Removing Licenses from Entra ID Accounts When a Replacement License Exists

License Management is All a Matter of Identifiers (GUIDs)

A reader asked how to use the Graph SDK to remove the Exchange Online Plan 2 license from 2,000 users who have been upgraded to the Microsoft 365 E3 license. This can be a challenging task if you’re not accustomed to dealing with Microsoft 365 licenses using Graph SDK cmdlets and understand how to use the identifiers assigned to products and service plans.

The task seems complete but it’s not complicated, especially since Microsoft supported license stacking for Exchange Online (the ability for an account to have multiple Exchange Online licenses). In this instance, the accounts have Exchange Online Plan 2 licenses purchased prior to the upgrade to Microsoft 365 E3. The E3 licenses also have an Exchange Online Plan 2 service plan, meaning that if you remove the Exchange Online Plan 2 license from accounts, the accounts retain access to their mailboxes through the Exchange Online Plan 2 service plan included in Microsoft 365 E3.

License Management Based on Licenses and Service Plans

I admit that it can be confusing when a product is licensed through a separate license and a service plan that’s part of a license. For instance, the Exchange Online Plan 2 product has an identifier of 19ec0d23-8335-4cbd-94ac-6050e30712fa. The product contains a single service plan, also called Exchange Online Plan 2 with an identifier of efb87545-963c-4e0d-99df-69c6916d9eb0.

You might ask why two objects involved with licensing exist with the same name. The good news is that this doesn’t happen very often. The easiest way to think about it is that a license can be purchased by customers and becomes part of the tenant subscriptions. Service plans cannot be purchased and are always part of a license. The good thing about service plans is that they can be selectively disabled and enabled to remove access to functionality. For instance, Office 365 E5 spans over 50 service plans, including Exchange Online Plan 2.

To complete the task, we need to:

• Find user accounts with the Exchange Online Plan 2 license.
• Check if those accounts have a Microsoft 365 E3 license.
• If they have, remove the Exchange Online Plan 2 license. Users will continue to have access to their mailboxes through the Exchange Online Plan 2 service plan included in Microsoft 365 E3.

Removing Licenses from Accounts

The first step is to find the product identifier for the Exchange Online Plan 2 license. This code uses the Get-MgSubscribedSku cmdlet to find the set of subscriptions (licenses) in a tenant and extracts the Exchange Online Plan 2 identifier before calling Get-MgUser to find the accounts with the license.

$ExchangePlan2SKU = Get-MgSubscribedSku -All | Where-Object SkuPartNumber -eq ‘EXCHANGEENTERPRISE’ | Select-Object -ExpandProperty SkuId
[array]$Users = Get-MgUser -Filter "assignedLicenses/any(s:s/skuId eq $ExchangePlan2SKU)" -All -Property Id, displayName, assignedLicenses

The next step is a matter of looping through the set of accounts to find if they have a Microsoft 365 E3 license. If they do, the script runs the Set-MgUserLicense cmdlet to remove the Exchange Online Plan 2 license.

$Microsoft365E3SkuId = "05e9a617-0261-4cee-bb44-138d3ef5d965"
ForEach ($User in $Users) {
  If ($Microsoft365E3SkuId -in $User.AssignedLicenses.SkuId) {
     Write-Host ("Removing the Exchange Online Plan 2 license from the {0} account" -f $User.displayName)
     Set-MgUserLicense -UserId $User.Id -RemoveLicenses $ExchangePlan2SKU -AddLicenses @()

  } Else {
     Write-Host ("The {0} account doesn't have a Microsoft 365 E3 license" -f $User.displayName)
 }
}

That’s it. The code is simple even if the concepts of licenses and service plans take a little time to get to know

If you use group-based licensing rather than direct assignments, the task is even easier because it then becomes a matter of removing users from the group that controls the Exchange Online Plan 2 license..

License Management is a Core Competence

License management is a core competence for Microsoft 365 tenant administrators. It’s a good idea to become accustomed to working with license assignments through PowerShell. Apart from being able to generate reports from the license information stored in user accounts, knowing how to manipulate licenses will help the tenant manage licenses efficiently.

---

Learn how to exploit the data available to Microsoft 365 tenant administrators through the Office 365 for IT Pros eBook. We love figuring out how things work.