LizenzverwaltungLicense Management

SKU-Verständnis, direkte und gruppenbasierte Zuweisung, Service Plans, Fehleranalyse und Referenztabellen.SKU understanding, direct and group-based assignment, service plans, troubleshooting, and reference tables.

LizenzkonzepteLicensing concepts

Ein SKU repräsentiert ein Produkt wie Microsoft 365 E3. Darunter befinden sich Service Plans, die einzelne Dienste wie Exchange Online, Teams oder Power BI repräsentieren.A SKU represents a product such as Microsoft 365 E3. Underneath are service plans that represent individual services such as Exchange Online, Teams, or Power BI.

Connect-MgGraph -Scopes "Organization.Read.All"
Get-MgSubscribedSku | Select-Object SkuPartNumber, SkuId, ConsumedUnits

GET https://graph.microsoft.com/v1.0/subscribedSkus
Authorization: Bearer <token>

Lizenz zuweisenAssign license

Die Zuweisung erfolgt über addLicenses/removeLicenses. Für Einzelbenutzer ist das schnell, für Betrieb im großen Stil aber nur für Ausnahmen geeignet.Assignment uses addLicenses/removeLicenses. It is quick for single users, but for large-scale operations it should be reserved for exceptions.

Connect-MgGraph -Scopes "User.ReadWrite.All","Organization.Read.All"
$sku = Get-MgSubscribedSku | Where-Object SkuPartNumber -eq "SPE_E3"
Set-MgUserLicense -UserId "user@contoso.com" -AddLicenses @{SkuId = $sku.SkuId} -RemoveLicenses @()

POST https://graph.microsoft.com/v1.0/users/user@contoso.com/assignLicense
Content-Type: application/json
Authorization: Bearer <token>

{ "addLicenses": [{ "skuId": "<sku-guid>" }], "removeLicenses": [] }

Gruppenbasierte LizenzierungGroup-based licensing

Gruppenbasierte Lizenzierung reduziert manuelle Arbeit, unterstützt Lifecycle-Prozesse und macht Bereitstellungen besser nachvollziehbar. Konflikte entstehen häufig bei konkurrierenden Direct Assignments oder Service-Plan-Abhängigkeiten.Group-based licensing reduces manual work, supports lifecycle processes, and makes deployments easier to trace. Conflicts often arise from competing direct assignments or service plan dependencies.

Connect-MgGraph -Scopes "Group.ReadWrite.All","Organization.Read.All"
$sku = Get-MgSubscribedSku | Where-Object SkuPartNumber -eq "SPE_E5"
Set-MgGroupLicense -GroupId "<group-id>" -AddLicenses @{SkuId = $sku.SkuId} -RemoveLicenses @()

POST https://graph.microsoft.com/v1.0/groups/<group-id>/assignLicense
Content-Type: application/json
Authorization: Bearer <token>

{ "addLicenses": [{ "skuId": "<sku-guid>" }], "removeLicenses": [] }

Lizenzen anzeigenView licenses

Für Inventare werden subscribedSkus, user licenseDetails und group assignment states kombiniert. Damit lassen sich Bestand, Verbrauch und Fehlerquellen sauber darstellen.For inventories, combine subscribedSkus, user licenseDetails, and group assignment states. This makes it possible to clearly present inventory, consumption, and error sources.

Connect-MgGraph -Scopes "Organization.Read.All","User.Read.All"
Get-MgSubscribedSku | Select-Object SkuPartNumber, SkuId, ConsumedUnits
Get-MgUserLicenseDetail -UserId "user@contoso.com"

GET https://graph.microsoft.com/v1.0/subscribedSkus
GET https://graph.microsoft.com/v1.0/users/user@contoso.com/licenseDetails
Authorization: Bearer <token>

Service Plans aktivieren oder deaktivierenEnable or disable service plans

Ein Produkt kann selektiv mit deaktivierten Teilplänen zugewiesen werden. Das ist hilfreich, wenn z. B. Teams oder Yammer bewusst ausgeschlossen werden sollen.A product can be assigned with selected disabled service plans. This is useful when, for example, Teams or Yammer should be intentionally excluded.

