Microsoft Entra ID : How to find the License Assignment Path for Specific Account SKUID

 Hello All

Sometimes, you need to find out  if user license are  assigned directly or inherited from a group based licensed for specific  Account SKUID to optimise the license 

Microsoft has given a excellent script for us to pull the above information in the below link

https://learn.microsoft.com/en-us/entra/identity/users/licensing-ps-examples

However, i found two setback's in the above Microsoft  page personally

1. Export option is not available

2. The output returns only Object ID 

Hence i decided to achieve the above goals by editing few lines in the script . 

There are two scripts available in this blog. first script it will export the output into CSV with you have specify  the account SKU ID , in my case "2t6xvv:FLOW_FREE"

connect the MSOL service and run the script

Script 1

#Returns TRUE if the user has the license assigned directly

function UserHasLicenseAssignedDirectly

{

    Param([Microsoft.Online.Administration.User]$user, [string]$skuId)

    foreach($license in $user.Licenses)

    {

        #we look for the specific license SKU in all licenses assigned to the user

        if ($license.AccountSkuId -ieq $skuId)

        {

            #GroupsAssigningLicense contains a collection of IDs of objects assigning the license

            #This could be a group object or a user object (contrary to what the name suggests)

            #If the collection is empty, this means the license is assigned directly - this is the case for users who have never been licensed via groups in the past

            if ($license.GroupsAssigningLicense.Count -eq 0)

            {

                return $true

            }

            #If the collection contains the ID of the user object, this means the license is assigned directly

            #Note: the license may also be assigned through one or more groups in addition to being assigned directly

            foreach ($assignmentSource in $license.GroupsAssigningLicense)

            {

                if ($assignmentSource -ieq $user.ObjectId)

                {

                    return $true

                }

            }

            return $false

        }

    }

    return $false

}

#Returns TRUE if the user is inheriting the license from a group

function UserHasLicenseAssignedFromGroup

{

    Param([Microsoft.Online.Administration.User]$user, [string]$skuId)

    foreach($license in $user.Licenses)

    {

        #we look for the specific license SKU in all licenses assigned to the user

        if ($license.AccountSkuId -ieq $skuId)

        {

            #GroupsAssigningLicense contains a collection of IDs of objects assigning the license

            #This could be a group object or a user object (contrary to what the name suggests)

            foreach ($assignmentSource in $license.GroupsAssigningLicense)

            {

                #If the collection contains at least one ID not matching the user ID this means that the license is inherited from a group.

                #Note: the license may also be assigned directly in addition to being inherited

                if ($assignmentSource -ine $user.ObjectId)

                {

                    return $true

                }

            }

            return $false

        }

    }

    return $false

}

#the license SKU we are interested in. use Get-MsolAccountSku to see a list of all identifiers in your organization

$skuId = "2t6xvv:FLOW_FREE"

#find all users that have the SKU license assigned

$Output = Get-MsolUser -All | where {$_.isLicensed -eq $true -and $_.Licenses.AccountSKUID -eq $skuId} | select `

    ObjectId, `

    @{Name="SkuId";Expression={$skuId}}, `

    @{Name="AssignedDirectly";Expression={(UserHasLicenseAssignedDirectly $_ $skuId)}}, `

    @{Name="AssignedFromGroup";Expression={(UserHasLicenseAssignedFromGroup $_ $skuId)}}

$Output | Export-CSV -path "C:\Temp\FLOW_FREEinfo.csv" -append

=========================================================================

Output 

Script 2

=========================================================================

Copy all the Object Ids from the output of script 1 and Keep in TXT file

$collection=@()

get-content "C:\Temp\objectsid.txt" | ForEach-Object{

$coll = “” | Select Objectid,userprincipalName

$msoluser = get-msoluser -objectid $_.trim() | Select Objectid,userprincipalName

$coll.objectid = $_.trim()

if($msoluser){

$coll.userprincipalName= $msoluser.userprincipalName

}

else{

$coll.userprincipalName = “Not Found”

}

$collection+=$coll

$coll

}

$collection | export-csv c:\temp\objid2upn.csv -notypeinfo

=========================================================================

Output 

I hope this would be useful script to find out  the  License Assignment Path in Microsoft entra ID and Happy Learning 😃