Microsoft 365 license not taking effect — 2/15/60

Short answer: most of the time a Microsoft 365 license that “doesn’t take” is either not actually assigned, waiting on tenant provisioning/replication, or blocked by a client token or policy. Start by proving the license is present in the admin portals and via PowerShell, then run the time‑boxed 2 / 15 / 60‑minute triage below: quick sign‑out and browser checks first, force reprovision or reassign next, then tenant diagnostics and logs before calling Microsoft Support.

Immediate symptom check: what you should verify in 0–2 minutes

Describe what you see and when it happens.

• Observable symptoms to note now:
• Office desktop apps show “unlicensed”, open read‑only, or ask for activation.
• Web apps (office.com, outlook.office.com, onedrive) show reduced features or an unlicensed banner.
• Mobile apps show errors or account not permitted to access content.

• Quick inventory to get before you touch anything:
• Which client shows the symptom (desktop, web, mobile)?
• Exact account the user is signing into (UPN shown in File > Account or the web session).
• When the license was assigned (if known) and by whom.

1. Ask the user to open an Office desktop app and read the exact account string in File > Account. Note that value.

2. Reproduce on the web: open a private/incognito browser, go to office.com, and sign in with the exact UPN you recorded.

3. If web apps show licensed but desktop apps do not, treat this as a client token/cache issue and follow the 2–15 minute client reprovision steps. If web apps also show unlicensed, continue to license verification.

• Quick local fixes (do these immediately):
• Sign out of Office on the affected device: File > Account > Sign out, then close all Office apps and sign back in.

Open an Office app > File > Account > Sign out. Then sign in with the licensed UPN.

Before you start (scope, permissions and safe checks)

• Applicability: this guide assumes the account is cloud or cloud‑synced to Entra (Azure AD) and you have an admin role (Global Admin or Privileged Role Administrator) to view and change licenses.

• Prerequisites and safe checks before making tenant changes:
• Have a second admin account available for verification, or test with an admin test account rather than the user account during initial trials.
• Confirm you can run the Microsoft Graph PowerShell module or the AzureAD/MSOnline modules used in your environment; update modules before use.
• Time‑box your work: follow the 2 / 15 / 60 minute flow below and capture evidence at each stage so you can roll back safely.

• Stopping condition: if you find a Service Health incident that explicitly affects provisioning, stop further reassignments and collect the incident ID before escalating.

• Backup: export the current license snapshot for the user (PowerShell output) before removing or changing licenses; this preserves the exact SKU and disabled plans for rollback.

Confirm the license assignment and SKU mapping (portal + PowerShell)

You must prove a license is assigned and the required service plans are enabled before changing anything.

• Portal checks (Microsoft 365 admin center and Entra):
• Microsoft 365 admin center: Accounts > Active users > select the user > Licenses and apps. Confirm a license is checked and note the SKU name and any unchecked service plans (Exchange, SharePoint, Teams, etc.).
• Entra (Microsoft Entra ID) portal: Entra ID > Users > select user > Licenses. Confirm the same SKU and service plans.

• PowerShell: confirm your module versions before running commands. In 2026 Microsoft.Graph is the recommended module; AzureAD and MSOnline exist in many tenants but may be legacy.

1. Connect with Microsoft Graph PowerShell and list license details.

Install-Module Microsoft.Graph -Force -AllowClobber
Import-Module Microsoft.Graph
Connect-MgGraph -Scopes "User.Read.All","Directory.Read.All"
Get-MgUser -UserId "user@domain.com" | Select-Object Id,UserPrincipalName
Get-MgUserLicenseDetail -UserId "user@domain.com"
Get-MgSubscribedSku

• What to look for in the output: assigned SKU(s) and, for each servicePlan, the ProvisioningStatus or state and whether it is enabled. If there are no license entries for the user, the assignment did not reach the user object.

2. If your environment still uses legacy modules for existing scripts, these commands give equivalent information. Verify these modules are allowed in your tenant before running them.

Install-Module MSOnline -Force
Import-Module MSOnline
Connect-MsolService
Get-MsolUser -UserPrincipalName "user@domain.com" | Select-Object DisplayName,IsLicensed,Licenses

Install-Module AzureAD -Force
Import-Module AzureAD
Connect-AzureAD
Get-AzureADUserLicenseDetail -ObjectId (Get-AzureADUser -ObjectId "user@domain.com").ObjectId

• Common pitfalls: the admin portal can show a license assigned due to cached UI state while PowerShell shows no license because of replication delay. Use the PowerShell snapshot and the portal screenshot with timestamps to prove current state.

Fast fixes and forced reprovision (what to try in 2–15 minutes)

Safe, reversible actions that often restore service quickly. Capture the PowerShell output you gathered above before you change anything.

1. Remove and reassign the license (tenant‑side reprovision). This forces provisioning to restart.

# Remove license (replace {SkuId-GUID} with the exact SkuId from Get-MgSubscribedSku)
Set-MgUserLicense -UserId "user@domain.com" -RemoveLicenses @("{SkuId-GUID}")

# Reassign license (example with SkuId)
Set-MgUserLicense -UserId "user@domain.com" -AddLicenses @(@{SkuId="{SkuId-GUID}";DisabledPlans=@()})

• Expected: assignment starts provisioning immediately; web apps typically reflect the change in a few minutes and desktop apps after reauthentication.

2. If you use on‑premises AD with Azure AD Connect: trigger a delta sync and confirm success.

# On the AD Connect server
Import-Module ADSync
Start-ADSyncSyncCycle -PolicyType Delta
Get-ADSyncConnectorRunStatus

• What it means if sync errors appear: address attribute mapping or duplicate identity errors before reassigning licenses; fixing identity collisions is required for provisioning to reach the cloud user.

