Office 365

Office 365 – Limiting license to minimum apps required

Office 365 has a lot of options and applications to choose from. Enabling one E1, E3, or any other license gives the user a lot of features, including Exchange, SharePoint, and Teams. But what if you want to make sure that the user can access only Microsoft Teams? By default, you can do it manually during the assignment of the license. Simply choose only Apps you want to assign to a user.

Of course, doing this manually is subject to errors and possibly giving the user a bit too much. So how can we make sure that the user gets what he is supposed to get?

License assignment using group membership

If you're lucky enough to have high enough license Azure AD Premium 1, you can enable the assignment of licenses by group membership. This provides an easy way to assign multiple licenses to one user with specific apps based on our choice. It's quite easy to set up and can work on both Azure AD Group Membership and Active Directory Group Membership. The steps are:

Click Licenses from the list
Click Manage your purchased licenses

Mark checkbox next to license you want to configure
Press Assign from the menu above

Choose Assignment options (pick apps which are supposed to be enabled for the user)
Finally apply it to user or group (better)
Item List Item Text

And you're done. Once user is added to the group licenses will kick in.

License assignment using PowerShell

The second option is based on PowerShell. One can configure license options based on the existing license. Since creating a new license option requires you to provide apps you want to disable, it may be subject to change if Microsoft decides to add some new plans into your Office 365 tenant. That's why instead of relying on DisabledPlans, I've reversed the situation by requiring only EnabledPlans and figuring out which plans to disable.

$License = 'evotec:STANDARDPACK' # E1 license
$EnabledPlans = @(
    'TEAMS1'
    'WHITEBOARD_PLAN1'
)
$Exclusions = @(
    'Sync_ADCONNECT1@evotec.onmicrosoft.com'
)

$AllPlans = (Get-MsolAccountSku | Where-Object { $_.AccountSkuId -eq $License } | Select-Object -ExpandProperty ServiceStatus).ServicePlan.ServiceName
$DisabledPlans = $AllPlans | Where-Object { $EnabledPlans -notcontains $_ }
$E1CustomizedLicense = New-MsolLicenseOptions -AccountSkuId $License -DisabledPlans $DisabledPlans

$Users = Get-MsolUser -UnlicensedUsersOnly -All -EnabledFilter EnabledOnly
foreach ($User in $Users) {
    if ($User.UsageLocation -ne 'PL') {
        Set-MsolUser -UserPrincipalName $User.UserPrincipalName -UsageLocation PL
    }
    if ($User.IsLicensed -eq $false -and $Exclusions -notcontains $User.UserPrincipalName) {
        Set-MsolUserLicense -UserPrincipalName $User.UserPrincipalName -AddLicenses $License -LicenseOptions $E1CustomizedLicense
    }
}

As part of the above code, I've added the ability to exclude some accounts. Please keep in mind that I'm assigning everyone a license that doesn't have one yet. With multiple licenses being available in your tenant, you may need to modify the code a bit and apply it based on that. You can quickly check for possible plans to disable/enable with following code

$LicensePlans = Get-MsolAccountSku | ForEach-Object {
    [PSCustomObject] @{
        LicenseName = $_.AccountSkuId
        Plans = $_.ServiceStatus.ServicePlan.ServiceName -join ', '
    }
}
$LicensePlans | Format-Table -AutoSize

For me, the first option is always the way to go unless you're out of luck when it comes to having limited features for your Office 365 tenant. The second option, while great, is only applicable to PowerShell and your helpdesk staff can still assign wrong licenses manually. It would be great if the second option would create a variant of a license that can be chosen from the interface but not having much hope for this one.

This post was last modified on %s = human-readable time difference 22:19

Przemyslaw Klys

System Architect with over 14 years of experience in the IT field. Skilled, among others, in Active Directory, Microsoft Exchange and Office 365. Profoundly interested in PowerShell. Software geek.

Share
Published by
Przemyslaw Klys

Recent Posts

Upgrade Azure Active Directory Connect fails with unexpected error

Today, I made the decision to upgrade my test environment and update the version of…

1 month ago

Mastering Active Directory Hygiene: Automating Stale Computer Cleanup with CleanupMonster

Have you ever looked at your Active Directory and wondered, "Why do I still have…

2 months ago

Active Directory Replication Summary to your Email or Microsoft Teams

Active Directory replication is a critical process that ensures the consistent and up-to-date state of…

7 months ago

Syncing Global Address List (GAL) to personal contacts and between Office 365 tenants with PowerShell

Hey there! Today, I wanted to introduce you to one of the small but excellent…

11 months ago

Active Directory Health Check using Microsoft Entra Connect Health Service

Active Directory (AD) is crucial in managing identities and resources within an organization. Ensuring its…

1 year ago

Seamless HTML Report Creation: Harness the Power of Markdown with PSWriteHTML PowerShell Module

In today's digital age, the ability to create compelling and informative HTML reports and documents…

1 year ago