Azure AD Direct to Group License Assignment Migration Scripts

PowerShell scripts to automate the migration from direct license assignment (in Office 365/Azure AD) to group-based licensing. This assumes you have on-prem AD and will be adding users to AD-based groups.

The scripts will do the following:

1. Script 1 — Assigns users to AD groups for individual plans (e.g. components of E3 such as Teams or Planner).
2. Script 2 — Assigns users to AD groups for complete SKUs (e.g. EMS).
3. Script 3 — Removes any direct assigned SKUs, leaving just the group-assigned plans and SKUs.

Connection Script

write-host "Checking connection"
try { 
    $var = Get-AzureADTenantDetail 
} catch [Microsoft.Open.Azure.AD.CommonLibrary.AadNeedAuthenticationException] { 
    Write-Host "Not connected, authenticate in other window"
    Connect-AzureAD
}

Script 1: Assign Individual Plans

This script maps service plans to AD groups, checking which direct assigned licenses the user has and adding them to the appropriate group. See the Service Plan ID reference for the full list of plan IDs.

Script 2: Assign Complete SKUs

This script is used when there are groups for complete SKUs (e.g. EMS, Visio). It adds users to the appropriate AD groups based on their directly assigned SKU licenses.

Script 3: Remove Direct Licenses

This script removes all direct licenses, leaving only inherited (group-based) licenses. Make sure the users have been added to all relevant groups first and wait at least 30 minutes for Azure AD to process the group changes.

Important: Test these scripts thoroughly in a non-production environment before using in production. Wait for AD sync to complete between scripts — at least one hour for Azure AD to process license changes.