Get the effective license mode for an Entra directory using PowerShell and Microsoft Graph - for example "Microsoft Entra ID P1"

You might find yourself needing to know the license mode of an Entra Directory tenant - as seen in the "Overview" screen of the Entra Admin UI - for example "Microsoft Entra ID P1".

This seems like it would be quite simple - install Microsoft Graph PowerShell and run Connect-MgGraph and then perhaps Get-MgOrganization...

Unfortunately it's not that simple, if you look for a Get-MgLicense command you'll also have an issue the cmdlets match the names in Graph which is subscribedSku.

It gets more complex because Entra licenses are actually per user whereas Entra displays the license as if it were a tenant (organization) wide license.

So what is actually happening is that the Entra Admin UI looks through all of the subscribed skus (licenses) and finds ones that are active and has one of the "AAD_*" service plans enabled. It then shows the best (most expensive) license that it finds.

The following PowerShell script performs that function.

 

function Get-EffectiveDirectoryLicenseServicePlanName {

    <#

    .SYNOPSIS

        Gets the effective license service plan name for the directory.

    .OUTPUTS

        String - The effective license service plan name (e.g. "Microsoft Entra ID P1").

    #>

 

    # Known service plan names that map to Entra editions

    $knownServicePlanNames = @("AAD_FREE", "AAD_BASIC", "AAD_PREMIUM", "AAD_PREMIUM_P2")

    $effectiveServicePlanNames = @()

 

    # Pull subscribed SKUs from Graph

    $skus = Get-MgSubscribedSku

 

    foreach ($sku in $skus) {

        # Only consider SKUs with capabilityStatus Enabled or Warning

        if ($sku.CapabilityStatus -ne "Enabled" -and $sku.CapabilityStatus -ne "Warning") {

            continue

        }

 

        $servicePlans = $sku.ServicePlans

        foreach ($plan in $servicePlans) {

            if ($knownServicePlanNames -notcontains $plan.ServicePlanName) { continue }

            if ($plan.ProvisioningStatus -ne "Success") { continue }

 

            $effectiveServicePlanNames += $plan.ServicePlanName

        }

    }

 

    if ($effectiveServicePlanNames -contains "AAD_PREMIUM_P2") { return "Microsoft Entra ID P2"; }

    if ($effectiveServicePlanNames -contains "AAD_PREMIUM")   { return "Microsoft Entra ID P1"; }

    if ($effectiveServicePlanNames -contains "AAD_BASIC")     { return "Microsoft Entra ID Basic"; }

    return "Microsoft Entra ID Free"

   

}

 

 

Connect-MgGraph -Scopes "Directory.Read.All";

Get-EffectiveDirectoryLicenseServicePlanName;