What this check looks at
Finds accounts with no usage location set, which blocks licence assignment and service availability.
Every Microsoft 365 account has a usage location, a two-letter country code (GB for the United Kingdom). Microsoft uses it to decide which services can be licensed to that person, because some are not available in every country. A licence cannot be assigned directly to an account with no usage location; group-based licensing falls back to the tenant’s country, which hides the gap until a direct assignment fails.
This check looks at enabled member accounts and lists those with no usage location set. The check fails when 5 per cent or more of enabled members have none, and warns when some do but fewer than 5 per cent.
The usual symptom is a ticket weeks later: a new starter cannot be given a licence, a Teams Phone or Audio Conferencing licence will not apply, or a script that assigns licences fails part-way through. Accounts created by scripts, synchronised from Active Directory without the attribute, or created before a template existed are the usual cause.
Why it matters
Licence assignment fails without a usage location, and some services are unavailable in certain jurisdictions. It surfaces as an unexplained "this user cannot be licensed" ticket months later.
At a 30-person firm, the MSP’s onboarding script creates accounts without a usage location. On a new starter’s first morning the licence assignment fails, so they have no mailbox or Teams, and it takes half a day of helpdesk time to find the cause while the person sits idle.
Setting the location is a quick bulk change, and adding it to account creation prevents the problem for good. For organisations with staff abroad, it also makes sure each person gets the services allowed where they work.
ISO 27001 A.5.9 (inventory of information and other associated assets), the NCSC 10 Steps asset management guidance and the NCSC CAF asset management outcome expect account records to be complete and accurate.
How to fix it
Where: Microsoft 365 admin centre → Users → Active users
Before you start
- Set the location to the country the person works in; it decides which services they can be licensed for.
Step by step
- List the accounts missing a location. Use the list in the evidence, or in Microsoft Graph PowerShell (Connect-MgGraph -Scopes User.ReadWrite.All) run Get-MgUser -All -Property id,userPrincipalName,usageLocation,accountEnabled,userType | Where-Object { -not $_.UsageLocation -and $_.AccountEnabled -and $_.UserType -eq "Member" }.
- Decide each person’s country. Use the country where each person works, normally GB for UK staff. Check with the client for anyone based abroad, as the location decides which services they can be licensed for.
- Set the location in bulk. Pipe the list from the first step into ForEach-Object { Update-MgUser -UserId $_.Id -UsageLocation "GB" }, using the right code for anyone abroad. For a handful of accounts, set it instead in the Microsoft Entra admin centre under Entra ID > Users > the user > Edit properties > Settings > Usage location, or in the Microsoft 365 admin centre under the user’s Licences and apps tab.
- Fix synchronised accounts at the source. For accounts synchronised from Active Directory, set the msExchUsageLocation attribute on the on-premises account where the schema has it, so Entra Connect keeps the value in step; otherwise set it in the cloud as above.
- Add it to account creation. Add the usage location to the MSP’s new-starter script or template (for example -UsageLocation "GB" on New-MgUser) and to the joiner checklist, so new accounts never lack it.
- Confirm nobody is missing a location. Re-run the command from the first step: it should return nothing. The finding clears at the next assessment.
With PowerShell
Update-MgUser -UserId <upn> -UsageLocation GB
What users will notice
None.
How to confirm it worked
Filtering users on an empty usage location returns nobody.
Frameworks and controls
This check maps to controls in 3 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | A3.a Asset management |
| ISO 27001:2022 | A.5.9 Inventory of information and other associated assets |
| NCSC 10 Steps | Asset management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Add users and assign licences (Microsoft Learn)