Microsoft 365 licences

8 steps 10 min Updated 4 November 2026

A Microsoft 365 account with no licence can sign in, but has no mailbox, Teams or Office apps. The Entra sync can give everyone the right licence for you: you choose one licence for students and one for staff, and each time the daily Entra sync runs (every morning at 06:00, Sunday to Friday) — straight after it creates new accounts — the sync gives each person theirs. New starters are licensed by the sync that creates their account or, if that run can't finish it, the next one; nobody has to be licensed by hand in the Microsoft 365 admin centre.

Governors, observers and admin accounts are not given a licence. Only students and staff are — unless you use licence rules, which can give any group, or one person, a different licence.

Before you start

The school must already be syncing to Microsoft Entra, with Entra sync switched on under School settings → Sync services — see Microsoft Entra settings.
You need a school admin with sync settings permission, with the school selected in the switcher.
The licences must already be in your Microsoft tenant. The sync gives out licences you have; it can't buy them. Education tenants usually have Office 365 A1 for students and Office 365 A1 for faculty free from Microsoft.
If you already license people through Microsoft's group-based licensing, you don't need this. Don't let both give out the same licence — pick one way.

Steps

Step 1: Let Realsmart read your licences

Giving out licences is covered by the User.ReadWrite.All permission the Realsmart Entra Sync app already has. Reading your list of licences isn't, so your Microsoft 365 administrator adds one more permission to the same app registration:

In the Microsoft Entra admin center, open App registrations → Realsmart Entra Sync → API permissions.
Select Add a permission → Microsoft Graph → Application permissions, find Organization.Read.All, tick it and add it. (LicenseAssignment.Read.All works instead, if your administrator prefers the narrower one.)
Select Grant admin consent so it takes effect.

Without it, the sync can still give out licences, but you can't see your licences to choose from, and the sync can't count how many are free first.

Permission	What it lets the sync do
User.ReadWrite.All (already granted) or LicenseAssignment.ReadWrite.All	Give and remove licences, and set an account's country
Organization.Read.All or LicenseAssignment.Read.All	Read which licences your tenant has and how many are free

Step 2: Open the Licences section

In the sidebar, go to Entra sync → Settings and select the Licences section (the page reopens on the section you used last, and ?section=licences in the address opens it directly).

Step 3: Load your licences

Under the form, Licences in your Microsoft tenant lists every licence your tenant can give to people, with how many are free, the total, how many Realsmart has given, and which one is chosen for students or staff. A licence that has lapsed but is still in its grace period shows an Expiring badge. The line under the heading says when the list was last read from Microsoft; the daily sync reads it again each time it runs. If the list is empty, select Check licences now. It asks Microsoft for the list and shows it here a moment later. It only reads — nothing in Microsoft 365 changes.

If it says Couldn't read your licences from Microsoft, the permission in Step 1 is missing or admin consent wasn't granted. If Check licences now says Couldn't check licences: Entra sync needs to be switched on for this school first, switch Entra sync on under School settings → Sync services and try again.

Step 4: Choose the licences

In Which licence each person gets:

Students — usually a "for students" licence, such as Office 365 A1 for students.
Staff — usually a "for faculty" licence, such as Office 365 A1 for faculty.

Each choice shows how many of that licence are free. Leave one on Don't give a licence if you only want to license the other group. If Assign Microsoft 365 licences is on but both are left on Don't give a licence, a No licence chosen yet warning appears and nobody is licensed.

Step 5: Check the country

Microsoft won't license an account unless it has a country (Microsoft calls it the usage location). Accounts made by the sync don't have one, so the sync sets the Country for licensed accounts on an account just before licensing it. Accounts that already have a country are left as they are. United Kingdom is the default; the list also offers Ireland, Jersey, Guernsey, the Isle of Man and Gibraltar — change it only if your school is elsewhere.

Step 6: Decide what happens to leavers

When someone is suspended or leaves, the sync disables their Microsoft account either way. Take their licence back decides whether they also lose the licence:

Off (recommended) — they keep it. Their email and files are kept, ready if they come back.
On — the licence is removed on the next sync so someone else can use it. Microsoft permanently deletes a person's mailbox 30 days after their licence is removed, unless they are reactivated before then. You'll be asked to confirm before this is saved.

Only licences Realsmart gave are ever removed — never ones you gave by hand.

Step 7: Switch it on and save

Turn on Assign Microsoft 365 licences and select Save settings. Licences are given the next time the daily Entra sync runs. To start straight away, run a manual sync (Sync status → Quick run → Microsoft Entra).

Step 8: Check the result

After that sync has run, the Licences section shows Last licence sync with its date and time: how many people were given a licence, how many moved to another licence, how many are waiting for a free licence and how many couldn't be licensed. Anyone who wasn't licensed is listed on Entra sync issues with the reason and what to do.

