GuidesOctober 28, 2026 · 7 min read

Remove licenses from disabled users with PowerShell

Blocking sign-in or disabling an account in Microsoft Entra ID stops the person getting in. It does nothing to the licenses on the account, so a disabled leaver keeps holding an E3 or E5 until someone removes it. This guide finds those accounts with Microsoft Graph PowerShell, turns license IDs into product names, removes the direct assignments, deals with licenses that come from groups, and then covers the step most clean-ups skip: getting the saving onto the invoice.

Want the list without the script?

Sentsai’s free, read-only scan finds paid licenses still assigned to disabled accounts and disabled guests, plus purchased licenses nobody holds. The free scan shows the savings total; the itemized report is paid.

Start your free scan See a sample report

Needs a one-time approval of read-only access from an administrator who can approve apps. Not an admin? Email this to yours.

Before you start

Use the Microsoft Graph PowerShell SDK. The MSOnline module was retired in May 2025 and the AzureAD module is deprecated, so scripts built on Get-MsolUser or Set-MsolUserLicense need rewriting, not reviving. Do the discovery with read-only permissions, review the output, and only then connect with write access for the removal.

To read users and licenses: User.Read.All, plus LicenseAssignment.Read.All (or Organization.Read.All) to read the tenant’s SKUs.
To remove licenses: LicenseAssignment.ReadWrite.All is the least privileged permission, and your account needs the License Administrator, User Administrator or Directory Writers role.

Step 1: find disabled accounts that still hold licenses

A disabled account has accountEnabled set to false, and assignedLicenses lists every license it holds, whether assigned directly or inherited from a group. Counting a collection inside a filter is an advanced query in Microsoft Graph, so the command needs -ConsistencyLevel eventual and a count variable. The backtick before $count stops PowerShell reading it as a variable of its own.

Connect read-only

Connect-MgGraph -Scopes "User.Read.All", "LicenseAssignment.Read.All"

Disabled and still licensed

$disabled = Get-MgUser -Filter "accountEnabled eq false and assignedLicenses/`$count ne 0" -ConsistencyLevel eventual -CountVariable disabledCount -All -Property Id, DisplayName, UserPrincipalName, UserType, AssignedLicenses, LicenseAssignmentStates

$disabledCount now holds the number found. Licensed guests that have been disabled appear too, with a UserType of Guest, and they are usually the easiest removals of all.

Step 2: turn SKU IDs into product names

assignedLicenses holds SKU IDs, which are GUIDs. Get-MgSubscribedSku returns each SKU in the tenant with its skuPartNumber, such as SPE_E3 for Microsoft 365 E3, so build a lookup table once and export a readable list to review.

SKU lookup

$sku = @{}; Get-MgSubscribedSku -All | ForEach-Object { $sku[$_.SkuId] = $_.SkuPartNumber }

Readable list for review

$disabled | Select-Object DisplayName, UserPrincipalName, @{n="Licenses"; e={ ($_.AssignedLicenses.SkuId | ForEach-Object { $sku[$_] }) -join ", " }} | Export-Csv .\disabled-licensed.csv -NoTypeInformation

Read the file before changing anything. Some former staff are kept licensed on purpose: a mailbox under litigation hold, a manager who still needs access to the mailbox, an account retained for a legal or HR reason. Those are decisions to confirm with their owners, not waste.

Step 3: check for licenses that come from groups

With group-based licensing, some of these licenses were never assigned to the user. They come from membership of a licensed group, and a license inherited from a group cannot be removed from the user directly; Graph rejects the request. The licenseAssignmentStates property shows which is which: each entry has a skuId and an assignedByGroup value that is empty for a direct assignment and holds the group’s object ID for an inherited one.

