Auto assign licenses in O365 yet ?

[mikkydoos]

I still don't think MS have implemented this yet but does anyone know of a way to auto assign licenses to users sync'd to Office 365.

 

Got my powershell and the admin UI but I keep forgetting to assign licenses when adding new users and don't particularly want to schedule the script licensing the relevant groups.

 

"My email won't work" -- "Doh!"

 

 

Anyone ?

 

 

 

Cheers in advance

[FN-GM]

Maybe you could use a script to run as a scheduled task incase you forget?

 

If you use Salamander that can also do it?

[internetuser]

I use a power shelf script to assign licences to users with nolicence

[CAWJames]

I run a script every morning that looks for unlicensed staff or students then powershells them into licence submission the student script even emails them the details. Love the no admin for this one

[Boredguy]

We have a script that runs every morning that creates any new user accounts on the network, and a second script that runs every hour and sets the licences for any Office 365 account that is currently unlicenced and AD Syncronised.

[Davit2005]

PowerShell script is the only method at the moment.

 

We used to run script nightly to assign license to unlicensed users as others have done.

[mikkydoos]

Thanks all. Its a bit fiddly because we have certain users who we dont want O365 licenses for, but they are in the same security group as others.

Will have to create some more finite groups methinks.

 

Have to be manual for right now till I do.

[3s-gtech]

I've been implementing some O365 features recently, the scripts I used read some other AD attributes to ensure that they don't apply to the wrong users. You can sync things like the Department attribute - our scripts then read this when doing get- queries. You can use quite a few different attributes, and put any custom value in your AD object to filter.

[Jamoire]

Like others we have a PowerShell script to assign the licenses but we have it as a scheduled task that runs each time the AD sync finishes so users get the licenses assigned relatively quickly after being created.

[snagrat]

Anyone like to share their more advance script. Mine just assigns a license based on AD Group but would like something more targeted.

Also mine assigns the whole features of the main license as I could get it to disable certain products.

[AliG]

I have struggled with these licensing issues since we implemented O365 if anyone wouldn't mind sharing a script and how to automate it then it would be greatly appreciated

[Arthur]

mine assigns the whole features of the main license as I couldn't get it to disable certain products.

I have struggled with these licensing issues since we implemented O365 if anyone wouldn't mind sharing a script and how to automate it then it would be greatly appreciated

I use the script mentioned in the following thread (along with a PS module called Connect-O365)...

 

www.edugeek.net/forums/cloud-services/170870-office-365-planner-preview-default.html#post1464073

 

It's the only one I have come across that makes any sense since assigning licenses in Office 365 is completely illogical.

 

Related article: https://mattmcnabb.github.io/Office-365-Licensing_4

 

Problem 1 - DisabledPlans

The biggest drawback to configuring user licenses via PowerShell lies in the design of the New-MsolLicenseOptions cmdlet. The problem is that the -DisabledPlans parameter is inherently the wrong approach to license automation. For example, let’s say we’ve set up a script that licenses users for the EnterprisePack and you’ve added Sharepoint to the disabled plans. In it’s original state, this would have enabled Exchange, Skype for Business, and Yammer. However, last year Microsoft added a new service plan to the license - Sway. This means that as soon as Sway became available as an assignable license in your tenant, Sway would have been assigned to your users because it hasn’t been explicitly added to the list of disabled plans.

 

So what we need to solve this problem is a method of setting enabled plans rather than disabled ones. That way no services will be provisioned for users unless you have explicitly added it in your script.

 

Problem 2 - AddLicenses

When you license a user who is currently unlicensed you use the -AddLicenses parameter of Set-MsolUserLicense to provision the license for the first time. However, if a user is already licensed and you need to modify the provisioned service plans, you need to omit the -AddLicenses parameter. If you don’t you’ll receive an error - "The license is invalid". This isn’t a very descriptive error, and you’ll get the same error if you assign an appropriate license but with invalid options. This can be a big roadblock to an automated solution since we won’t know how to react to the error appropriately.

[snagrat]

I use the script mentioned in the following thread (along with a PS module called Connect-O365)...

 

www.edugeek.net/forums/cloud-services/170870-office-365-planner-preview-default.html#post1464073

 

It's the only one I have come across that makes any sense since assigning licenses in Office 365 is completely illogical.

 

Related article: https://mattmcnabb.github.io/Office-365-Licensing_4

 

Looks good.

 

I assume you schedule task this easily enough to run automatically?

