Update-MgUser -UsageLocation: set the country code required for licenses

Update-MgUser -UserId ID -UsageLocation "US" sets a Microsoft Entra ID user's usage location, a two-letter ISO 3166 country code. Microsoft 365 licensing needs it: the Graph user resource says usageLocation is "Required for users that are assigned licenses due to legal requirements to check for availability of services in countries/regions. Examples include: US, JP, and GB. Not nullable." Users created by scripts, synchronization or B2B invitations often lack it, and license assignment to them fails until it is set.

Connect-MgGraph -Scopes "User.ReadWrite.All"
Update-MgUser -UserId anna@contoso.com -UsageLocation "DE"
Get-MgUser -UserId anna@contoso.com -Property UserPrincipalName, UsageLocation |
  Select-Object UserPrincipalName, UsageLocation

Set it for users who have none

usageLocation "Requires $select to retrieve", so request it with -Property (Get-MgUser -Property) before filtering:

Get-MgUser -All -Property Id, UserPrincipalName, UsageLocation |
  Where-Object { -not $_.UsageLocation } |
  ForEach-Object { Update-MgUser -UserId $_.Id -UsageLocation "US" }

The user resource also says usageLocation supports $filter (eq, ne, not, ge, le, in, startsWith, and eq on null values), so the service can narrow the list instead of Where-Object.

The parameter in the module

Checked offline in Windows PowerShell 5.1 with Microsoft.Graph.Users 2.41.2: -UsageLocation is a plain string on both New-MgUser and Update-MgUser; PowerShell does not validate the country code, the service does.

Import-Module Microsoft.Graph.Users
foreach ($cmd in 'New-MgUser', 'Update-MgUser') {
  $p = (Get-Command $cmd).Parameters['UsageLocation']
  $vs = $p.Attributes | Where-Object { $_ -is [System.Management.Automation.ValidateSetAttribute] }
  '{0} -UsageLocation: {1}, ValidateSet: {2}' -f $cmd, $p.ParameterType.Name, [bool]$vs
}
try { Update-MgUser -UserId anna@contoso.com -UsageLocation "DE" -ErrorAction Stop } catch { $_.Exception.Message }

New-MgUser -UsageLocation: String, ValidateSet: False
Update-MgUser -UsageLocation: String, ValidateSet: False
Authentication needed. Please call Connect-MgGraph.

Where it matters

Pitfalls

• Codes, not names. Germany or UK are not valid; use DE and GB.
• Synced users. For accounts synchronized with Microsoft Entra Connect, the value can come from the on-premises attribute mapping; a cloud change may be overwritten on the next sync if that attribute is mapped.
• Permissions. The admin needs a role that can manage users (for example User Administrator) and a Graph scope such as User.ReadWrite.All.
• Then assign the license. See Set-MgUserLicense, and for new accounts New-MgUser with a password profile.

FAQ