Licenses inherited from groups

$disabled | ForEach-Object { $u = $_; $u.LicenseAssignmentStates | Where-Object { $_.AssignedByGroup } | Select-Object @{n="User"; e={$u.UserPrincipalName}}, @{n="License"; e={$sku[$_.SkuId]}}, AssignedByGroup }

To remove an inherited license, take the user out of the group, or, for a dynamic group, change its membership rule so disabled accounts drop out. If a user holds the same license both directly and through a group, it counts as one license, and removing only the direct copy changes nothing until the group membership goes too.

Step 4: remove the direct assignments

Connect again with write access. Set-MgUserLicense takes the SKU IDs to remove and an empty -AddLicenses value, which Microsoft’s own examples pass as @{}. Try one account first, then run the loop, which removes only the directly assigned licenses on each disabled account.

Connect with write access

Connect-MgGraph -Scopes "User.Read.All", "LicenseAssignment.ReadWrite.All"

Test on one account

$e3 = Get-MgSubscribedSku -All | Where-Object SkuPartNumber -eq "SPE_E3"; Set-MgUserLicense -UserId "leaver@contoso.com" -RemoveLicenses @($e3.SkuId) -AddLicenses @{}

Every direct license on every disabled account

foreach ($u in $disabled) { $direct = @($u.LicenseAssignmentStates | Where-Object { -not $_.AssignedByGroup } | Select-Object -ExpandProperty SkuId -Unique); if ($direct.Count -gt 0) { Set-MgUserLicense -UserId $u.Id -RemoveLicenses $direct -AddLicenses @{} | Out-Null } }

Removing all of a user’s direct licenses in one call avoids a dependency error, which Graph raises when you remove a license that another assigned license still depends on. Run Step 1 again afterwards: anything left is either inherited from a group or failed for a reason worth reading.

What happens to the mailbox and files

Exchange Online data is held for 30 days after the license is removed, then deleted and unrecoverable, except content kept by a retention policy or retention label.
Once the license is gone, the mailbox can no longer be searched with Content Search or eDiscovery (Premium).
OneDrive files are not deleted by removing the license. They go when the user account is deleted.
Enterprise plans such as Office 365 E3 can keep a deleted user’s mailbox as an inactive mailbox. If the mailbox must be kept, decide how before you remove the license, because the 30-day clock starts when you do.

Removing a license does not reduce the bill

This is where most of the saving gets lost. An unassigned license goes back into the pool and you keep paying for it, because you pay for the subscription quantity, not for assignments. Microsoft’s own instructions for reducing a subscription make it two steps: unassign licenses from users, then remove licenses from the subscription. When you can take the second step depends on how you buy:

Direct from Microsoft on a Microsoft Customer Agreement billing account: you can remove licenses within seven days of buying or renewing the subscription. After that window, a reduction takes effect at renewal and shows on the first invoice after the renewal date.
Through a Cloud Solution Provider partner on new commerce: the partner can lower a subscription’s license count only within seven days of those licenses being added, whether at purchase, renewal or mid-term. Otherwise it waits for the next renewal, and the partner can schedule the reduction for that date in advance.
Through a Microsoft representative or an Enterprise Agreement: quantities change on the agreement’s own cycle, and what can be reduced depends on your enrollment and the product terms. Ask your licensing partner or account team what can come down at the next anniversary, and the deadline for telling them.

Until renewal, the freed licenses still have value: assign them to new starters instead of buying more. Then carry the final count into the renewal so the reduction actually happens.

Let a read-only scan find them first

Sentsai finds these accounts for Microsoft 365, read-only, in minutes: paid licenses on disabled accounts and disabled guests, purchased licenses nobody holds, and group license assignments that Microsoft reports in an error state. It never removes a license itself; it shows you what to remove and what it costs. The free scan shows the total annual savings it identified, how many users it checked and how many compliance gaps it found. The itemized list, with every named account and license, costs 5% of the identified annual savings, with a $99 minimum.

Find every disabled account still holding a license

Read-only, for Microsoft 365, in minutes. The free scan shows the total annual savings and the headline counts; the itemized, named list costs 5% of identified annual savings, $99 minimum.

Start your free scan See a sample report first