Check if your Microsoft 365 license is active — steps

Short answer: start in the Microsoft 365 admin center and confirm the user’s Licenses and apps pane shows the expected SKU and enabled service plans. Next, verify with Microsoft Graph PowerShell using `Get-MgUserLicenseDetail` to check per-service `CapabilityStatus`. Then confirm on a user endpoint (Office app File > Account or portal.office.com) that Office accepts the license. If UI and PowerShell agree but apps still show Unlicensed, focus on cached tokens, Conditional Access or a disabled service plan; the steps below show checks and what to collect before escalating.

Quick 2‑minute checklist (prerequisites to run these checks)

Answer: You need an admin account, the affected user’s UPN, a machine for PowerShell, and an endpoint where the user can sign in. These let you confirm assignment in the admin UI and verify client behavior.

• An admin account with at least the User management admin role or equivalent rights.

• The affected user’s UPN (user@domain.example).

• Access to a machine where you can run PowerShell and authenticate to Microsoft Graph.

• One endpoint where the user signs in (Windows, macOS, or a browser session) for end-user verification.

Why this matters: the admin UI requires admin rights to view assignments. PowerShell needs the Graph module and authentication to read license details. A user endpoint proves Office apps accept the license rather than relying only on directory state.

Step 1 — Confirm assignment in Microsoft 365 admin center (exact UI path)

Answer: Check the user’s Licenses and apps pane in the admin center to see whether the SKU and service plans are assigned and which services are disabled. This proves the tenant allocated the SKU to the user.

1. Sign in to the Microsoft 365 admin center at admin.microsoft.com with an admin-capable account.

2. From the left nav choose Users then Active users.

3. Find and click the affected user (search by UPN or display name).

4. In the user pane choose Licenses and apps.

5. Read the assigned license block(s). Expect to see the SKU display name and a list of included services beneath it.

Microsoft 365 admin center > Users > Active users > (select user) > Licenses and apps

What to interpret: an assigned SKU row with a checked license means the tenant allocated that SKU to the user. If services are marked as disabled, that maps to the disabledPlans flag and means that specific service (for example Exchange Online or Teams) is turned off. A missing SKU row means no license is assigned.

Expected result that proves assignment: the SKU is listed and checked for the user, with no trial expiration or license conflict notes. If a required service is unchecked, note its name for Step 4.

Step 2 — Quick PowerShell checks (modules and one-liners)

Answer: Use Microsoft Graph PowerShell to list assigned licenses and per-service status. The output shows AssignedLicenses and ServicePlans with CapabilityStatus so you can confirm which services are enabled or disabled.

1. Install the Graph module and sign in with an account that can read directory/license info.

Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes "User.Read.All Directory.Read.All"

2. Show assigned licenses and detailed per-service status for the user.

Get-MgUser -UserId user@domain.example | Select-Object Id,UserPrincipalName,AssignedLicenses
Get-MgUserLicenseDetail -UserId user@domain.example

3. Compact one-liner to list service plan status.

(Get-MgUserLicenseDetail -UserId user@domain.example).ServicePlans | Format-Table ServicePlanId,ServicePlanName,CapabilityStatus

4. Legacy commands (use only if required and compatible):

Install-Module MSOnline -Scope CurrentUser
Connect-MsolService
Get-MsolUser -UserPrincipalName user@domain.example | Select-Object DisplayName,Licenses

What output means: an empty AssignedLicenses array means no license. ServicePlans showing Disabled corresponds to the portal disabledPlans flag — SKU assigned but that service not enabled. Permission errors mean your account lacks read access; use a different admin account or grant the required Graph permissions.

Step 3 — Verify on the user endpoint and in Office web apps (Windows/macOS/web/mobile)

Answer: Check a desktop Office app and portal.office.com to confirm the app shows the correct UPN and product line. If apps still show Unlicensed, refresh tokens and cached credentials, then recheck.

1. Ask the user to open any Office desktop app (Word, Excel, Outlook) and check File > Account.

2. In File > Account verify the signed-in account matches the UPN and look for a product/license line such as Microsoft 365 Apps for enterprise or Connected to Microsoft 365.

3. Expected result: with a working license the app allows editing and shows the product name. Unlicensed states show messages like Unlicensed or Sign in to activate.

