🚨 Microsoft Teams Error: 'Tenant does not have a SPO license' — Cause, Fix, and Troubleshooting Guide

What this error means

A Microsoft Graph call that touches storage backed by SharePoint Online or OneDrive fails with an HTTP 403 stating the tenant has no SharePoint license. Teams stores channel files in a SharePoint site and personal chat files in OneDrive, so any endpoint that reaches through to that storage — /drive, a channel’s filesFolder, /sites, or team creation that provisions a SharePoint site — fails when SharePoint isn’t licensed or provisioned in the tenant.

HTTP/1.1 403 Forbidden

{
  "error": {
    "code": "AccessDenied",
    "message": "Tenant does not have a SPO license."
  }
}

What users report

• Graph returns 403 with “Tenant does not have a SPO license.” on /teams/{id}/channels/{id}/filesFolder, /drive, or /sites calls.
• Creating a team or a group-connected site fails at the point SharePoint provisioning would happen.
• Reading or listing channel files fails even though the team, channel, and messages exist.
• The failure is consistent for the whole tenant, not intermittent throttling.
• A brand-new tenant fails these calls while other Graph endpoints (users, messages) work fine.

Tenant and app configuration causes

• No SharePoint Online in the tenant’s licensing — no assigned plan includes the SharePoint Online service, so the service was never provisioned.
• Calling user lacks a SPO license — for delegated calls, the signed-in account has no plan that grants SharePoint/OneDrive.
• SharePoint not yet provisioned — a newly licensed or newly created tenant where SharePoint provisioning hasn’t completed.
• SharePoint service plan disabled — a plan is assigned but the SharePoint Online service plan within it is switched off.
• OneDrive not provisioned for the user — personal-scope file operations hit OneDrive that has never been initialized for that account.
• Trial or reduced SKU — a tenant SKU that intentionally excludes SharePoint/OneDrive.

Confirming tenant configuration

Confirm the call and the exact error, then check licensing and provisioning. Reproduce with curl so you can see the status and body precisely:

# Channel files folder -> reaches into the SharePoint-backed drive
curl -i -H "Authorization: Bearer $TOKEN" \
  "https://graph.microsoft.com/v1.0/teams/$TEAM_ID/channels/$CHANNEL_ID/filesFolder"

Inspect the tenant’s subscribed SKUs and each user’s assigned service plans to see whether SharePoint is present and enabled:

# Tenant-level: which SKUs and service plans exist
curl -s -H "Authorization: Bearer $TOKEN" \
  "https://graph.microsoft.com/v1.0/subscribedSkus" \
  | jq '.value[] | {skuPartNumber, servicePlans: [.servicePlans[] | select(.servicePlanName|test("SHAREPOINT|ONEDRIVE"))]}'

# User-level: is a SharePoint service plan assigned and enabled for the caller?
curl -s -H "Authorization: Bearer $TOKEN" \
  "https://graph.microsoft.com/v1.0/users/$USER_ID/licenseDetails" \
  | jq '.value[].servicePlans[] | select(.servicePlanName|test("SHAREPOINT|ONEDRIVE"))'

A servicePlanName in the SharePoint/OneDrive family with provisioningStatus of “Success” indicates it’s live; its absence or a disabled state explains the 403.

Resolution

Assign a plan that includes SharePoint Online to the tenant and to the relevant users, then let provisioning complete:

• In the Microsoft 365 admin center, assign a license whose service plans include SharePoint Online (and OneDrive) to the calling account and to the users whose files you access.
• If the plan is assigned but the SharePoint service plan is toggled off, re-enable that service plan within the license assignment.
• For delegated Graph calls, ensure the signed-in user specifically holds a SharePoint-inclusive license, not just an app or a SharePoint-less SKU.

After assignment, SharePoint provisioning for the tenant and OneDrive provisioning for individual users can take time to complete. Re-check provisioningStatus until it reports success, then retry the Graph call. For a brand-new tenant, simply wait for initial provisioning to finish before treating the 403 as a bug.

Avoiding tenant drift

• Provisioning is asynchronous — a freshly assigned license won’t clear the 403 instantly; poll provisioningStatus before retrying.
• Delegated vs application context — under delegated auth, the specific signed-in user needs the license, not merely the tenant.
• Service plan toggles — a license can include SharePoint yet have that service plan disabled per user; check the plan state, not just the SKU.
• OneDrive for personal files — personal-scope file calls need OneDrive provisioned for that user, which happens on first use or admin pre-provisioning.
• Not a retry/throttling case — this 403 is a licensing state, not a transient 429; retry loops won’t resolve it.
• Distinguish from Authorization_RequestDenied — a missing Graph permission produces a different error; the SPO-license message is specifically about SharePoint provisioning/licensing.

Related tenant errors

• 403 Authorization_RequestDenied
• Access Denied
• 404 Resource Not Found