KBY Technologies Logo
Microsoft Entra ID · PowerShell 7.6

Licences bought, assigned and available

For every licence SKU the tenant subscribes to, how many units are enabled, how many are assigned, and how many are left?

Script

#Requires -Modules Microsoft.Graph.Authentication, Microsoft.Graph.Identity.DirectoryManagement
# Licence units enabled, assigned and available for every subscribed SKU. Read-only.

Connect-MgGraph -Scopes 'LicenseAssignment.Read.All' -NoWelcome

Get-MgSubscribedSku -All |
    ForEach-Object {
        [pscustomobject]@{
            Sku       = $_.SkuPartNumber
            Status    = $_.CapabilityStatus
            AppliesTo = $_.AppliesTo
            Enabled   = $_.PrepaidUnits.Enabled
            Assigned  = $_.ConsumedUnits
            Available = $_.PrepaidUnits.Enabled - $_.ConsumedUnits
            Warning   = $_.PrepaidUnits.Warning
            Suspended = $_.PrepaidUnits.Suspended
            LockedOut = $_.PrepaidUnits.LockedOut
            SkuId     = $_.SkuId
        }
    } |
    Sort-Object Sku

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Reading the output

  • Enabled, Warning, Suspended and LockedOut come from prepaidUnits. Warning units belong to an expired subscription in its grace period; Suspended units can't be assigned but can still be reactivated; LockedOut means the subscription was cancelled.
  • Available is Enabled minus Assigned (consumedUnits). It can be negative when assigned licences sit on units that are in warning or suspended.
  • Free and self-service SKUs (for example Power Automate Free) often show large unit counts; that is how Microsoft reports them, not a purchase.
  • Sku is the SKU part number. Microsoft's product names and service plan identifiers page maps part numbers to product names.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.

Connect-MgGraph (Microsoft.Graph.Authentication)Get-MgSubscribedSku (Microsoft.Graph.Identity.DirectoryManagement)List subscribedSkus: permissionssubscribedSku resource type: capabilityStatus, consumedUnits, prepaidUnitslicenseUnitsDetail resource type: enabled, warning, suspended, lockedOutProduct names and service plan identifiers for licensingForEach-Object (Microsoft.PowerShell.Core)Sort-Object (Microsoft.PowerShell.Utility)
All scripts