Set-MgBetaUserLicense not working

[AlyaKoni]

Describe the bug

The cmdlet:

Set-MgBetaUserLicense -UserId $adUser.Id -AddLicenses @{SkuId = $Sku.SkuId} -RemoveLicenses @()

gives error:

Set-MgBetaUserLicense_AssignExpanded: D:\Repos\PFIBDO-ADM-CloudConfiguration\scripts\aad\Configure-Licenses.ps1:261:25
Line |
 261 |  …             Set-MgBetaUserLicense -UserId $adUser.Id -AddLicenses @(@ …
     |                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | One or more parameters of the operation 'assignLicense' are missing from the request payload. The missing parameters are: removeLicenses.  Status: 400        
     | (BadRequest) ErrorCode: Request_BadRequest Date: 2025-02-28T20:04:03  Headers: Cache-Control                 : no-cache Vary                          :       
     | Accept-Encoding Strict-Transport-Security     : max-age=31536000 request-id                    : cffa816c-c9ce-468f-843b-0b38595f1df8 client-request-id       
     | : 32915540-5cf1-4543-a811-3bbb3ba324e5 x-ms-ags-diagnostic           : {"ServerInfo":{"DataCenter":"Switzerland
     | North","Slice":"E","Ring":"3","ScaleUnit":"000","RoleInstance":"ZR1PEPF00000664"}} Link                          :
     | <https://developer.microsoft-tst.com/en-us/graph/changes?$filterby=beta,Users&from=2022-02-01&to=2022-03-01>;rel="deprecation";type="text/html" deprecation   
     | : Thu, 17 Feb 2022 23:59:59 GMT sunset                        : Sat, 17 Feb 2024 23:59:59 GMT x-ms-resource-unit            : 1 Date                          
     | : Fri, 28 Feb 2025 20:04:03 GMT

  Recommendation: See service error codes: https://learn.microsoft.com/graph/errors

This code was working in the past.

Expected behavior

It should be possible to assing just a license without removing one. This has be done in the past by adding an empty array in the RemoveLicenses parameter like documented.

How to reproduce

Try to assign a license without removing one.

SDK Version

ModuleType Version PreRelease Name ExportedCommands ---------- ------- ---------- ---- ---------------- Script 2.26.1 Microsoft.Graph.Authentication {Add-MgEnvironment, Connect-MgGraph, Disconnect-MgGraph, Get-MgContext…} Script 2.26.1 Microsoft.Graph.Beta.Applications {Add-MgBetaApplicationKey, Add-MgBetaApplicationPassword, Add-MgBetaServicePrincipalTokenSigni… Script 2.26.1 Microsoft.Graph.Beta.Groups {Add-MgBetaGroupFavorite, Add-MgBetaGroupSiteContentModelGetByNameToDrive, Add-MgBetaGroupToLi… Script 2.26.1 Microsoft.Graph.Beta.Identity.Dire… {Complete-MgBetaDirectoryImpactedResource, Complete-MgBetaDirectoryRecommendation, Complete-Mg… Script 2.26.1 Microsoft.Graph.Beta.Identity.Gove… {Add-MgBetaAccessReviewDecision, Add-MgBetaAccessReviewInstanceDecision, Add-MgBetaIdentityGov… Script 2.26.1 Microsoft.Graph.Beta.Identity.Sign… {Confirm-MgBetaInformationProtectionSignature, Confirm-MgBetaRiskyServicePrincipalCompromised,… Script 2.26.1 Microsoft.Graph.Beta.Users {Complete-MgBetaUserOutlookTask, Complete-MgBetaUserOutlookTaskFolderTask, Complete-MgBetaUser… Script 2.26.1 Microsoft.Graph.Beta.Users.Actions {Clear-MgBetaUserAndBlockManagedApp, Clear-MgBetaUserManagedAppRegistrationByAzureAdDeviceId, …

Latest version known to work for scenario above?

