Licenses

---
name: "cipp-licenses"
description: "Read-only M365 license visibility through CIPP: per-tenant SKU purchase vs. consumption, portfolio-wide CSP license commitments, common SKU part numbers and their friendly names, and the license-mix red flags that drive rightsizing and billing reconciliation."
when_to_use: >-
  When auditing M365 license usage, finding unused/overprovisioned licenses, or reviewing CSP
  license inventory across the MSP portfolio. Use when: cipp license, license usage, license
  audit, unused licenses, csp licenses, m365 sku, license report, or rightsize licenses.
---

# CIPP Licenses

License visibility across managed tenants. Two tools cover the read surface: per-tenant assignment + usage, and portfolio CSP inventory. License *changes* (assigning, removing) flow through `cipp_create_user`, `cipp_offboard_user`, or the M365 plugin — this skill is read-only.

## Anti-triggers

- **Assigning or removing a licence** — no write tool exists here. Use
  `cipp-users` (`cipp_create_user` assigns at create time,
  `cipp_offboard_user` reclaims) or the `m365` plugin's
  `Microsoft 365 Licensing`.
- **Buying, provisioning, or cancelling a subscription** — CSP
  *commitments* are visible here, but procurement is the distributor;
  use `Pax8 Subscriptions` or `Pax8 Orders`.
- **Why a standard reports a failure that is really a licensing gap** —
  the standard and its findings are in `cipp-standards`; come here only
  to confirm the SKU.

## Tools

### `cipp_list_licenses`

```
cipp_list_licenses(tenantFilter='contoso.onmicrosoft.com')
```

Returns every SKU in the tenant with `skuPartNumber`, friendly name, `prepaidUnits.enabled` (purchased), `consumedUnits` (assigned), and per-SKU service plan detail. The gap between purchased and consumed is your unused-license inventory.

### `cipp_list_csp_licenses`

```
cipp_list_csp_licenses()
```

Portfolio-wide view of CSP (Cloud Solution Provider) license commitments — what the MSP owns across all tenants. Use to reconcile what's deployed against what's billed.

## Common SKU reference

| Part number | Friendly | Notes |
|-------------|----------|-------|
| `O365_BUSINESS_PREMIUM` | M365 Business Premium | SMB sweet spot — Exchange + EMS basics |
| `SPB` | M365 Business Premium (legacy code) | Same as above on older tenants |
| `SPE_E3` | M365 E3 | Mid-market, includes Intune + EMS |
| `SPE_E5` | M365 E5 | E3 + Defender + advanced compliance |
| `ENTERPRISEPACK` | Office 365 E3 | Apps + Exchange + SharePoint, no EMS |
| `EMS` / `EMSPREMIUM` | EMS E3 / E5 | Identity + device management add-on |
| `AAD_PREMIUM` / `AAD_PREMIUM_P2` | Entra ID P1 / P2 | Conditional access requires P1+ |
| `EXCHANGESTANDARD` | Exchange Online Plan 1 | Mail-only, no Office apps |
| `MCOMEETADV` | Teams Audio Conferencing | Per-user PSTN dial-in |

## Workflow patterns

### Unused-license report (single tenant)

```
licenses = cipp_list_licenses(tenantFilter='contoso.onmicrosoft.com')
unused = [
    {
        'sku': sku['skuPartNumber'],
        'purchased': sku['prepaidUnits']['enabled'],
        'consumed': sku['consumedUnits'],
        'unused': sku['prepaidUnits']['enabled'] - sku['consumedUnits']
    }
    for sku in licenses
    if sku['prepaidUnits']['enabled'] - sku['consumedUnits'] > 0
]
```

Anything with > 3 unused licenses or > 10% unused is worth flagging in the next QBR.

### Portfolio license-mix audit

For each tenant in `cipp_list_tenants`, call `cipp_list_licenses` and tally SKUs. Cross-reference against `cipp_list_csp_licenses`. Mismatches signal:

- Tenants on direct-billing where the MSP isn't earning CSP margin
- CSP licenses purchased but not yet assigned to any tenant
- Licenses assigned in a tenant without a corresponding CSP reservation (overage billing risk)

### License-mix red flags

| Pattern | Concern |
|---------|---------|
| Tenant has E3 + EMS E3 separately | Should be on M365 E3 — bundle is cheaper |
| Multiple Business Premium tenants > 300 users | Above 300, E3 typically wins on TCO |
| Entra ID P1 absent but conditional access deployed | CA requires P1; tenant is using a feature not licensed |
| Defender for Office not assigned but standards expect it | Standards will report failures until licensing is fixed |

## Caveats

- License *write* operations (assign/remove SKU) aren't in the MCP surface — use `cipp_create_user` (assigns at create time), `cipp_offboard_user` with `removeLicenses=true`, or fall back to the M365 plugin / Graph for runtime changes.
- `consumedUnits` can lag the live tenant by minutes; trust the tenant UI for time-sensitive decisions.