azureblog.co.uk
← cd ~/licences
// licences · sku

EMS_GOVEnterprise Mobility + Security G3 GCC

EMS_GOV is the SKU part number Microsoft uses for Enterprise Mobility + Security G3 GCC. You'll see it in Graph, PowerShell, licence reports and group-based licensing errors.

Product nameEnterprise Mobility + Security G3 GCC
String ID (SkuPartNumber)EMS_GOV
GUID (SkuId)c793db86-5237-494e-9b11-dcd4877c2c8c
Service plans7

Service plans included (7)

Service planNameID
AAD_PREMIUMMicrosoft Entra ID P141781fb2-bc02-4b7c-bd55-b576c07bb09d
RMS_S_PREMIUMAzure Information Protection Premium P16c57d4b6-3b23-47a5-9bc9-69f17b4947b3
ADALLOM_S_DISCOVERYCloud App Security Discovery932ad362-64a8-4783-9106-97849a1a30b9
EXCHANGE_S_FOUNDATION_GOVExchange Foundation for Government922ba911-5694-4e99-a794-73aed9bfeec8
RMS_S_ENTERPRISEMicrosoft Entra Rightsbea4c11e-220a-4e6d-8eb8-8ea15d019f90
MFA_PREMIUMMicrosoft Azure Multi-Factor Authentication8a256a2b-b617-496d-b51b-e76466e88db0
INTUNE_AMicrosoft Intunec1ec4a95-1f05-45b3-a911-aa3fa01094f5

Is it in your tenant?

powershell3 lines
Connect-MgGraph -Scopes "Organization.Read.All"
Get-MgSubscribedSku | Where-Object SkuPartNumber -eq "EMS_GOV" |
    Select-Object SkuPartNumber, ConsumedUnits, @{ n = "Purchased"; e = { $_.PrepaidUnits.Enabled } }

Assign it to a user

For more than a handful of people, use group-based licensing instead. The user needs a usage location set first.

powershell3 lines
Connect-MgGraph -Scopes "User.ReadWrite.All"
Set-MgUserLicense -UserId "jane.doe@contoso.com" `
    -AddLicenses @{ SkuId = "c793db86-5237-494e-9b11-dcd4877c2c8c" } -RemoveLicenses @()

Who has it?

powershell4 lines
Connect-MgGraph -Scopes "User.Read.All"
Get-MgUser -Filter "assignedLicenses/any(x:x/skuId eq c793db86-5237-494e-9b11-dcd4877c2c8c)" `
    -ConsistencyLevel eventual -CountVariable n -All |
    Select-Object DisplayName, UserPrincipalName

Similar licences

These share the most service plans with EMS_GOV.

Search all 620 SKUs →

Sources