2.25.X

Known Workarounds

Downgrading module could work may does not have to

Debug output

Click to expand log

```

DEBUG: [CmdletBeginProcessing]: - Set-MgBetaUserLicense begin processing with parameterSet 'AssignExpanded'.
DEBUG: [Authentication]: - AuthType: 'Delegated', TokenCredentialType: 'InteractiveBrowser', ContextScope: 'CurrentUser', AppName: 'Microsoft Graph Command Line Tools'.
DEBUG: [Authentication]: - Scopes: [Application.ReadWrite.All, AppRoleAssignment.ReadWrite.All, AuditLog.Read.All, ChannelMessage.Send, Contacts.Read, CrossTenantInformation.ReadBasic.All, DelegatedPermissionGrant.ReadWrite.All, DeviceManagementApps.Read.All, DeviceManagementApps.ReadWrite.All, DeviceManagementConfiguration.Read.All, DeviceManagementConfiguration.ReadWrite.All, DeviceManagementManagedDevices.Read.All, DeviceManagementManagedDevices.ReadWrite.All, DeviceManagementRBAC.Read.All, DeviceManagementServiceConfig.Read.All, DeviceManagementServiceConfig.ReadWrite.All, Directory.AccessAsUser.All, Directory.Read.All, Directory.ReadWrite.All, Domain.ReadWrite.All, email, Group.ReadWrite.All, GroupMember.ReadWrite.All, openid, Organization.ReadWrite.All, OrganizationalBranding.ReadWrite.All, Policy.Read.All, Policy.ReadWrite.AuthenticationMethod, Policy.ReadWrite.Authorization, Policy.ReadWrite.ConditionalAccess, Policy.ReadWrite.CrossTenantAccess, Policy.ReadWrite.DeviceConfiguration, Policy.ReadWrite.PermissionGrant, profile, RoleAssignmentSchedule.ReadWrite.Directory, RoleEligibilitySchedule.Read.Directory, RoleEligibilitySchedule.ReadWrite.Directory, RoleManagement.Read.All, RoleManagement.ReadWrite.Directory, SharePointTenantSettings.ReadWrite.All, TeamMember.ReadWrite.All, TeamsApp.ReadWrite.All, TeamsAppInstallation.ReadWriteForTeam, TeamsAppInstallation.ReadWriteSelfForTeam, TeamSettings.ReadWrite.All, TeamsTab.ReadWrite.All, User.Read.All, User.ReadWrite.All, UserAuthenticationMethod.Read.All, UserAuthenticationMethod.ReadWrite.All, WindowsUpdates.ReadWrite.All].

Confirm
Are you sure you want to perform this action?
Performing the operation "Set-MgBetaUserLicense_AssignExpanded" on target "Call remote 'POST /users/{user-id}/microsoft.graph.assignLicense' operation".
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y"): A
DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
POST

Absolute Uri:
https://graph.microsoft.com/beta/users/0e88beff-7c45-4bc2-9631-bca7e7e0908b/microsoft.graph.assignLicense

Headers:
FeatureFlag : 00000003
Cache-Control : no-store, no-cache
User-Agent : Mozilla/5.0,(Windows NT 10.0; Microsoft Windows 10.0.26100; de-CH),PowerShell/2025.0.0
SdkVersion : graph-powershell-beta/2.26.1
client-request-id : fb641a05-b41d-4fb6-ab26-24d6bb4974d9
Accept-Encoding : gzip,deflate,br

Body:
{
"addLicenses": [
{
"skuId": "f245ecc8-75af-4f8e-b61f-27d8114de5f3"
}
]
}

DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
BadRequest

Headers:
Cache-Control : no-cache
Vary : Accept-Encoding
Strict-Transport-Security : max-age=31536000
request-id : 974af0e7-9da6-49f6-83e8-c257c2b9a881
client-request-id : fb641a05-b41d-4fb6-ab26-24d6bb4974d9
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"Switzerland North","Slice":"E","Ring":"3","ScaleUnit":"000","RoleInstance":"ZR1PEPF0000066C"}}
Link : https://developer.microsoft-tst.com/en-us/graph/changes?$filterby=beta,Users&from=2022-02-01&to=2022-03-01;rel="deprecation";type="text/html"
deprecation : Thu, 17 Feb 2022 23:59:59 GMT
sunset : Sat, 17 Feb 2024 23:59:59 GMT
x-ms-resource-unit : 1
Date : Fri, 28 Feb 2025 20:06:39 GMT

Body:
{
"error": {
"code": "Request_BadRequest",
"message": "One or more parameters of the operation 'assignLicense' are missing from the request payload. The missing parameters are: removeLicenses.",
"innerError": {
"date": "2025-02-28T20:06:39",
"request-id": "974af0e7-9da6-49f6-83e8-c257c2b9a881",
"client-request-id": "fb641a05-b41d-4fb6-ab26-24d6bb4974d9"
}
}
}

Set-MgBetaUserLicense_AssignExpanded: D:\Repos\PFIBDO-ADM-CloudConfiguration\scripts\aad\Configure-Licenses.ps1:261:25
Line |
261 | … Set-MgBetaUserLicense -UserId $adUser.Id -AddLicenses @(@ …
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| One or more parameters of the operation 'assignLicense' are missing from the request payload. The missing parameters are: removeLicenses. Status: 400
