Set-MgUserLicense: assign or remove Microsoft 365 licenses with Microsoft Graph PowerShell

Set-MgUserLicense replaces Set-MsolUserLicense and Set-AzureADUserLicense. It always takes both -AddLicenses and -RemoveLicenses; pass an empty array for the one you do not use:

Connect-MgGraph -Scopes "User.ReadWrite.All", "Organization.Read.All"

$sku = Get-MgSubscribedSku -All | Where-Object SkuPartNumber -eq 'SPE_E3'
Set-MgUserLicense -UserId anna@contoso.com -AddLicenses @{SkuId = $sku.SkuId} -RemoveLicenses @()

SkuPartNumber values (for example SPE_E3 for Microsoft 365 E3, ENTERPRISEPACK for Office 365 E3) are listed in Microsoft's "Product names and service plan identifiers for licensing". Organization.Read.All is needed for Get-MgSubscribedSku.

Module and permissions

The cmdlet lives in Microsoft.Graph.Users.Actions, not in Microsoft.Graph.Users, and calls POST /users/{id}/assignLicense. Find-MgGraphCommand shows this from the metadata in Microsoft.Graph.Authentication 2.41.2, without a connection:

Import-Module Microsoft.Graph.Authentication
$c = Find-MgGraphCommand -Command Set-MgUserLicense | Select-Object -First 1
'{0} {1} (module Microsoft.Graph.{2})' -f $c.Method, $c.URI, $c.Module
$c.Permissions | Where-Object { $_.Name -notlike 'AgentIdUser*' } | Sort-Object PermissionType, Name -Unique |
  ForEach-Object { '{0,-14} {1,-32} admin consent: {2}' -f $_.PermissionType, $_.Name, $_.IsAdmin }

POST /users/{user-id}/assignLicense (module Microsoft.Graph.Users.Actions)
Application    Directory.ReadWrite.All          admin consent: True
Application    LicenseAssignment.ReadWrite.All  admin consent: True
Application    User.ReadWrite.All               admin consent: True
DelegatedWork  Directory.ReadWrite.All          admin consent: True
DelegatedWork  LicenseAssignment.ReadWrite.All  admin consent: False
DelegatedWork  User.ReadWrite.All               admin consent: True

Delegated sign-in also needs a role that can assign licenses, such as License Administrator or User Administrator.

Common tasks

-RemoveLicenses takes SKU IDs (GUIDs), not hashtables. Disabled plans are service plan IDs from $sku.ServicePlans:

$planIds = $sku.ServicePlans | Where-Object ServicePlanName -in 'MFA_PREMIUM','INTUNE_A' | Select-Object -ExpandProperty ServicePlanId

Errors you may see

• A usage location error: the user has no UsageLocation (Graph requires it for users who are assigned licenses). Set it first with Update-MgUser -UserId USER -UsageLocation US.
• Insufficient privileges to complete the operation.: missing scope or role (details).
• The term 'Set-MgUserLicense' is not recognized: install the module with Install-Module Microsoft.Graph.Users.Actions -Scope CurrentUser (or the full Microsoft.Graph).