Group-based licensing errors in Microsoft 365: conflicts, usage location and fixes

Group-based licensing is the cleanest way to license Microsoft 365, until a few members end up without a mailbox or Teams while the group itself looks healthy. Assignment errors are recorded per user, so they are easy to miss. In this post I'll cover the error types, where they show up, how to list every affected user with Microsoft Graph PowerShell, and how to fix and reprocess them.

Symptoms#

• A user is a member of the licensing group, but has no mailbox, Teams tells them they need a licence, or Microsoft 365 Apps won't activate.
• In the Microsoft 365 admin center, Billing › Licenses › product › Errors & issues lists one or more users.
• Some members of a group received their licences and others didn't. When a group assigns several products and one of them can't be assigned to a user, that user doesn't get the other products from the group either.

Why it happens#

Group-based licensing is a Microsoft Entra ID feature that you now manage from the Microsoft 365 admin center. When you assign products to a group, the service evaluates every member separately and records the outcome in the user's licenseAssignmentStates collection: one entry per product, the source group in assignedByGroup, a state (Active, ActiveWithError, Disabled or Error) and an error value. The group assignment succeeds; individual members fail. These are the causes you'll meet:

A blank usage location doesn't cause an error: members licensed through a group inherit the tenant's location. That is convenient, but wrong for users in other countries, so set the value deliberately. You may also see LicenseAssignmentAttributeConcurrencyException in the Microsoft Entra audit logs when two groups assign the same product to one user at the same time; the service retries automatically and no action is needed.

How to fix it#

1. Find the users in error#

For one product, open Billing › Licenses, select the product, open Errors & issues and select a user to see the error type. For a tenant-wide, read-only list, use Microsoft Graph PowerShell:

Connect-MgGraph -Scopes "User.Read.All","Group.Read.All","Organization.Read.All"

# Readable product names
$sku = @{}
Get-MgSubscribedSku | ForEach-Object { $sku[$_.SkuId] = $_.SkuPartNumber }

# Groups with at least one member in error
Get-MgGroup -All -Filter "hasMembersWithLicenseErrors eq true" -Property Id,DisplayName |
    Select-Object DisplayName, Id

# Every assignment in error, with the group that caused it
Get-MgUser -All -Property Id,UserPrincipalName,UsageLocation,LicenseAssignmentStates |
    ForEach-Object {
        $u = $_
        $u.LicenseAssignmentStates |
            Where-Object { $_.Error -and $_.Error -ne 'None' } |
            ForEach-Object {
                [pscustomobject]@{
                    User          = $u.UserPrincipalName
                    UsageLocation = $u.UsageLocation
                    Product       = $sku[$_.SkuId]
                    State         = $_.State
                    Error         = $_.Error
                    ViaGroup      = $_.AssignedByGroup
                }
            }
    } | Format-Table -AutoSize

In a large tenant, enumerating every user takes a while; for a single group, Get-MgGroupMemberWithLicenseError -GroupId <id> -All returns only the members in error.

2. Fix the cause#

1. Not enough licences: compare purchased and consumed units, then reclaim licences from leavers or from users who also hold a redundant direct assignment, or buy more.
   PowerShell

   Get-MgSubscribedSku | Select-Object SkuPartNumber, ConsumedUnits,
       @{ n = 'Purchased'; e = { $_.PrepaidUnits.Enabled } }

2. Conflicting service plans: in the script output, look for another entry for the same user with an empty ViaGroup (a direct assignment) or a different group. Remove that product, or edit one assignment to switch off the conflicting plans. Remember that changing plans on the group affects every member.
3. Missing dependencies: re-enable the plan the other product relies on, or remove the dependent add-on before disabling the plan.
4. Usage location: set the correct two-letter country code. If your directory sync flows usage location from on-premises Active Directory, change it there instead, or the next sync cycle puts the old value back.
   PowerShell

   Update-MgUser -UserId "anna@contoso.com" -UsageLocation "EG"

5. Proxy address conflict: find the object that already holds the address in Exchange Online PowerShell, then remove the address from whichever object shouldn't have it. For synced objects, fix it on-premises; see Entra Connect sync errors and duplicate attributes.
   PowerShell

   Get-Recipient -Filter "EmailAddresses -eq 'anna@contoso.com'" |
       Format-List DisplayName, RecipientType, EmailAddresses

3. Reprocess the affected users#

Group-based licensing reacts to membership and assignment changes, but fixing a cause elsewhere, such as freeing up licences or removing a duplicate address, doesn't always trigger a new evaluation. Reprocess the users who are still in error (License Administrator or User Administrator role):

Connect-MgGraph -Scopes "User.ReadWrite.All","Group.Read.All"
$groupId = "<group object ID>"

Get-MgGroupMemberWithLicenseError -GroupId $groupId -All |
    ForEach-Object { Invoke-MgLicenseUser -UserId $_.Id | Out-Null }

Processing time depends on tenant size and load, so give large groups some time before you check again.

Verify the fix#

(Get-MgUser -UserId "anna@contoso.com" -Property LicenseAssignmentStates).LicenseAssignmentStates |
    Select-Object SkuId, AssignedByGroup, State, Error

• Good looks like State = Active, no error value (None), and AssignedByGroup showing your licensing group's object ID.
• Errors & issues for the product is empty, and the hasMembersWithLicenseErrors query no longer returns the group.
• The services follow: the mailbox appears in Exchange Online, Teams signs in normally and Microsoft 365 Apps activate. Mailbox provisioning can lag slightly behind the licence.

Prevent it next time#

• Set usage location at creation. Make it part of your provisioning flow, whether that is HR-driven provisioning, directory sync or a script.
• One licensing group per product and plan combination. Keep groups that assign conflicting products mutually exclusive; dynamic membership rules make this easier.
• Remove redundant direct assignments once users are covered by a group; Microsoft's PowerShell examples for group-based licensing include a pattern for it.
• Move users in the right order: add them to the destination group, confirm the new licence is active, then remove them from the old group. Removing first leaves them unlicensed until processing finishes.
• Avoid nested groups for licensing: only the group's direct user members receive the licences.
• Watch free units and schedule the read-only report above, so you find errors before users do.

References#

• Assign or unassign licenses to a group in the Microsoft 365 admin center
• PowerShell examples for group-based licensing