[Katy]

I've just set this up on my system now. You need it to save the credentials in order to run as an unattended task, I found this:

https://blogs.technet.microsoft.com/robcost/2008/05/01/powershell-tip-storing-and-using-password-credentials/

I stuck the Set-Office365Licences.ps1 file that was linked from http://www.edugeek.net/forums/cloud-services/170870-office-365-planner-preview-default.html#post1464073 (which I think Arthur linked further up) into a folder with the below (where xxxxxx = the tenant name), saved as AutoLicence.ps1

. .\Set-O365UserLicense.ps1
$password = Get-Content .\cred.txt | ConvertTo-SecureString
$Cred = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "[email protected]",$password
Connect-MsolService -Credential $Cred

$Students = Get-MsolUser -Department Student -UnlicensedUsersOnly -All

$StudentTemplate1 = @{  
   AccountSkuId = 'xxxxxx:STANDARDWOFFPACK_STUDENT'
   EnabledPlans = 'SHAREPOINTWAC_EDU','EXCHANGE_S_STANDARD','SHAREPOINTSTANDARD_EDU'
}
$StudentTemplate2 = @{
   AccountSkuId = 'xxxxxx:OFFICESUBSCRIPTION_STUDENT'
   EnabledPlans = 'EXCHANGE_S_FOUNDATION','ONEDRIVESTANDARD','OFFICESUBSCRIPTION','SHAREPOINTWAC_EDU'
}

$Students | Set-MsolUser -UsageLocation GB
$Students | Set-O365UserLicense -LicenseTemplate $StudentTemplate1,$StudentTemplate2

$Staff = Get-MsolUser -Department Staff -UnlicensedUsersOnly -All
$StaffTemplate1 = @{
   AccountSkuId = 'xxxxxx:STANDARDWOFFPACK_FACULTY'
   EnabledPlans = 'FLOW_O365_P2','POWERAPPS_O365_P2','RMS_S_ENTERPRISE','OFFICE_FORMS_PLAN_2','PROJECTWORKMANAGEMENT','SWAY','YAMMER_EDU','SHAREPOINTWAC_EDU','MCOSTANDARD','SHAREPOINTSTANDARD_EDU','EXCHANGE_S_STANDARD'
}
$StaffTemplate2 = @{
   AccountSkuId = 'xxxxxx:OFFICESUBSCRIPTION_STUDENT'
   EnabledPlans = 'EXCHANGE_S_FOUNDATION','ONEDRIVESTANDARD','OFFICESUBSCRIPTION','SHAREPOINTWAC_EDU','SWAY','OFFICE_FORMS_PLAN_2'
}
$Staff | Set-MsolUser -UsageLocation GB
$Staff | Set-O365UserLicense -LicenseTemplate $StaffTemplate1,$StaffTemplate2

That basically gives the students a few select features and staff all (except InTune), the students need to have the Department field in AD set to Student, the staff need it set to Staff, and it only picks out unlicensed users so it won't overwrite anything already set.

Once logged on as the user that will be running the script, you need to do this:

read-host -assecurestring | convertfrom-securestring | out-file cred.txt

and type the password for your Office365 admin account. In the third line of the above script you replace [email protected] with your 365 admin logon.

 

Then create a scheduled task to run:

Application: powershell

Arguments: .\AutoLicence.ps1

Start In: C:\powershell (or wherever you saved everything)

 

Note the task has to run as the user that ran the read-host line to encrypt the password or it won't work.

You can find out what your Account SKUs are by running:

Connect-MsolServiceGet-MsolAccountSku

and to find out what the plans are called:

(Get-MsolAccountSku | where {$_.AccountSkuId -eq ''}).ServiceStatus

where is one of the IDs returned from the Get-MsolAccountSku.

Edited January 14, 2017 by Katy

[CAWJames]

http://www.edugeek.net/forums/cloud-services/157567-password-management-office-365-a-2.html

 

See post #17 for my auto script that takes a list of students/staff etc from a CSV (created by SSIS from our home developed MIS in my case) and auto creates an account and assigns a licence to them and sends them an email with their username and password. It also checks O365 to make sure it isn't trying to create an address already created. HTML is a bit crappy, but has been updated many times since this post in 2015! It also now reassigns an alumni exchange online licence to a student when they are no longer studying, so we can keep in communication for CPD etc.

 

Not sure its any use to you, but there it is!

 

Bit of hands off admin

[snagrat]

I've just set this up on my system now. You need it to save the credentials in order to run as an unattended task, I found this:

https://blogs.technet.microsoft.com/robcost/2008/05/01/powershell-tip-storing-and-using-password-credentials/

I stuck the Set-Office365Licences.ps1 file that was linked from http://www.edugeek.net/forums/cloud-services/170870-office-365-planner-preview-default.html#post1464073 (which I think Arthur linked further up) into a folder with the below (where xxxxxx = the tenant name), saved as AutoLicence.ps1

. .\Set-O365UserLicense.ps1
$password = Get-Content .\cred.txt | ConvertTo-SecureString
$Cred = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "[email protected]",$password
Connect-MsolService -Credential $Cred

$Students = Get-MsolUser -Department Student -UnlicensedUsersOnly

$StudentTemplate1 = @{  
   AccountSkuId = 'xxxxxx:STANDARDWOFFPACK_STUDENT'
   EnabledPlans = 'SHAREPOINTWAC_EDU','EXCHANGE_S_STANDARD','SHAREPOINTSTANDARD_EDU'
}
$StudentTemplate2 = @{
   AccountSkuId = 'xxxxxx:OFFICESUBSCRIPTION_STUDENT'
   EnabledPlans = 'EXCHANGE_S_FOUNDATION','ONEDRIVESTANDARD','OFFICESUBSCRIPTION','SHAREPOINTWAC_EDU'
}

