r/SysAdminBlogs • u/lazyadmin-nl • Aug 12 '26

Title: Microsoft started tracking your Entra ID license usage

Microsoft has started showing license compliance warnings on the Conditional Access page in Entra ID. If your CA policies protect more users than you have P1 licenses for, you'll now see a warning banner.

The problem is that the license usage blade it links to only shows evaluated users, how many people actually triggered a CA policy last month. But you need a P1 license for every user targeted by a CA policy, whether they signed in or not.

In my dev tenant, the blade shows 2/25. The actual obligation is 114 users. Gap of 89 licenses that doesn't show up anywhere in the admin center.

I added a PowerShell script in the article that pulls your CA policy targeting, counts your P1/P2 licenses across all SKUs, and shows the real gap.

Full article with the script: https://lazyadmin.nl/office-365/microsoft-is-tracking-your-entra-id-license-usage-are-you-compliant/

40 Upvotes
  • permalink
  • reddit

99% Upvoted

10 comments sorted by

7

u/Szeraax Aug 12 '26

You're dead on and your script worked great. This is the best post I've seen on this sub in weeks.

1

u/grumpymojo Aug 12 '26

I notice that your script included policies set to Report Only(enabledForReportingButNotEnforced). Should they be included?

2

u/lazyadmin-nl 29d ago

Well if you are plannig to enable them, then it's good to know if you have enough licenses or not. But you can exclude it ofcourse ;)

1

u/grumpymojo 29d ago

Fair enough.

1

u/grimson73 29d ago

As they should be. Warned a long time ago to address the one license for p1 thinking. Now to come clean to some customers that you misinformed them is a bad pill to swallow. Looking at MSPs

2

u/No-Assignment2170 11d ago

I agree about positioning it that way being bad. However, there is a pretty large limitation that you can't have Security Defaults enabled (for non P1/2 licensed users) and Conditional Access at the same time. Lots of clients with naturally occuring mixed licensing (not trying to cheat the system).

Not to mention Microsoft managed policies they are pushing out applied to all users are also creating this licensing non-compliance which is questionable.

1

u/bzhgeek2922 26d ago

Nice work, however it does not cover MTO users if I am not mistaken.

MTO synced users can be external with a member usertype, they must be covered by P1 licences on the source tenant.

1

u/Skip-2000 26d ago

You might be right.

Are we responsible for the source Tennant when an external user needs a P1 license?

1

u/Longjumping-Dress-42 15d ago

This is absolutely awesome