Microsoft Entra ID · Remaining Built-in Roles
License Administrator
Can manage product licenses on users and groups. Can also manage usage location and read service plans but cannot purchase or manage subscriptions.
Scope: Organization-wide license assignment and management
Permissions
- Group Licenses - Assign licenses to groups
- Group Licenses - Reprocess license assignments
- User Licenses - Assign licenses to users
- User Licenses - Reprocess user license assignments
- Usage Location - Update usage location for users
- Service Health - Manage Azure service health
- M365 Health - Manage M365 service health
- Usage Reports - Read usage reports
- Admin Center - Read admin center properties
- License Inventory - View license usage and availability
- User Properties - Read user properties for license assignment
- Limitation - Cannot purchase new licenses or subscriptions
Common use cases
- IT helpdesk managing user licenses
- HR onboarding/offboarding workflows
- License optimization and reallocation
- Group-based licensing administration
- License audit and compliance
- License usage reporting
- Service plan assignment management
- Usage location management for licensing
Best practices
- Use group-based licensing for efficiency
- Review license utilization regularly
- Document license allocation policies
- Coordinate with Billing Admin for purchases
- Set up license usage alerts
- Consider PIM for just-in-time access
- Automate onboarding/offboarding license workflows
- Review orphaned licenses periodically
Security considerations
- License changes affect user capabilities
- Can enable/disable service features via licenses
- Can update user usage location
- Monitor for license privilege escalation
- Audit license assignment changes
- Consider PIM for elevated access
Common questions
When should I assign the License Administrator role?
Assign License Administrator when you need to: IT helpdesk managing user licenses; HR onboarding/offboarding workflows; License optimization and reallocation; Group-based licensing administration; and License audit and compliance. It is part of Microsoft Entra ID and should be granted as a least-privilege alternative to broader roles like Global Administrator.
What can someone with the License Administrator role do?
The License Administrator role grants permissions including: Group Licenses - Assign licenses to groups; Group Licenses - Reprocess license assignments; User Licenses - Assign licenses to users; User Licenses - Reprocess user license assignments; Usage Location - Update usage location for users; and Service Health - Manage Azure service health. See the Permissions section above for the full list.
What are the security risks of the License Administrator role?
Key considerations when assigning License Administrator: License changes affect user capabilities; Can enable/disable service features via licenses; Can update user usage location; and Monitor for license privilege escalation. Review the Security considerations section before assignment, and pair with Privileged Identity Management (PIM) for just-in-time access where possible.