Connect-MgGraph -Scopes "User.ReadWrite.All","Organization.Read.All"
$sku = Get-MgSubscribedSku | Where-Object SkuPartNumber -eq "SPE_E3"
$disabledPlans = @(
  ($sku.ServicePlans | Where-Object ServicePlanName -eq "TEAMS1").ServicePlanId
)
Set-MgUserLicense -UserId "user@contoso.com" -AddLicenses @{ SkuId = $sku.SkuId; DisabledPlans = $disabledPlans } -RemoveLicenses @()

POST https://graph.microsoft.com/v1.0/users/user@contoso.com/assignLicense
Content-Type: application/json
Authorization: Bearer <token>

{
  "addLicenses": [
    { "skuId": "<sku-guid>", "disabledPlans": ["<service-plan-guid>"] }
  ],
  "removeLicenses": []
}

Zuweisungen auflisten und exportierenList assignments and export

Ein gutes Lizenzreporting beantwortet drei Fragen: Wer ist lizenziert? Welche Lizenzen sind direkt versus gruppenbasiert? Wo entstehen Fehler oder Leerlauf?Good license reporting answers three questions: Who is licensed? Which licenses are direct versus group-based? Where do errors or idle allocations occur?

Connect-MgGraph -Scopes "User.Read.All","Organization.Read.All"
$report = Get-MgUser -All -Property DisplayName,UserPrincipalName,AssignedLicenses |
  Select-Object DisplayName, UserPrincipalName,
    @{n='AssignedSkuCount';e={$_.AssignedLicenses.Count}}
$report | Export-Csv ".\license-summary.csv" -NoTypeInformation -Encoding UTF8

GET https://graph.microsoft.com/v1.0/users?$select=displayName,userPrincipalName,assignedLicenses
Authorization: Bearer <token>

Häufige FehlerCommon errors

Lizenzfehler entstehen oft durch fehlenden usageLocation-Wert, ausverkaufte SKU-Kontingente, widersprüchliche Service Plans oder nicht kompatible Gast-/Workload-Szenarien.License errors often arise from missing usageLocation values, exhausted SKU capacity, conflicting service plans, or incompatible guest/workload scenarios.

Connect-MgGraph -Scopes "User.Read.All","Organization.Read.All"
Get-MgSubscribedSku | Select-Object SkuPartNumber, ConsumedUnits, PrepaidUnits

GET https://graph.microsoft.com/v1.0/subscribedSkus
Authorization: Bearer <token>

SKU-IDs ReferenzSKU ID reference

Die folgende Tabelle verwendet gängige skuPartNumbers und GUIDs aus der offiziellen Microsoft-Referenz. Für produktive Skripte sollte dennoch immer der Live-Abgleich über subscribedSkus erfolgen.The following table uses common skuPartNumbers and GUIDs from the official Microsoft reference. For production scripts, always verify live data through subscribedSkus.

Connect-MgGraph -Scopes "Organization.Read.All"
Get-MgSubscribedSku | Sort-Object SkuPartNumber | Select-Object SkuPartNumber, SkuId

GET https://graph.microsoft.com/v1.0/subscribedSkus?$select=skuPartNumber,skuId
Authorization: Bearer <token>

Komplette SkripteComplete scripts

Die folgenden Muster decken Reporting, Bulk Assign und die Suche nach unlizenzierten Benutzern ab. In realen Umgebungen sollten sie um Logging, Retry-Handling und Paging ergänzt werden.The following patterns cover reporting, bulk assignment, and finding unlicensed users. In real environments, add logging, retry handling, and paging.

