We recently enabled a new feature in Office 365, which allows tenant admins to assign more than one Exchange Online license per AAD user.

SharePoint Online and Teams, for example, have been supporting concurrent license assignments for their own services for some time now. Our new feature hence helps bring the same level of support to Exchange Online.

How does it work?

To better understand what this feature changes, let's compare the old behavior of Exchange Online license management, with the new behavior.

Previous experience

When tenant admins tried to assign more than one license pack (which contains Exchange Online) to the same AAD user, either through AAD PowerShell or the Microsoft 365 admin center or through group-based licensing in AAD, an exception message would have been shown and license changes would not have gone through.

For example, if the user already had a Microsoft 365 Business Standard license, and the admin tried to assign a second Exchange Online (Plan 2) license (either the standalone license, or as part of E3 or E5 suites), the following type of exception would have been raised in the Microsoft 365 admin center:

Another example, where a user already has Exchange Online (Plan 1) assigned, and a tenant admin is trying to assign them an additional Microsoft 365 E5 license package:

The same experience would have been seen for any combinations of the following licenses:

• Microsoft 365 Business packages: Basic, Standard, Premium
• Microsoft / Office 365 F1, F2, F3, E1, E3, E5, A1, A3, A5
• Exchange Online Essentials
• Exchange Online Kiosk
• Exchange Online Plan 1
• Exchange Online Plan 2
• Some Teams and Project license packs (see the following section for more information)

Current (new) experience

Any combination of the above-mentioned plans is now allowed. For example, users can be concurrently assigned Microsoft 365 E3 and Office 365 E5 licenses, or Exchange Online Kiosk and Office 365 E3 license etc. The scope also includes the various Education (A) plans.

The legacy plans Office 365 Small Business (BPOS_L), Office 365 Midsize Business (BPOS_S_MidSize), which cannot be bought anymore, but might still exist in production - are not supported by this new feature. The same applies for the license packs we bundle together with British Telecom (BPOS_B).

The following table summarizes which plans support stacking:

Here is an example where an AAD user had concurrently assigned 4 different license types (note that Office 365 E3 and Exchange Online Plan 2 contain the same Exchange Online license).

Please note that AddOn plans' assignment has not changed - the experience with assigning AddOn plans has always been the same, in that multiple AddOn licenses can be assigned to the same user.

What does actually happen in Exchange Online?

Exchange Online will decide on which of the actively assigned plans is the most “superior” and will ensure the features of this superior plan are available to the corresponding Exchange Online user (Mailbox User or Mail User). By ‘features’ here we refer to mailbox quotas, transport limits, protocol access etc.

When a license is removed from the AAD user, or when a license expires, the new collection of actively assigned licenses is evaluated and the new superior plan is chosen.

Hence, the new feature supports license demotions and promotions: for example, if the user has E3 and Kiosk assigned, but E3 is then removed from the AAD user, then Exchange Online will ensure the corresponding Mailbox User or Mail User will be granted access to Kiosk features only. If the user is later also assigned E5, Exchange Online will grant the user access to all the features of E5, regardless of if the user still has assigned a concurrent Kiosk license.

Exchange Online maps AAD or Microsoft 365 admin center license pack names to "capabilities", as detailed by the table above, which lists supported, stackable license packs and their corresponding capabilities. As such, in order of superiority from least superior to most superior, we have:

• Exchange Online Essentials, which maps to the capability "BPOS_S_Essentials"
• Exchange Online Kiosk, which maps to the capability "BPOS_S_Deskless"
• Business Basic, Standard, Premium and E1, which all map to the capability "BPOS_S_Standard"
• Microsoft/Office E3 and E5 plans, which map to the capability "BPOS_S_Enterprise"

What are the benefits of this approach?

Over time, the lack of this “license stacking” feature has caused customers to raise incidents with Microsoft Support. For some, it was a burden to have to manually remove the old Exchange Online license first, and then assign the new license. In some cases, if this procedure wasn't followed correctly, the Exchange Online mailbox might have been moved to a soft deleted state.

For our large Enterprise customers, who manage large license packs, it was an even bigger burden to manage license assignments. In most cases, large Enterprises manage license assignments through group-based licensing. With users being part of multiple control groups, it was a burden for admins to figure out which group to remove the user from. Often, this was managed through automation which involved complicated scripts. With the new feature, tenant admins can now manage license assignments in an easier way.

As a tenant admin, you would still need to run reporting on license assignments and determine which users might have more than one Exchange Online license assigned. You might then elect to remove the least superior licenses from that user and send them back to the pool of unused licenses, so other users can benefit from them. This is important to understand: if two (or more) licenses are assigned, all of them are “in use” (and might be billed).

The feature will also aid with license pack transitions for other services, such as Teams. We already have a success story for the transition of users from Teams Exploratory packages to Teams Essentials/Basic/Standard packages. Many services in Office 365 (Teams included) rely on Exchange Online to either store data in or to access data from mailboxes. For this reason, license packs constructed for Teams or SharePoint or other services, will sometimes include an Exchange Online license as well. Before the changes went live, the lack of support for stacking of Exchange Online licenses had been a blocker for other services such as Teams. With the new feature, Teams can now easily allow transitions of users from one Teams package to another, without causing any data loss or end user experience disruptions.

How to programmatically check which licenses are assigned to a given Exchange Online user?

We introduced a new property in Exchange Online, which exposes all the licenses assigned to a given user. Here is an example of how to verify a sample user using Exchange Online PowerShell:

Get-Mailbox test1 | select SkuAssigned, PersistedCapabilities
SKUAssigned PersistedCapabilities
----------- ---------------------
       True {MYANALYTICSP2, BPOS_S_BookingsAddOn, BPOS_S_Enterprise}

Get-Recipient test1 | select RootCapabilities

RootCapabilities
----------------
BPOS_S_Essentials, BPOS_S_Deskless, BPOS_S_Standard, BPOS_S_Enterprise

In this example, the user "test1" (mailbox user) has a license assigned (SKUAssigned = True), and the superior license assigned to him has the capability BPOS_S_Enterprise. This capability, as previously explained, maps to either E3/E5 or the standard Exchange Online (Plan 2).

In the output of Get-Recipient, the new property RootCapabilities, contains all the Exchange Online active licenses assigned to this user - the output above shows that the user is actually granted 4 different Exchange Online licenses, but because BPOS_S_Enterprise is the most superior one, then that license's features are applied to the Exchange Online user.

What is next?

We are planning to add the same license stacking support for the equivalents of the above-mentioned license packs, for all Sovereign clouds (including Office 365 operated by 21Vianet) and Government clouds. This will be achieved in the first half of CY2023.

Alexandru Grosu and the Exchange Online Provisioning team