Reassign a Microsoft 365 license to fix unlicensed apps

Short answer: an 'Unlicensed' Office or Teams error means the user lacks an appropriate Microsoft 365 SKU, the assignment hasn't propagated, or sign-in/conditional access is blocking token issuance. Do the pre-checks, add the replacement SKU first (Admin Center or Graph/PowerShell), force a client sign-in to refresh tokens, then remove the old SKU only after the user confirms access. Collect audit and sign-in logs before and after the change so you can roll back or escalate with evidence if needed.

What the user sees when apps show 'unlicensed'

Direct answer: users see activation banners, disabled commands, or sign-in loops. Capture screenshots and timestamps before you change anything.

• Office desktop apps: activation banners, read-only notices, or prompts like Product deactivated or Account does not have a license for Office.

• Teams (desktop/web/mobile): a feature-limiting banner, inability to join meetings, or a sign-in loop on mobile.

• Web apps: some commands are disabled, or you get a licensing-required prompt when using mailbox, OneDrive, or SharePoint features.

• Portal and diagnostics: Entra ID sign-in entries can show token issuance failures or messages about missing license entitlement. The admin center may show the user’s licenses as None or not list the expected SKU.

Before you start (applicability and pre-change checklist)

Direct answer: run a short checklist to confirm the account, directory sync, SKU availability, and Conditional Access status before you change licenses.

• Confirm account sign-in state:
• Check the user is Enabled and not blocked for sign-in in Entra ID.
• Confirm authentication works (password not expired, not locked out) and note if they use pass-through or federated auth.

• Check directory sync and hybrid conditions:
• If you use AAD Connect, confirm the last sync time and that the on-prem object does not conflict with the cloud object.

• Verify license availability and SKU suitability:
• Confirm spare licenses exist and the SKU includes required services (Office apps, Exchange Online, OneDrive). Record available counts before changing assignments.

• Review Conditional Access, MFA and sign-in blocks:
• Check recent Entra sign-in entries for Conditional Access denials or MFA failures that could block tokens.

• Group-based licensing and special account types:
• If group-based licensing applies, check group membership and the group's license assignment. Guest, resource, and shared mailbox accounts can be ineligible for some SKUs.

• Record rollback artifacts now:
• Export or screenshot the user’s Assigned licenses, license details, and group memberships that grant licenses.

Safe reassignment: Admin Center (GUI) — add then remove

Direct answer: add the replacement SKU first, confirm the user can sign in and use services, then remove the old SKU.

1. Open the Microsoft 365 admin center and go to Users > Active users.
2. Search for and select the affected user.
3. Click Licenses and apps (or the current UI label for license assignment).
4. Record the current license selections with a screenshot or export.
5. Toggle ON the replacement SKU; leave the existing SKU enabled.
6. Click Save and note the success confirmation.
7. Ask the user to sign out of Office apps and sign back in (see client refresh section) and confirm services work.
8. Once the user confirms apps are active, return to Licenses and apps and remove the old SKU, then Save.

Safe reassignment: PowerShell / Microsoft Graph (minimal, auditable)

Direct answer: use Microsoft Graph PowerShell to script changes, save command output for audit, and perform add-only then remove steps.

1. Connect to Microsoft Graph with the least-privilege scopes you need.

Connect-MgGraph -Scopes "User.ReadWrite.All","Directory.Read.All"

2. Capture current license state for audit.

Get-MgUser -UserId user@contoso.com | Select-Object Id,UserPrincipalName,@{n='Licenses';e={(Get-MgUserLicenseDetail -UserId $_.Id).SkuId}} | Out-File C:\temp\user-license-before.txt

3. Assign the replacement SKU (add-only step).

$assign = @{AddLicenses = @(@{SkuId = "<sku-guid>"});RemoveLicenses = @()}
Add-MgUserLicense -UserId user@contoso.com -BodyParameter $assign | Out-File C:\temp\assign-output.txt

4. Verify the license now appears on the user object.

Get-MgUserLicenseDetail -UserId user@contoso.com | Out-File C:\temp\user-license-after-add.txt

5. After the user confirms apps are active, remove the old SKU.

$swap = @{AddLicenses = @();RemoveLicenses = @("<old-sku-guid>")}
Add-MgUserLicense -UserId user@contoso.com -BodyParameter $swap | Out-File C:\temp\remove-output.txt

Permissions: you need Global Administrator, User Administrator, or a role with license assignment permission in Entra. Group-based license changes may require Group Owner or Global Admin depending on configuration.