| (BadRequest) ErrorCode: Request_BadRequest Date: 2025-02-28T20:06:39 Headers: Cache-Control : no-cache Vary :
| Accept-Encoding Strict-Transport-Security : max-age=31536000 request-id : 974af0e7-9da6-49f6-83e8-c257c2b9a881 client-request-id
| : fb641a05-b41d-4fb6-ab26-24d6bb4974d9 x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"Switzerland
| North","Slice":"E","Ring":"3","ScaleUnit":"000","RoleInstance":"ZR1PEPF0000066C"}} Link :
| https://developer.microsoft-tst.com/en-us/graph/changes?$filterby=beta,Users&from=2022-02-01&to=2022-03-01;rel="deprecation";type="text/html" deprecation
| : Thu, 17 Feb 2022 23:59:59 GMT sunset : Sat, 17 Feb 2024 23:59:59 GMT x-ms-resource-unit : 1 Date
| : Fri, 28 Feb 2025 20:06:39 GMT

Recommendation: See service error codes: https://learn.microsoft.com/graph/errors

</details>


### Configuration

PS D:\Repos\PFIBDO-ADM-CloudConfiguration> $PSVersionTable 

Name                           Value
----                           -----
PSVersion                      7.5.0
PSEdition                      Core
GitCommitId                    7.5.0
OS                             Microsoft Windows 10.0.26100
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

Architecture: x64

### Other information

_No response_

[12Knocksinna]

also fails with Set-MgUserLicense

Set-MgUserLicense -UserId $User.Id -AddLicenses @{} -RemoveLicenses @($CopilotSKUId) -debug

Are you sure you want to perform this action?
Performing the operation "Set-MgUserLicense_AssignExpanded" on target "Call remote 'POST /users/{user-id}/microsoft.graph.assignLicense' operation".
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y"): y
DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
POST

Absolute Uri:
https://graph.microsoft.com/v1.0/users/7bfd3f83-be63-4a5a-bbf8-c821e2836920/microsoft.graph.assignLicense

Headers:
FeatureFlag : 00000003
Cache-Control : no-store, no-cache
User-Agent : Mozilla/5.0,(Windows NT 10.0; Microsoft Windows 10.0.26100; en-IE),PowerShell/7.5.0
SdkVersion : graph-powershell/2.26.1
client-request-id : 0ad8891c-1037-4af5-a71a-38f94164bf9c
Accept-Encoding : gzip,deflate,br

Body:
{
"removeLicenses": [
"639dec6b-bb19-468b-871c-c5c441c4b0cb"
]
}

DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
BadRequest

Headers:
Cache-Control : no-cache
Vary : Accept-Encoding
Strict-Transport-Security : max-age=31536000
request-id : 6536ca95-0dca-41ad-9852-b02e685d9eab
client-request-id : 0ad8891c-1037-4af5-a71a-38f94164bf9c
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"North Europe","Slice":"E","Ring":"4","ScaleUnit":"005","RoleInstance":"DU6PEPF00002DC3"}}
x-ms-resource-unit : 1
Date : Mon, 03 Mar 2025 09:53:07 GMT

Body:
{
"error": {
"code": "Request_BadRequest",
"message": "One or more parameters of the operation 'assignLicense' are missing from the request payload. The missing parameters are: addLicenses.",
"innerError": {
"date": "2025-03-03T09:53:08",
"request-id": "6536ca95-0dca-41ad-9852-b02e685d9eab",
"client-request-id": "0ad8891c-1037-4af5-a71a-38f94164bf9c"
}
}
}

[jcot456]

Same issue for me with Set-MgUserLicense. I thought I was losing my mind. Glad I found I am not the only one.

[nkokkos]

Same issue for me with Set-MgUserLicense. I thought I was losing my mind. Glad I found I am not the only one.

Same here trying with Set-MgUserLicense. I even tried two different versions of powershell: 7.5 and 5.1. Nothing

[lbton]

Same here with "Set-MgBetaUserLicense".

One or more parameters of the operation 'assignLicense' are missing from the request payload. The missing parameters are: removeLicenses.
Status: 400 (BadRequest)
ErrorCode: Request_BadRequest
Date: 2025-03-04T16:18:40

This error is happening on a script which as been working for months without issue, up until today.

Steps taken:

• Update-Module -Name Microsoft.Graph.Beta
• Verified that the correct scope is being used while connecting to MgGraph (According to Microsoft - "The Organization.Read.All permission scope is required to read the licenses available in the tenant:"

"Connect-MgGraph -Scopes "User.ReadWrite.All", "Group.ReadWrite.All", "Organization.Read.All""

