TL;DR:
Microsoft Graph doesn’t expose the Entra "effective license mode" because it’s a UI‑calculated value, not a directory attribute. This script uses Microsoft Graph PowerShell to analyse your tenant’s SKUs and service plans to determine the same license mode shown in the Entra portal.
Summary
You might find yourself needing to know the license mode of an
Entra Directory tenant - as seen in the "Overview" screen of the Entra Admin UI - for example "Microsoft
Entra ID P1".
Unfortunately it's not that simple, if you look for a Get-MgLicense command you'll also have an issue the cmdlets match the names in Graph which is subscribedSku.
It gets more complex because
Entra licenses are actually per user whereas
Entra displays
the license as if it were a tenant (organization) wide license.
So what is actually happening is that the
Entra Admin UI looks through all of the subscribed skus (licenses) and finds ones that are active and has one of the "AAD_*" service plans enabled. It
then shows the best (most expensive) license that it finds.
Why isn’t this available in Graph?
Microsoft hasn’t exposed the "effective license mode" in Microsoft Graph simply because it isn't a real directory attribute.
The value you see in the Entra admin portal is calculated on the fly by the UI based on your subscribed SKUs and their provisioning status, rather than being stored anywhere in the directory.
Graph only returns the underlying licensing data - SKUs, service plans, and statuses - and leaves the interpretation to the client. Since the license mode is essentially a convenience label rather than a first‑class property, Microsoft hasn’t formalised
it as part of the Graph API surface, which is why we need to replicate the logic ourselves.
PowerShell Script
The following PowerShell script performs that function.
Prerequisite Permissions
- Directory.Read.All
- or -
- Organization.Read.All permissions
PowerShell Code
function Get-EffectiveDirectoryLicenseServicePlanName {
<#
.SYNOPSIS
Gets the effective license service plan name for the directory.
.OUTPUTS
String - The effective license service plan name (e.g. "Microsoft Entra ID P1").
#>
# Known service plan names that map to Entra editions
$knownServicePlanNames = @("AAD_FREE"
, "AAD_BASIC", "AAD_PREMIUM",
"AAD_PREMIUM_P2")
$effectiveServicePlanNames = @()
# Pull subscribed SKUs from Graph
$skus = Get-MgSubscribedSku
foreach ($sku in
$skus) {
# Only consider SKUs with capabilityStatus Enabled or Warning
if ($sku.CapabilityStatus
-ne "Enabled" -and $sku
.
CapabilityStatus -ne "Warning") {
continue
}
$servicePlans = $sku
.ServicePlans
foreach ($plan in
$servicePlans) {
if ($knownServicePlanNames
-notcontains $plan.ServicePlanName) { continue
}
if ($plan.
ProvisioningStatus
-ne "Success") { continue }
$effectiveServicePlanNames +=
$plan.ServicePlanName
}
}
if ($effectiveServicePlanNames -contains
"AAD_PREMIUM_P2") { return "Microsoft Entra ID P2"
; }
if ($effectiveServicePlanNames -contains
"AAD_PREMIUM") { return "Microsoft Entra ID P1"
; }
if ($effectiveServicePlanNames -contains
"AAD_BASIC") { return "Microsoft Entra ID Basic"
; }
return "Microsoft Entra ID Free"
}
Automate with XIA Configuration
As well as the PowerShell method listed above XIA Configuration's upcoming Entra documentation capabilities will
automatically document your effective license as well as conditional access, branding, users, groups, applications and enterprise applications.