4. On the web, sign in at portal.office.com with the user’s account and confirm the account menu and service tiles appear. If the portal asks to set up a trial or prevents access, the license may not be assigned or a token/cookie issue is present.

5. Teams and Outlook checks: if Teams opens and the user can access chat/meetings and Outlook connects to the mailbox, that is functional proof services are active. Missing Teams features commonly mean the Teams service plan is disabled.

6. If desktop apps show Unlicensed despite admin and PowerShell evidence, force a token and credential refresh:

• On Windows, open Credential Manager and remove credentials that reference MicrosoftOffice or the user’s UPN.

• In Office apps use File > Office Account > Sign out then sign back in.

• In a browser use an InPrivate / Incognito window to sign in at portal.office.com to avoid cookie cache.

Expected result after refresh: File > Account shows the correct UPN and a product/license line; editing is enabled and Outlook connects. If this does not happen, capture the exact app error text for escalation.

Step 4 — Service-specific indicators and propagation timing, plus quick fixes

Answer: Check the specific service records (Exchange, Teams, OneDrive) and note propagation timing. If admin UI and PowerShell show the SKU and CapabilityStatus: Enabled, treat directory propagation as done and focus on client tokens or Conditional Access.

Service-specific checks:

1. Exchange Online: confirm the Exchange service plan is enabled and that a mailbox exists.

# Connect using Exchange Online PowerShell (modern module) then run:
Get-Mailbox -Identity user@domain.example

Expected result: Get-Mailbox returns the mailbox object. If it does not exist, licensing may not have created one or provisioning failed.

2. Teams: check the Teams admin center or use Teams PowerShell to inspect the user.

Get-CsOnlineUser -Identity user@domain.example

Expected result: the user record exists and shows Teams-related attributes; an unlicensed state limits Teams features.

3. SharePoint/OneDrive: confirm the user can open OneDrive web and create files, or use SharePoint Online cmdlets to check personal site creation status. If the OneDrive site is missing, creation may be pending or blocked.

Propagation timing and how to tell it finished:

• Directory assignment is usually visible in the admin center and via Graph within minutes.

• Client-visible effects can lag because of cached tokens, client policies, or Conditional Access.

If the admin UI and PowerShell both show the SKU and CapabilityStatus: Enabled, treat directory propagation as complete and troubleshoot tokens and access policies on the client.

Typical quick fixes (run in this order):

1. Confirm assignment in the admin UI and PowerShell (Steps 1–2).

2. Have the user sign out of Office apps and browsers and sign back in; clear cached credentials.

3. Use an InPrivate/Incognito browser session to rule out cookies.

4. Check Azure AD sign-in logs for Conditional Access failures or blocked token issuance.

5. If a ServicePlan is Disabled, enable the needed service in the license assignment or assign an appropriate SKU.

Common messages and quick interpretations:

• Unlicensed or Product deactivated — client lacks a current license token. Usually fixed by signing out, clearing cached credentials, and signing back in.

• Sign-in required — the app needs a valid token; sign-in normally fixes it, but check Conditional Access if sign-in is blocked.

• Limited functionality — Office recognizes the account but not a full license; confirm assigned SKUs and service plans.

What to collect before contacting Microsoft support:

• Tenant ID and the affected UPN.

• Timestamped screenshots: admin Licenses and apps pane, PowerShell output showing AssignedLicenses and ServicePlans, and the client app error message.

• Azure AD sign-in log entries for the user around the failure time (include correlation IDs and failure codes).

• Client-side correlation ID or request ID if shown in the app.

When to escalate: collect the items above and open a Microsoft support case if admin UI and Graph/PowerShell both show the correct SKU and CapabilityStatus: Enabled for required services, and you have exhausted token and credential refresh, Conditional Access review, and client troubleshooting.

Conclusion

If the Microsoft 365 admin center lists the SKU and Microsoft Graph/PowerShell shows `AssignedLicenses` with per-service `CapabilityStatus: Enabled`, the directory has assigned the license. To prove apps accept it, sign the user out of Office apps and portal.office.com, clear cached credentials, sign back in, and confirm `File > Account` shows the correct UPN and product line. If that still fails, gather tenant ID, admin screenshots, PowerShell output and Azure AD sign-in logs before contacting Microsoft support.