$Students | Set-MsolUser -UsageLocation GB
$Students | Set-O365UserLicense -LicenseTemplate $StudentTemplate1,$StudentTemplate2

$Staff = Get-MsolUser -Department Staff -UnlicensedUsersOnly
$StaffTemplate1 = @{
   AccountSkuId = 'xxxxxx:STANDARDWOFFPACK_FACULTY'
   EnabledPlans = 'FLOW_O365_P2','POWERAPPS_O365_P2','RMS_S_ENTERPRISE','OFFICE_FORMS_PLAN_2','PROJECTWORKMANAGEMENT','SWAY','YAMMER_EDU','SHAREPOINTWAC_EDU','MCOSTANDARD','SHAREPOINTSTANDARD_EDU','EXCHANGE_S_STANDARD'
}
$StaffTemplate2 = @{
   AccountSkuId = 'xxxxxx:OFFICESUBSCRIPTION_STUDENT'
   EnabledPlans = 'EXCHANGE_S_FOUNDATION','ONEDRIVESTANDARD','OFFICESUBSCRIPTION','SHAREPOINTWAC_EDU','SWAY','OFFICE_FORMS_PLAN_2'
}
$Staff | Set-MsolUser -UsageLocation GB
$Staff | Set-O365UserLicense -LicenseTemplate $StaffTemplate1,$StaffTemplate2

That basically gives the students a few select features and staff all (except InTune), the students need to have the Department field in AD set to Student, the staff need it set to Staff, and it only picks out unlicensed users so it won't overwrite anything already set.

Once logged on as the user that will be running the script, you need to do this:

read-host -assecurestring | convertfrom-securestring | out-file cred.txt

and type the password for your Office365 admin account. In the third line of the above script you replace [email protected] with your 365 admin logon.

 

Then create a scheduled task to run:

Application: powershell

Arguments: .\AutoLicence.ps1

Start In: C:\powershell (or wherever you saved everything)

 

Note the task has to run as the user that ran the read-host line to encrypt the password or it won't work.

You can find out what your Account SKUs are by running:

Connect-MsolServiceGet-MsolAccountSku

and to find out what the plans are called:

(Get-MsolAccountSku | where {$_.AccountSkuId -eq ''}).ServiceStatus

where is one of the IDs returned from the Get-MsolAccountSku.

 

Excellent!!!

 

If I wanted to change already Licensed users could I just remove -UnlicensedUsersOnly?

[snagrat]

Also what if I wanted to get users based on Group, rather than Department.

 

From what I can see I could use Get-distributiongroupmber instead of Get-MsolUser.

 

Can you see any problems with that?

[Katy]

Excellent!!!

If I wanted to change already Licensed users could I just remove -UnlicensedUsersOnly?

Yes. Just realised it also needs -All at the end of the line too otherwise it will only return the default number of results rather than the actual amount of items.

 

Not sure targeting members of a distribution group as there doesn't appear to be an option on Get-MsolUser to pick from a group. I would have thought you'd need to use something that gives you the output of Get-MsolUser just filtered to the group. No idea on that one sorry!

[CAWJames]

I think Get-DistributionGroupMember is only for exchange/O365 mail distribution groups and I'm not sure it would output what is needed for the script into the variable

[CAWJames]

https://365lab.net/2014/04/15/office-365-assign-licenses-based-on-groups-using-powershell/

 

This may help, extracts users from a group and splits the members, then uses Set-MsolUser and Set-MsolUserLicence to apply to each group member

[gshaw]

Don't know why MS can't implement the Azure AD licensing method into O365.

 

In Azure you just license a group and any new users get the license automatically.

[mikkydoos]

Don't know why MS can't implement the Azure AD licensing method into O365.

 

In Azure you just license a group and any new users get the license automatically.

 

 

Exactly. Its a right pain and so clunky.

[Andycat]

We use Ruler Connect here, seems pretty good and we've had good experience with the developer.

[Arthur]

Don't know why MS can't implement the Azure AD licensing method into O365.

It looks like they have now!

 

Office 365 License Management Made Easy with Azure AD Groups

 

On 22 February 2017, Microsoft announced the preview of a new feature to control the assignment of Office 365 licenses using Azure AD Groups. Using groups to control licenses is a good idea because it introduces some automation to simplify and streamline a process that is often tiresome and prone to error when administrator assign licenses to users one at a time.

 

You need an account with an Azure AD Basic license (or above) to use the new feature, which Microsoft says they will eventually incorporate into plans like Office 365 E3.

 

Link: https://blogs.technet.microsoft.com/enterprisemobility/2017/02/22/announcing-the-public-preview-of-azure-ad-group-based-license-management-for-office-365-and-more/

Edited March 14, 2017 by Arthur

[gshaw]

It looks like they have now!

 

Office 365 License Management Made Easy with Azure AD Groups

 

 

 

Link: https://blogs.technet.microsoft.com/enterprisemobility/2017/02/22/announcing-the-public-preview-of-azure-ad-group-based-license-management-for-office-365-and-more/

 

About time too, don't worry MS I'll come up with some more ideas to improve your services soon, how about getting that Explorer \ placeholder \ OneDrive system sorted out in the next Win10 release