Check ID: admincenter_users_admins_reduced_license_footprint
Provider: Microsoft 365
Service: admincenter
Severity: HIGH
Categories: identity-access, e3
Resource type: NotDefined

​
What this check verifies

Privileged users in Microsoft 365 are evaluated for a reduced license footprint: only AAD_PREMIUM (P1) or AAD_PREMIUM_P2 (P2), or no license. Assignments that include productivity app suites indicate excess application entitlements on administrative accounts.

​
Risk

Productivity licenses on privileged identities create mailboxes and collaboration surfaces that widen attack paths. Phishing, malicious content, or rogue OAuth apps can steal credentials/tokens, enabling tenant-wide role misuse, data exfiltration, and configuration tampering-compromising confidentiality and integrity.

​
Recommendation

Maintain dedicated admin accounts with a least-privilege, reduced-license model: assign only Microsoft Entra P1/P2 features needed for identity security, or keep them unlicensed for apps. Separate admin from daily-use accounts, enforce MFA and just-in-time elevation, and use privileged access workstations for administration.

​
Remediation

Set-MgUserLicense -UserId <USER_PRINCIPAL_NAME_OR_ID> -AddLicenses @() -RemoveLicenses @(Get-MgUserLicenseDetail -UserId <USER_PRINCIPAL_NAME_OR_ID> | Select-Object -ExpandProperty SkuId)

​
References

​
Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = admincenter_users_admins_reduced_license_footprint. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks