Group-based licensing troubleshooting checklist

Symptoms to confirm

• A user is a member of the licensing group, but has no mailbox, Teams tells them they need a licence, or Microsoft 365 Apps won't activate.
• In the Microsoft 365 admin center, Billing › Licenses › product › Errors & issues lists one or more users.
• Some members of a group received their licences and others didn't. When a group assigns several products and one of them can't be assigned to a user, that user doesn't get the other products from the group either.

Likely causes

Group-based licensing is a Microsoft Entra ID feature that you now manage from the Microsoft 365 admin center.

• A blank usage location doesn't cause an error: members licensed through a group inherit the tenant's location. That is convenient, but wrong for users in other countries, so set the value deliberately.

Checklist

1. 1

   Find the users in error

   For one product, open Billing › Licenses, select the product, open Errors & issues and select a user to see the error type. For a tenant-wide, read-only list, use Microsoft Graph PowerShell:

   See the full script in the source article.

2. 2

   Fix the cause

   • Not enough licences: compare purchased and consumed units, then reclaim licences from leavers or from users who also hold a redundant direct assignment, or buy more.
     powershell

     Get-MgSubscribedSku | Select-Object SkuPartNumber, ConsumedUnits,
         @{ n = 'Purchased'; e = { $_.PrepaidUnits.Enabled } }

   • Conflicting service plans: in the script output, look for another entry for the same user with an empty ViaGroup (a direct assignment) or a different group. Remove that product, or edit one assignment to switch off the conflicting plans. Remember that changing plans on the group affects every member.
   • Missing dependencies: re-enable the plan the other product relies on, or remove the dependent add-on before disabling the plan.
   • Usage location: set the correct two-letter country code. If your directory sync flows usage location from on-premises Active Directory, change it there instead, or the next sync cycle puts the old value back.
     powershell

     Update-MgUser -UserId "anna@contoso.com" -UsageLocation "EG"

   • Proxy address conflict: find the object that already holds the address in Exchange Online PowerShell, then remove the address from whichever object shouldn't have it. For synced objects, fix it on-premises; see Entra Connect sync errors and duplicate attributes.
     powershell

     Get-Recipient -Filter "EmailAddresses -eq 'anna@contoso.com'" |
         Format-List DisplayName, RecipientType, EmailAddresses

3. 3

   Reprocess the affected users

   Group-based licensing reacts to membership and assignment changes, but fixing a cause elsewhere, such as freeing up licences or removing a duplicate address, doesn't always trigger a new evaluation. Reprocess the users who are still in error (License Administrator or User Administrator role):

   powershell

   Connect-MgGraph -Scopes "User.ReadWrite.All","Group.Read.All"
   $groupId = "<group object ID>"
   
   Get-MgGroupMemberWithLicenseError -GroupId $groupId -All |
       ForEach-Object { Invoke-MgLicenseUser -UserId $_.Id | Out-Null }

Verify

(Get-MgUser -UserId "anna@contoso.com" -Property LicenseAssignmentStates).LicenseAssignmentStates |
    Select-Object SkuId, AssignedByGroup, State, Error

• Good looks like State = Active, no error value (None), and AssignedByGroup showing your licensing group's object ID.
• Errors & issues for the product is empty, and the hasMembersWithLicenseErrors query no longer returns the group.
• The services follow: the mailbox appears in Exchange Online, Teams signs in normally and Microsoft 365 Apps activate. Mailbox provisioning can lag slightly behind the licence.

Prevent it next time

• Set usage location at creation. Make it part of your provisioning flow, whether that is HR-driven provisioning, directory sync or a script.
• One licensing group per product and plan combination. Keep groups that assign conflicting products mutually exclusive; dynamic membership rules make this easier.
• Remove redundant direct assignments once users are covered by a group; Microsoft's PowerShell examples for group-based licensing include a pattern for it.
• Move users in the right order: add them to the destination group, confirm the new licence is active, then remove them from the old group. Removing first leaves them unlicensed until processing finishes.
• Avoid nested groups for licensing: only the group's direct user members receive the licences.

+1 more tips in the full article.