# Office 365 – Limiting license to minimum apps required Office 365 has a lot of options and applications to choose from. Enabling one E1, E3, or any other license gives the user a lot of features, including Exchange, SharePoint, and Teams. But what if you want to make sure that the user can access only Microsoft Teams? By default, you can do it manually during the assignment of the license. Simply choose only Apps you want to assign to a user. blog 07 Apr 2020 de ![Office 365 – Limiting license to minimum apps required](/wp-content/uploads/2020/04/img_5e89cc6b4b3e9.png) [Bilder ansehen (5)](#pf-content-image-1-0) **Office 365** has a lot of options and applications to choose from. Enabling one **E1**, **E3**, or any other license gives the user a lot of features, including **Exchange**, **SharePoint**, and **Teams**. But what if you want to make sure that the user can access only **Microsoft Teams**? By default, you can do it manually during the assignment of the license. Simply choose only Apps you want to assign to a user. [!\[Office 365 license assignment screen with selected apps such as Microsoft Teams\](/wp-content/uploads/2020/04/img_5e89c91bd9a02.png)](/wp-content/uploads/2020/04/img_5e89c91bd9a02.png) Of course, doing this **manually** is subject to errors and possibly giving the user a bit too much. So how can we make sure that the user gets what he is supposed to get? ### 💡 License assignment using group membership If you're lucky enough to have high enough license **Azure AD Premium 1**, you can enable the assignment of licenses by group membership. This provides an easy way to assign multiple licenses to one user with specific apps based on our choice. It's quite easy to set up and can work on both **Azure AD Group Membership** and **Active Directory Group Membership**. The steps are: - 💬 Open [Azure Active Directory Admin Center](https://aad.portal.azure.com/) - 💬 Click **Licenses** from the list - 💬 Click** Manage your purchased licenses** [!\[Azure AD license management page showing purchased licenses\](/wp-content/uploads/2020/04/img_5e89cc6b4b3e9.png)](/wp-content/uploads/2020/04/img_5e89cc6b4b3e9.png) - 💬 Mark **checkbox** next to license you want to configure - 💬 Press **Assign** from the menu above [!\[Azure AD license assignment workflow with the Assign action selected\](/wp-content/uploads/2020/04/img_5e89ccae24831.png)](/wp-content/uploads/2020/04/img_5e89ccae24831.png) - 💬 Choose **Assignment options** (pick apps which are supposed to be enabled for the user) - 💬 Finally apply it to user or group (better) - 💬 Item List Item Text [!\[Azure AD assignment options screen for enabling only the required license apps\](/wp-content/uploads/2020/04/img_5e89cceba987f.png)](/wp-content/uploads/2020/04/img_5e89cceba987f.png) And you're done. Once user is added to the group licenses will kick in. ### 💡 License assignment using PowerShell The second option is based on **PowerShell**. One can configure license options based on the existing license. Since creating a new license option requires you to provide apps you want to disable, it may be subject to change if **Microsoft** decides to add some new plans into your **Office 365** tenant. That's why instead of relying on **DisabledPlans**, I've reversed the situation by requiring only **EnabledPlans** and figuring out which plans to disable. ```powershell $License = 'evotec:STANDARDPACK' # E1 license $EnabledPlans = @( 'TEAMS1' 'WHITEBOARD_PLAN1' ) $Exclusions = @( 'Sync_ADCONNECT1@evotec.onmicrosoft.com' ) $AllPlans = (Get-MsolAccountSku | Where-Object { $_.AccountSkuId -eq $License } | Select-Object -ExpandProperty ServiceStatus).ServicePlan.ServiceName $DisabledPlans = $AllPlans | Where-Object { $EnabledPlans -notcontains $_ } $E1CustomizedLicense = New-MsolLicenseOptions -AccountSkuId $License -DisabledPlans $DisabledPlans $Users = Get-MsolUser -UnlicensedUsersOnly -All -EnabledFilter EnabledOnly foreach ($User in $Users) { if ($User.UsageLocation -ne 'PL') { Set-MsolUser -UserPrincipalName $User.UserPrincipalName -UsageLocation PL } if ($User.IsLicensed -eq $false -and $Exclusions -notcontains $User.UserPrincipalName) { Set-MsolUserLicense -UserPrincipalName $User.UserPrincipalName -AddLicenses $License -LicenseOptions $E1CustomizedLicense } } ``` As part of the above code, I've added the ability to exclude some accounts. Please keep in mind that I'm assigning everyone a license that doesn't have one yet. With **multiple licenses** being available in your tenant, you may need to modify the code a bit and apply it based on that. You can quickly check for possible plans to disable/enable with following code ```powershell $LicensePlans = Get-MsolAccountSku | ForEach-Object { [PSCustomObject] @{ LicenseName = $_.AccountSkuId Plans = $_.ServiceStatus.ServicePlan.ServiceName -join ', ' } } $LicensePlans | Format-Table -AutoSize ``` [!\[PowerShell output listing available Office 365 license plans and service names\](/wp-content/uploads/2020/04/img_5e89d9263d9b2.png)](/wp-content/uploads/2020/04/img_5e89d9263d9b2.png) For me, the first option is always the way to go unless you're out of luck when it comes to having limited features for your Office 365 tenant. The second option, while great, is only applicable to PowerShell and your helpdesk staff can still assign wrong licenses manually. It would be great if the second option would create a variant of a license that can be chosen from the interface but not having much hope for this one. ## Zugehörige Projekte Projekte, die zu Tags, Kategorien und Inhalt dieses Beitrags passen. [Alle Projekte](/de/projekte/) Projekte werden abgeglichen... [Zurück zum Blog](/blog) ## Ähnliche Beiträge - [Office 365 – msExchHideFromAddressLists does not synchronize with Office 365](/de/blog/office-365-msexchhidefromaddresslists-does-not-synchronize-with-office-365/) - [Azure ADConnect Export Failed – Permission-issue error](/de/blog/azure-adconnect-export-failed-permission-issue-error/) - [Syncing Global Address List (GAL) to personal contacts and between Office 365 tenants with PowerShell](/de/blog/syncing-global-address-list-gal-to-personal-contacts-and-between-office-365-tenants-with-powershell/)