The issue persists after taking the above steps. I'm setting licenses manually for the time being.

[drouck74]

Same issue here. Tryed to downgrade all modules , same issue. issue could be to api callee?

[lovepreetenflick]

Same issue here

[magoogle]

Same problem here, previous version I had installed had no problems. Literally Just updated, then found myself here with the same problem.

[Argboi]

Running into the same issue. Downgrading does not resolve either.

[magoogle]

Running into the same issue. Downgrading does not resolve either.

Downtrade to: 2.24, mine is working again on this version.

Uninstall all graph modules then Install-Module -Name Microsoft.Graph -RequiredVersion 2.24.0

[jmartelgit]

Invoke-MgGraphRequest POST "v1.0/users/$userUPN/assignLicense" -Body @{
addLicenses = @()
removeLicenses = @($skuID)
}

That is the ONLY thing that worked for me today! I do have already remove ALL Ms-Graph and now, I did reinstall 2.26.1
Working good so far!

[Argboi]

Running into the same issue. Downgrading does not resolve either.

Downtrade to: 2.24, mine is working again on this version.

Uninstall all graph modules then Install-Module -Name Microsoft.Graph -RequiredVersion 2.24.0

This worked for me! I used this script (https://blog.icewolf.ch/archive/2022/03/18/cleanup-microsoft-graph-powershell-modules/ #) and changed the last line to Install-Module -Name Microsoft.Graph -RequiredVersion 2.24.0

@magoogle Thanks a ton!
@drouck74 hopefully it works for you as well.

[drouck74]

Invoke-MgGraphRequest POST "v1.0/users/$userUPN/assignLicense" -Body @{ addLicenses = @() removeLicenses = @($skuID) }

That is the ONLY thing that worked for me today! I do have already remove ALL Ms-Graph and now, I did reinstall 2.26.1 Working good so far!

Thanks @jmartelgit i finally choose this way that's give me the possibility to keep last release of module.

[salbeck-sit]

You can also do > Set-MgUserLicense -UserId $upn -BodyParameter @{addLicenses = @(); removeLicenses = @($skuID)}
In thta respect it's a little like Invoke-MgGraphRequest but params are more specific to the task.

[jmartelgit]

@salbeck-sit , the set command is not working anymore.. that is the purpose of this long thread ;)

[nkokkos]

When is the next release? It is still unworkable

[PSNobbi]

I hope this helps:

#addLicenses
$EmsSku = Get-MgBetaSubscribedSku | Where SkuPartNumber -eq 'EMSPREMIUM'
$userId = (Get-MgBetaUser -UserId XXXXX@XXXXXXXXXX.com).Id
$body = @{
     "addLicenses" = @(
         @{
             "skuId" = $EmsSku.SkuId
         }
     )
     "removeLicenses" = @()
} 
Invoke-MgGraphRequest POST "v1.0/users/$userId/assignLicense" -Body $body

# removeLicenses
$EmsSku = Get-MgBetaSubscribedSku | Where SkuPartNumber -eq 'EMSPREMIUM'
$userId = (Get-MgBetaUser -UserId XXXXX@XXXXXXXXXX.com).Id
$body = @{
    "addLicenses" = @()
    "removeLicenses" = @($EmsSku.SkuId)
}
Invoke-MgGraphRequest POST "v1.0/users/$userId/assignLicense" -Body $body

[jmartelgit]

@PSNobbi , yes! i did wrote exactly the same above!

removeLicenses

$EmsSku = Get-MgBetaSubscribedSku | Where SkuPartNumber -eq 'EMSPREMIUM'
$userId = (Get-MgBetaUser -UserId XXXXX@XXXXXXXXXX.com).Id
$body = @{
"addLicenses" = @()
"removeLicenses" = @($EmsSku.SkuId)
}
Invoke-MgGraphRequest POST "v1.0/users/$userId/assignLicense" -Body $body

[amaiman]

@timayabi2020 Why does Microsoft not have unit tests in place for these cmdlets that must pass prior to release? This never should have been released with the cmdlet being completely non-functional due to this bug. Sure, I can use Invoke-MgGraphRequest to work around the bug, but the whole point of Graph PowerShell existing is so that scripts can be built without needing to do that, and releases need to not break past functionality.

[itmachinist]

There still has not been a new version pushed and this is still broken.

[Paul398516]

The latest module has been released.
https://www.powershellgallery.com/packages/Microsoft.Graph/2.27.0

However, even with the latest version, I get an error when I run "Set-MgUserLicense -UserId $userUPN -AddLicenses @{SkuId = ""} -RemoveLicenses @()".
When will this be fixed?

[simongeary]

Upgrading to 2.27.0 does fix it for me, the command is working normally again.

[jcot456]

Not fixed for me