Force client-side refresh and expected timing

Direct answer: propagation often takes minutes; sign out and sign back in to force token refresh. If desktop apps still show unlicensed, cached tokens or Conditional Access blocks are common causes.

Expected propagation: often minutes, sometimes longer if directory sync or tenant conditions add delay.

Client steps to run or instruct the user to do:

1. Sign out of all Office apps and close them.
2. In Office apps: File > Account > Sign out, then close the app.
3. On Windows, remove cached credentials: Settings > Accounts > Access work or school > disconnect any stale entries.
4. Restart the device.
5. Open an Office app and sign in when prompted; complete MFA if enforced.
6. For Teams: sign out and sign back in. To clear Teams cache, quit Teams and delete the folder %appdata%\Microsoft\Teams\Cache.

Server-side checks to watch while the user refreshes:

• Entra sign-in entries: look for a successful token issuance event after the license change.
• Microsoft 365 admin center: the user should show the replacement SKU as Assigned.
• Audit logs: license assignment events should appear in the Unified Audit log and Entra audit logs.

Verification: what to collect and how to tell the change worked

Direct answer: confirm the replacement SKU is Assigned in the portal and the user can perform key actions. Collect sign-in and audit logs and your PowerShell output files.

1. Portal indicators:

• In Entra or the admin center, the user shows the replacement SKU as Assigned.

2. Sign-in and service tests (ask the user to do these):

• Open Word or Excel and create, edit, and save a document.
• Access Outlook on the web and send/receive mail.
• Open OneDrive and upload a test file.
• Sign into Teams and join a test meeting.

3. Logs to collect:

• Entra sign-in entries for the user showing post-change successful token issuance.
• Entra audit logs or Microsoft 365 Audit log entries for the license add/remove actions.
• PowerShell output files captured during the change: user-license-before.txt, assign-output.txt, user-license-after-add.txt, remove-output.txt.

Expected success: the user can edit documents, access mailbox and OneDrive, and Teams features return. Server logs show a successful license assignment and token issuance after the change.

Quick failure-mode playbook and rollback

Direct answer: if the user still shows 'Unlicensed', check client sign-in, Conditional Access, group-based licensing, and directory sync. If needed, roll back by reassigning the original SKU and have the user sign back in.

Common failures and quick remedies:

• Symptom: user still shows 'Unlicensed' after reassignment.
• Remedy: confirm the user signed out and back in to refresh tokens. Check Entra sign-in entries for Conditional Access denials or MFA blocks. If group-based licensing is in use, verify group changes propagated.

• Symptom: admin center shows license assigned but apps deny features.
• Remedy: confirm AAD Connect sync if hybrid, verify the SKU contains the required service, and force a client token refresh by reauthenticating.

Rollback (undo the reassignment):

1. Record the current state: capture the user's current assigned licenses and relevant logs.
2. Reassign the original SKU using Admin Center or PowerShell.

$assign = @{AddLicenses=@(@{SkuId="<original-sku-guid>"});RemoveLicenses=@()}
Add-MgUserLicense -UserId user@contoso.com -BodyParameter $assign | Out-File C:\temp\rollback-output.txt

3. Ask the user to sign out and sign back in and verify service access.

What to collect before opening a Microsoft support ticket:

• Screenshots of the user error and the admin center license view.
• Entra sign-in entries with timestamps showing failures or denials.
• PowerShell capture files from before and after commands.
• Exact reproduction steps and the time window when you saw failures.

Minimum roles and tenant settings that can block reassignment

Direct answer: you need Global Admin, User Admin, or a License Admin role to assign licenses. Tenant settings like blocked sign-in, assignment rules, or directory sync conflicts can block reassignment.

Minimum admin roles required:

• Global Administrator or User Administrator to assign and remove licenses directly.
• License Administrator for most license management tasks.
• Group Owner or Global Administrator to change group-based license membership depending on tenant setup.

Tenant-level settings that block reassignment:

• Blocked sign-in: a user set to block sign-in prevents token issuance even if licensed.
• License restrictions or assignment rules: policies that prevent certain SKUs from being assigned.
• Directory sync conflicts: an on-prem object state that prevents cloud-side changes from persisting.
• Lack of available licenses: no spare seats of the SKU to assign.

If any apply, resolve them before a per-user reassignment and capture who made the setting when escalating.

Conclusion

If a user sees an 'Unlicensed' app error, run the pre-checks, add the replacement SKU first (Admin Center or Graph/PowerShell), force a client sign-in to refresh tokens, then remove the old SKU only after the user confirms access. Collect audit and sign-in logs before and after the change so you can roll back or escalate with evidence if needed.