.

Further Enhancements

• CSV Integration: Replace the static Get-MgUser block with a CSV import to target a specific user list.
• Conditional Logic: Only assign/remove licenses based on user attributes (department, location, etc.).
• Logging: Output results to a CSV for compliance/auditing purposes.
• Dry Run Option: Preview which users will be affected without making changes.

Possible Errors & Solutions

Error	Cause	Solution
Access Denied or Insufficient privileges	Missing Graph scopes or app permissions	Ensure User.ReadWrite.All and Directory.ReadWrite.All scopes are used
Cannot convert the literal ... to Edm.Guid	License assignment format is incorrect	Ensure you pass a hashtable for -AddLicenses and GUIDs for -RemoveLicenses
SkuId is null	SkuPartNumber does not exist in your tenant	Use the correct SkuPartNumber using Get-MgSubscribedSku
Set-MgUserLicense: Bad Request	Invalid combination of licenses or user not eligible	Check the license dependencies and prerequisites for the user

Conclusion

This Graph PowerShell script is a simple yet powerful way to manage Microsoft 365 license assignments in bulk. It eliminates manual overhead, reduces errors, and boosts administrative productivity.

By querying tenant-wide licenses and applying them dynamically, admins can scale their licensing strategy efficiently. Modify this script further to match your organization’s specific provisioning workflows and compliance needs.