A person's own licence shows on their profile, on the Cloud tab under Microsoft Entra. To see everyone at once — what each person gets, why, and how the last sync went for them — use Who gets which licence (see Licence rules for groups and people).

What the sync does each time it runs

Only what's needed. The sync checks what each person already has in Microsoft 365. Someone who already has the right licence — even one you gave by hand — is left alone. A licence someone removed in the Microsoft 365 admin centre is given back the next time the sync runs, as long as the person should have it.
Staff first when licences are short. If there aren't enough free licences for everyone, staff are licensed before students, and the rest wait. They're listed once as people waiting for a Microsoft 365 licence on the Issues page, and are licensed on the next sync after licences are freed up or bought.
A frozen school isn't touched. While the school's provisioning window is paused, no licences are given or taken away (see Cloud sync paused).
Licences follow accounts. The licence step runs straight after new accounts are created, so someone new can have an account and a licence by the end of the same run.

Different licences for some groups or people

Need senior leadership on A3 while other staff stay on A1, a different licence for Year 11, or one person to be left alone? Under Advanced, turn on Use licence rules for groups and people. You can then give a group, or one person, a licence of its own; rules are checked in order and the first match wins. See Licence rules for groups and people.

Changing or stopping

Changing a licence choice — for example moving students from A1 to A3 — moves everyone who has the old licence from Realsmart onto the new one on the next sync. Microsoft swaps them in one step, so email and files are kept. You'll be asked to confirm, with the number of people it affects. Anyone who was given the old licence by hand is given the new one too but keeps the old one — remove it in the Microsoft 365 admin centre if you don't want them to have both.
Choosing "Don't give a licence" for a group, or switching licence assignment off, stops new licences being given. It never takes away licences people already have. To remove those, use the Microsoft 365 admin centre.

Rolling out across a trust

Apply across MAT on the Entra settings page has a Licences section too, so you can switch licensing on and choose the licences for many schools at once. Microsoft uses the same licence IDs in every tenant, so a choice means the same licence at every school — the list shows how many of your schools own each one. If a school's tenant doesn't have the chosen licence, that school's sync says so on its Issues page and licenses nobody in that group until it's fixed.

Each school's own Licences section shows its free counts once it has had Check licences now, or one daily sync with licences switched on.

If something goes wrong

What you see	What it means	What to do
People are waiting for a Microsoft 365 licence	Your tenant has no free licences of the type chosen for them.	Buy more, or remove licences from people who no longer need one, in the Microsoft 365 admin centre (Billing → Licences). They're licensed on the next sync.
The licence chosen in Realsmart isn't in your Microsoft tenant	The licence has expired or been removed from your tenant.	Check licences now, choose a licence your tenant has, and save.
Realsmart can't read which licences your tenant has	The permission in Step 1 is missing. Licences are still given out.	Add Organization.Read.All (or LicenseAssignment.Read.All) and grant admin consent.
Some accounts couldn't be licensed: they have no country	Microsoft wouldn't accept the country for these accounts.	Check the country in Step 5; if it's right, set the usage location on the accounts in the Microsoft 365 admin centre.
A licence clashes with one these people already have	Microsoft won't give a licence that overlaps one the person already holds.	Remove the overlapping licence in the Microsoft 365 admin centre, or choose a different one.
The Realsmart app isn't allowed to give out licences	The app registration is missing User.ReadWrite.All.	Grant it (or LicenseAssignment.ReadWrite.All) with admin consent, then Test connection.
Licence removals were held back	With Take their licence back on, too many suspended accounts would have lost their licence in one run — often a sign of an MIS problem — so none did.	Check the suspended accounts are right. If they are, contact Realsmart support to release the removals.
Licence assignment isn't ready on Realsmart's side yet	Licence assignment is on, but part of the update that adds it hasn't been installed yet, so nobody is licensed.	Contact Realsmart support with the message — there's nothing to change on your side.
No licence chosen yet (warning in the Licences section)	Assign Microsoft 365 licences is on, but both Students and Staff are on Don't give a licence.	Choose a licence for the people you want licensed and select Save settings.
Some people couldn't be given a Microsoft 365 licence	Microsoft turned the licence change down for these people for a reason that isn't one of the above; the message on the Issues page says what Microsoft reported.	Often clears on the next sync. If the same people keep appearing, look at their account in the Microsoft 365 admin centre, or contact Realsmart support with the message.

Test connection → Test permissions also checks both licence permissions once licence assignment is switched on.

Result

Students and staff get the Microsoft 365 licence chosen for them automatically, new starters by the sync that creates their account (or the next one), and anyone who can't be licensed is listed with the reason.

Did this work for you?

If a step looked different on your site, tell us and we'll update the screenshots.