Assign Office 365 Licences based on group membership

[k-strider]

I currently have been using the code below to assign Office Pro Plus for Students based on a group membership. which is great because i can allocate them quickly.

 

I was wondering if anyone would know how to change it so that if they have the license already then it ignores them (the last bit) so i could leave the script to run automatically therefore licensing up the users automatically once they are provisioned in o365.

 

I built this script using two separate scripts i found online, one that assigned licences and the other that made a bulk change to a user attribute based on group.

 

$AccountSkuId = "OurSchool:OFFICESUBSCRIPTION_STUDENT"
$UsageLocation = "GB"
$AdminUsername = "syncAccount@ourschooldomain"
$AdminPassword = "ThePassword"


$SecurePassword = ConvertTo-SecureString $AdminPassword -AsPlainText -Force
$cred = New-Object -TypeName System.Management.Automation.PSCredential -argumentlist $AdminUsername,$SecurePassword

Connect-MSOLService -Credential $cred

$LicenseOptions = New-MsolLicenseOptions -AccountSkuId $AccountSkuId

$AdGrp = "y10"
# Get the AD Group in Azure
$AzAdGrp = Get-MsolGroup -All | Where-Object { $_.DisplayName -eq $AdGrp }
$AzAdGrp_members = Get-MsolGroupMember -All -GroupObjectId $AzAdGrp.ObjectId
write-host "Total members of group: " $AzAdGrp_members.Count

# Create array of users to change
$users = Get-MsolGroupMember -All -GroupObjectId $AzAdGrp.ObjectId | Get-MsolUser
write-host "Total members of group: " $users.Count

$LicenseOptions = New-MsolLicenseOptions -AccountSkuId $AccountSkuId
$users | ForEach-Object { Set-MsolUserLicense -UserPrincipalName $_.UserPrincipalName -AddLicenses $AccountSkuId -LicenseOptions $LicenseOptions }

[michaelf]

I've not used this myself, but I believe the Get-MsolUser has a -UnlicensedUsersOnly parameter which should return only those users who do not already have a license assigned.

 

From https://msdn.microsoft.com/en-us/library/dn194133.aspx

    -UnlicensedUsersOnly []
       The filter for only users who are not assigned a license.
       
       Required?                    false
       Position?                    named
       Default value                
       Accept pipeline input?       false
       Accept wildcard characters?  false

 

So changing

 $users = Get-MsolGroupMember -All -GroupObjectId $AzAdGrp.ObjectId | Get-MsolUser 

to

$users = Get-MsolGroupMember -All -GroupObjectId $AzAdGrp.ObjectId | Get-MsolUser -UnlicensedUsersOnly 

might do the trick?

Edited June 21, 2016 by michaelf

[Matt_Renato]

I don't think the -UnlicensedUsersOnly switch will work (at least it didn't when I tested it).

 

This is essentially the same thing but done in a different way.

 

# Create array of users to change
$users = Get-MsolGroupMember -All -GroupObjectId $AzAdGrp.ObjectId | Get-MsolUser|Where{$_.isLicensed -eq $False}
Write-Output "Total unlicensed users in group: " $users.Count

[k-strider]

Thanks Guys i will give it a try

[k-strider]

Well i had to fiddle a bit this still isn't perfect but its getting there:

 

$users = Get-MsolGroupMember -All -GroupObjectId $AzAdGrp.ObjectId | Get-MsolUser|Where {$_.isLicensed -eq $True -and $_.licenses[0].accountskuid.tostring() -ne $AccountSkuId}

Write-Output "Total unlicensed users in group: " $users.Count

 

i have one staff license for OFFICESUBSCRIPTION_FACULTY all staff are licensed for o356 for education so $_.isLicensed -eq $False would always return 0 so i swapped it around and had to add the bit about the specific license i'm interested in. and i got 126 for total members in group then 125 for unlicensed so this will work now as long as i allocate o365 license separately using a different script first which i probably will do...

[k-strider]

here it is in total for our staff... just have to remember to provision the o365 for education license first.

 

$AccountSkuId = "SchoolName:OFFICESUBSCRIPTION_FACULTY"
$UsageLocation = "GB"
$AdminUsername = "SyncUser@SchoolName"
$AdminPassword = "SyncPassword"


$SecurePassword = ConvertTo-SecureString $AdminPassword -AsPlainText -Force
$cred = New-Object -TypeName System.Management.Automation.PSCredential -argumentlist $AdminUsername,$SecurePassword

Connect-MSOLService -Credential $cred

$LicenseOptions = New-MsolLicenseOptions -AccountSkuId $AccountSkuId

$AdGrp = "UsersInThisGroupGetOfficeProPlus"
# Get the AD Group in Azure
$AzAdGrp = Get-MsolGroup -All | Where-Object { $_.DisplayName -eq $AdGrp }
$AzAdGrp_members = Get-MsolGroupMember -All -GroupObjectId $AzAdGrp.ObjectId
write-host "Total members of group: " $AzAdGrp_members.Count

# Create array of users to change
# Command to run for all users in the group:
$users = Get-MsolGroupMember -All -GroupObjectId $AzAdGrp.ObjectId | Get-MsolUser|Where {$_.isLicensed -eq $True  -and $_.licenses

[0].accountskuid.tostring() -ne $AccountSkuId}
Write-Output "Total unlicensed users in group: " $users.Count

$LicenseOptions = New-MsolLicenseOptions -AccountSkuId $AccountSkuId
$users | ForEach-Object { Set-MsolUserLicense -UserPrincipalName $_.UserPrincipalName -AddLicenses $AccountSkuId -LicenseOptions $LicenseOptions }