Connect-MgGraph -Scopes "User.Read.All","User.ReadWrite.All","Organization.Read.All"

$licenseReport = Get-MgUser -All -Property DisplayName,UserPrincipalName,AssignedLicenses |
  Select-Object DisplayName, UserPrincipalName,
    @{n='AssignedSkuCount';e={$_.AssignedLicenses.Count}}
$licenseReport | Export-Csv ".\license-report.csv" -NoTypeInformation -Encoding UTF8

$sku = Get-MgSubscribedSku | Where-Object SkuPartNumber -eq "SPE_E3"
Import-Csv ".\license-targets.csv" | ForEach-Object {
  Set-MgUserLicense -UserId $_.UserPrincipalName -AddLicenses @{SkuId = $sku.SkuId} -RemoveLicenses @()
}

Get-MgUser -All -Property DisplayName,UserPrincipalName,AssignedLicenses |
  Where-Object { $_.AssignedLicenses.Count -eq 0 } |
  Export-Csv ".\unlicensed-users.csv" -NoTypeInformation -Encoding UTF8

GET https://graph.microsoft.com/v1.0/users?$select=displayName,userPrincipalName,assignedLicenses
POST https://graph.microsoft.com/v1.0/users/{id}/assignLicense
GET https://graph.microsoft.com/v1.0/subscribedSkus
Authorization: Bearer <token>

Komplette SKU-TabelleComplete SKU table

Die Tabelle ergänzt die bereits vorhandene Lizenzreferenz um zusätzliche Education-, Government-, Security-, Teams-, Viva-, Power-Platform- und Copilot-SKUs. Grundlage ist die offizielle Microsoft-Liste 'Product names and service plan identifiers for licensing'.This table expands the existing licensing reference with additional education, government, security, Teams, Viva, Power Platform, and Copilot SKUs. It is based on Microsoft’s official 'Product names and service plan identifiers for licensing' reference.

Service Plan DependenciesService plan dependencies

Dienstpläne sind selten völlig unabhängig. Bei Optimierungs- oder Downgrade-Projekten sollten Sie nicht nur SKUs vergleichen, sondern konkrete Workload-Abhängigkeiten wie Exchange-Backends, SharePoint-Dateispeicher, Voice-Routing und Defender-Sensorik.Service plans are rarely fully independent. In optimization or downgrade projects, compare not only SKUs but also workload dependencies such as Exchange back ends, SharePoint storage, voice routing, and Defender sensors.

License OptimizationLicense optimization

Lizenzoptimierung ist mehr als 'billigere SKU suchen'. Sie kombiniert Nutzung, Persona, Compliance, Security Minimum, geografische Verfügbarkeit, Downgrade-Risiko und technische Abhängigkeiten. Ziel ist ein verteidigbares, auditierbares Lizenzmodell.License optimization is more than 'find a cheaper SKU'. It combines usage, persona, compliance, security minimums, geographic availability, downgrade risk, and technical dependencies. The goal is a defensible, auditable licensing model.

Optimierungs-ScorecardOptimization scorecard

• Unterauslastete Lizenzen über inaktive Konten, fehlende Sign-ins und nicht verwendete Service Plans erkennen.Find underutilized licenses through inactive accounts, missing sign-ins, and unused service plans.
• Direkte Zuweisungen reduzieren und in standardisierte Gruppenstapel überführen.Reduce direct assignments and move users into standardized group-based stacks.
• Downgrade-Kandidaten nur vorschlagen, wenn Security- und Compliance-Mindestanforderungen erhalten bleiben.Recommend downgrades only when minimum security and compliance requirements remain intact.
• Vor jeder Migration pilotieren: Voice, Archive, Purview, Defender und Power Platform separat validieren.Pilot before any migration: validate voice, archive, Purview, Defender, and Power Platform separately.

