"Tenant does not have a SPO license" error on Graph API despite active SharePoint Online licenses

Question

We are calling the Microsoft Graph API using application-level (client credentials) authentication. All requests to any SharePoint/OneDrive endpoint return:

{
  "code": "BadRequest",
  "message": "Tenant does not have a SPO license."
}

This persists despite SharePoint Online being fully provisioned and accessible via browser.

API details:

• Endpoint: PUT https://graph.microsoft.com/v1.0/users/{user-id}/drive/root:/conversions/{uuid}.docx:/content
• Auth flow: OAuth 2.0 Client Credentials (grant_type=client_credentials)
  • Token endpoint: https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token
  • Scope: https://graph.microsoft.com/.default
  • Application permission: Files.ReadWrite.All (admin consent granted)

What we've verified:

1. The user has SharePoint (Plan 1) and Microsoft 365 Business Basic licenses assigned — both show Active in Entra Admin Center
2. The SharePoint admin center (*.sharepoint.com) loads successfully
3. The user's OneDrive (*-my.sharepoint.com) loads successfully in browser and shows storage allocated (1 TB)
4. Token acquisition succeeds — the app gets a valid JWT with "roles": ["Files.ReadWrite.All"]
5. Admin consent has been granted for the app
6. The error occurs on every SharePoint/OneDrive Graph endpoint, including GET /sites/root and GET /users/{id}/drive — not just file operations
7. We have waited 30+ minutes since license assignment and SPO provisioning with no change
8. This is a work/school account, not a personal Microsoft account

Sample request-ids from failed Graph calls

• [Moderator note: UUID removed]
• [Moderator note: UUID removed]
• [Moderator note: UUID removed]

Answer 1

Hi LegalAtoms,

Thank you for posting your question in the Microsoft Q&A forum and for the thorough details you shared.

Please note that our forum is a public platform, and we will modify your question to hide your request IDs in the description. Kindly ensure that you hide any personal or organizational information the next time you post an error or other details to protect personal data.

It looks like you’ve already troubleshot and verified the required conditions (licenses assigned/active, SPO/OneDrive accessible in the browser, admin consent granted, app-only token issued successfully), yet you’re still consistently hitting the same “Tenant does not have a SPO license” error across SharePoint/OneDrive Graph endpoints.

From what I found in similar reports, using an application (app-only) token can follow a different backend path than a delegated/user context, and it’s possible something is going wrong in that provisioning/validation path even when the interactive experience looks fine.

However, I regret to inform you that this is a user-to-user support forum. The moderators, contributors, and external Microsoft employees participating here do not have access to backend systems, nor do we have the ability to escalate cases or intervene directly in Microsoft product features. Our role is limited to providing technical guidance and sharing best practices based on reported issues, requests, or ideas.

Therefore, to get Microsoft support involved, I recommend creating a support ticket via your Azure portal and providing the tenant_id along with the request_ids you captured so they can investigate more deeply on the backend.

In the meantime, here’s one suggestion you can try: if your app registration supports multitenant account types, you can test requesting the token using the /common authority instead of /{tenant_id} (as a diagnostic) to see whether the issue still persists.

---

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.