Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1236
  • Last Modified:

Office 365 lost license

We have migrated all of our users to Office 365. In the last week, I've had two (One an E3 user and one an E1) who have been unable to log into their account.  When I checked, both of them were unlicensed. They have been using this fine for at least a couple of weeks, so I know that the licensing was OK at some point. We put their licensing back and they are OK now. They have not been deleted or had their accounts disabled.
0
jhyiesla
Asked:
jhyiesla
  • 4
  • 3
1 Solution
 
Vasil Michev (MVP)Commented:
Not sure what exactly the question is here? If you want to find out what happened with the licenses, check the Azure AD audit logs under the Security and Compliance Center: https://support.office.com/en-us/article/Search-the-audit-log-in-the-Office-365-Security-Compliance-Center-0d4d0f35-390b-4518-800e-0c7ec95e946c?ui=en-US&rs=en-US&ad=US
0
 
jhyieslaAuthor Commented:
I'll check the logs, but the question is, why would someone lose a license if it appears that we've not done anything here to cause that.
0
 
Vasil Michev (MVP)Commented:
I've been working with O365 for over 5 years now, never had a license disappear without a user action. I've occasionally run into other similar cases and most of the time it's either a rogue admin, a user mistake or some forgotten script that did it. There have been few "unexplained" ones, and we even discussed those on some calls with Microsoft folks, but they were never confirmed.

You can always open a case with MS and have them investigate the issue.
0
Get your Conversational Ransomware Defense e‑book

This e-book gives you an insight into the ransomware threat and reviews the fundamentals of top-notch ransomware preparedness and recovery. To help you protect yourself and your organization. The initial infection may be inevitable, so the best protection is to be fully prepared.

 
jhyieslaAuthor Commented:
I ran the log file search for the users in question. I don't see anything in the logs that would indicate that anything happened to them. All I see is multiple entries for ForeignRealmIndexLogonInitialAuthUsingADFSFederatedToken

If this happens again, I'll call MS.
0
 
Vasil Michev (MVP)Commented:
The events you should be looking for in this case are under the "User administration activities" section, more specifically the "changed user licenses" one.
0
 
jhyieslaAuthor Commented:
What I had chosen was all activities.  But I did as you suggested above and changed it to the specific thing for changed user licenses. I looked for the last week and found nothing... which is weird I guess as I did re-license the users during this time frame. I even expanded the search to the first of the month...nothing.
0
 
jhyieslaAuthor Commented:
While the solution seemed like it would be useful, it really didn't resolve my problem. It's not recurred and I'm closing this question.
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 4
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now