Connect-MgGraph -Scopes "Organization.Read.All","User.Read.All","AuditLog.Read.All"

$inactiveThreshold = (Get-Date).AddDays(-45)
$users = Get-MgUser -All -Property DisplayName,UserPrincipalName,AssignedLicenses,UsageLocation,SignInActivity
$skus = Get-MgSubscribedSku | Group-Object SkuId -AsHashTable -AsString

$report = foreach ($user in $users) {
  $lastSignIn = $user.SignInActivity.LastSignInDateTime
  $assignedSkuNames = foreach ($license in $user.AssignedLicenses) {
    if ($skus.ContainsKey($license.SkuId.Guid)) { $skus[$license.SkuId.Guid].SkuPartNumber }
  }

  [pscustomobject]@{
    DisplayName = $user.DisplayName
    UserPrincipalName = $user.UserPrincipalName
    UsageLocation = $user.UsageLocation
    AssignedSkus = ($assignedSkuNames -join '; ')
    AssignedSkuCount = $user.AssignedLicenses.Count
    LastSignInDateTime = $lastSignIn
    UnderUtilized = [bool]($user.AssignedLicenses.Count -gt 0 -and ($null -eq $lastSignIn -or $lastSignIn -lt $inactiveThreshold))
    Recommendation = if ($user.AssignedLicenses.Count -eq 0) {
      "No license assigned"
    }
    elseif ($null -eq $lastSignIn -or $lastSignIn -lt $inactiveThreshold) {
      "Review for downgrade, archive, or reclaim"
    }
    else {
      "Keep and monitor"
    }
  }
}

$report | Export-Csv ".\license-optimization-report.csv" -NoTypeInformation -Encoding UTF8
$report | Where-Object UnderUtilized | Sort-Object AssignedSkuCount -Descending

Monatlicher Governance-ZyklusMonthly governance cycle

Entra LizenzmatrixEntra licensing matrix

Die Lizenzfrage im Entra-Umfeld betrifft nicht nur Entra Free/P1/P2, sondern auch die Bündelung in Microsoft 365, EMS und Security-Paketen. Für Architekturentscheidungen zählt daher immer die effektive SKU-Kombination.Licensing in the Entra space is not limited to Entra Free/P1/P2; it also depends on how those capabilities are bundled in Microsoft 365, EMS, and security suites. Architecture decisions therefore depend on the effective SKU combination.

Group-based Licensing Deep DiveGroup-based licensing deep dive

Connect-MgGraph -Scopes "Group.ReadWrite.All","Directory.ReadWrite.All"

$sku = Get-MgSubscribedSku | Where-Object SkuPartNumber -eq "ENTERPRISEPACK"
$group = Get-MgGroup -Filter "displayName eq 'Lic-M365-E3-KnowledgeWorkers'"

$body = @{
  addLicenses = @(
    @{
      skuId = $sku.SkuId
      disabledPlans = @()
    }
  )
  removeLicenses = @()
} | ConvertTo-Json -Depth 6

Invoke-MgGraphRequest -Method POST `
  -Uri "https://graph.microsoft.com/v1.0/groups/$($group.Id)/assignLicense" `
  -Body $body `
  -ContentType "application/json" 

Reporting und OptimierungReporting and optimization

Governance und TransitionGovernance and transition

• Lizenzdesign immer mit Joiner/Mover/Leaver-Prozessen, HR-Attributen und Gruppenstrategie verbinden.Always connect license design with joiner/mover/leaver processes, HR attributes, and group strategy.
• Vor SKU-Wechseln abhängige Workloads wie Exchange Archive, Teams Phone, Defender und Purview separat validieren.Before SKU changes, validate dependent workloads such as Exchange archive, Teams Phone, Defender, and Purview separately.
• Direkt zugewiesene Alt-Lizenzen nur in dokumentierten Ausnahmefällen bestehen lassen.Keep directly assigned legacy licenses only for documented exceptions.
• Regelmäßige Review-Zyklen für Premium-Add-ons, Gäste und inaktive Konten etablieren.Establish regular review cycles for premium add-ons, guests, and inactive accounts.