3. Force the client to refresh tokens (desktop):

• Sign out of Office (File > Account > Sign out), close all Office apps, remove any Microsoft credentials for the account from Windows Credential Manager, then sign back in.

Control Panel > Credential Manager > Windows Credentials > remove entries containing the user's UPN or MicrosoftOffice16

• If that fails, test on a clean machine or create a new local Windows profile to rule out profile corruption.

4. Mobile clients: remove the account from Outlook/Office apps, clear app data (or uninstall), reinstall and re-add the account.

5. If desktop apps still show unlicensed after a sign out/in, run Office Repair: Settings > Apps > Microsoft 365 Apps > Modify > Quick Repair, then sign back in.

• If these steps don’t restore service, collect the evidence described in the verify section and proceed to tenant‑level diagnostics.

Deeper tenant checks and logs (what to do in 15–60 minutes)

Broaden scope to tenant‑level causes: service incidents, directory sync issues, and policies that can block tokens even when a license is present.

1. Check Microsoft 365 Service Health and Message Center.

• Admin center path: Microsoft 365 admin center > Health > Service health. Look for active incidents affecting licensing, provisioning, or the specific workload. Note the Service Health ID, tenant impact, and timestamps.

• If there is a global or tenant incident affecting provisioning, avoid repeating assignments; instead capture the incident ID and wait for Microsoft to resolve or include your tenant in the incident.

2. Collect sign‑in and audit logs in Entra.

• Entra portal > Monitoring > Sign-ins and Audit logs. Filter for the affected user and the window when you assigned or re‑assigned the license.

• Export entries showing token issuance failures, Conditional Access denials, or errors mentioning licenseGrant or service provisioning.

3. Inspect the Azure AD account state and identity attributes.

Get-MgUser -UserId "user@domain.com" | Select-Object Id,UserPrincipalName,AccountEnabled,OnPremisesImmutableId
Get-MgUserLicenseDetail -UserId "user@domain.com"

• Check UPN, proxyAddresses, ImmutableId (for federated users), and whether the account is disabled or blocked. A mismatch between the UPN the user signs into and the licensed UPN is a common root cause.

4. Azure AD Connect health and sync errors: open the Azure AD Connect server’s Synchronization Service Manager and review recent runs and error queues. Duplicate attributes, mismatched ImmutableId, or failing Connectors can stop provisioning.

5. Conditional Access, Intune and device compliance policies: Conditional Access can block token issuance even when a license exists. In Entra: Security > Conditional Access; review policies that apply to the user or their groups, or that require device compliance. Temporarily exclude an admin test account to validate whether CA is the blocker.

• Expected meanings:
• Service Health incident: collect the incident ID and ETA; avoid repeating assignments that create noise.
• Sync errors / duplicate identities: resolve attribute issues, then re‑run sync and reassign licenses.
• Conditional Access block: adjust or create a temporary exclusion for testing with approval and documented change control.

• Evidence to capture at this stage: export sign‑in logs, copy PowerShell outputs (Get-MgUserLicenseDetail, Get-MgSubscribedSku, Get-MgUser), screenshot Service Health entries (with timestamp and incident ID), and save Azure AD Connect sync error records.

Verify success, collect evidence and when to escalate

How to confirm the license is effective and what to bring to Microsoft Support if you escalate.

• Verify success (check these):

1. Web apps: sign in to office.com with the user’s licensed UPN and confirm Outlook, OneDrive, and Teams are operating normally (no reduced functionality banners).

2. PowerShell verification:

Get-MgUserLicenseDetail -UserId "user@domain.com"
Get-MgSubscribedSku

• Expected: license entries present for the user and servicePlans show provisioned/enabled. If PowerShell shows the SKU and servicePlans, provisioning reached Entra.

3. Desktop Office: after sign out/in, File > Account should show the licensed user and apps should no longer be in reduced functionality.

• Evidence to collect before opening support: tenant ID, affected UPN, precise UTC timestamps of assignment and troubleshooting steps, PowerShell output files saved as text, Service Health incident ID(s), portal screenshots showing license and service plan state, and exported sign‑in/audit log entries that show failures or Conditional Access denials.

• When to escalate to Microsoft Support:
• After you’ve allowed the usual propagation window (allow up to 60 minutes after reassignment) and desktop/web states disagree or provisioning never reaches the user object.
• If you have a Service Health incident, open a ticket to request your tenant be included only if the portal indicates it isn’t already.
• If Azure AD Connect shows sync errors or duplicate identity collisions you can’t safely resolve, escalate with the sync logs attached.

• What to include in the support ticket: tenant ID, UPN, exact UTC timestamps, PowerShell outputs (Get-MgUserLicenseDetail, Get-MgSubscribedSku), steps you tried (remove/reassign, client sign out, sync run), Service Health IDs, and exported sign‑in/audit logs. These let Microsoft correlate backend logs faster.

• Safe rollback / reassign checklist to avoid disruption:
• Before removing licenses from a user with data, save the current license snapshot and note assignment groups.
• To revert, reassign the original SKU and ensure DisabledPlans match the snapshot. Do this during a maintenance window if the user has heavy Exchange/OneDrive activity.

• Final decision rule: if portal and PowerShell both show the correct license and web apps work but the desktop still shows unlicensed after full sign‑out, repair and credential removal, treat this as a client problem. If portal/PowerShell disagree or provisioning never reached the user object, escalate with the captured evidence.