Assigning 365 licences using Powershell

[cookie_monsta]

Dear all,

 

I am hoping that there is a PowerShell and Office 365 Guru that I can approach for some assistance.

 

I have been trying in vain to get a PS script to work that will assign certain service plans within a O365 licence. I have successfully ran a PS script to extract the users from a specific OU in Active Directory in to a CSV file. What I/we would to achieve is to assign a Microsoft Teams licence/service plan from the STANDARDWOFFPACK_STUDENT Licence pack to those that are listed in the CSV file(s). The others Service Plans such as Yammer etc., should remain either unassigned or disabled.

 

I tried different variation of commands etc., but still fail to achieve what I/we need to. One script ran through, didn't error but nothing got assigned either.

 

All the intended users have been manually assigned a ProPlus 365 Student licence - though I/we do have a script that works for the this task.

 

If anyone has any advice or guidance; it will be very welcome.

 

Many thanks in advance,

 

Cookie

[Davit2005]

I struggled for the syntax for a few days.

 

Below is a snippet from my code that I used a few years ago now. Replace the $vairables and SKUID with your own and test with a single test user. $row.UserPrincipalName was pulled from doing a script to find unlicensed users in a csv

 

$UnLicensedUPN = $row.UserPrincipalName

$LicOptions = New-MsolLicenseOptions -AccountSkuId [sKUID]:STANDARDWOFFPACK_STUDENT -DisabledPlans MCOSTANDARD

 

Write-Host "**************************************"

Write-Host "Setting Usage Location and adding Licenses to - $UnLicensedUPN"

Set-MsolUser -UserPrincipalName $UnLicensedUPN -UsageLocation "GB"

Set-MsolUserLicense -UserPrincipalName $UnLicensedUPN -AddLicenses "[sKUID]:OFFICESUBSCRIPTION_STUDENT","[sKUID]:STANDARDWOFFPACK_STUDENT" -LicenseOptions $LicOptions

[cookie_monsta]

Hi Davit,

 

Many many thanks for this. I will manipulate your suggestion so it reflects our setup and I will see how I get on.

 

Kindest of regards,

 

Cookie

 

I struggled for the syntax for a few days.

 

Below is a snippet from my code that I used a few years ago now. Replace the $vairables and SKUID with your own and test with a single test user. $row.UserPrincipalName was pulled from doing a script to find unlicensed users in a csv

 

$UnLicensedUPN = $row.UserPrincipalName

$LicOptions = New-MsolLicenseOptions -AccountSkuId [sKUID]:STANDARDWOFFPACK_STUDENT -DisabledPlans MCOSTANDARD

 

Write-Host "**************************************"

Write-Host "Setting Usage Location and adding Licenses to - $UnLicensedUPN"

Set-MsolUser -UserPrincipalName $UnLicensedUPN -UsageLocation "GB"

Set-MsolUserLicense -UserPrincipalName $UnLicensedUPN -AddLicenses "[sKUID]:OFFICESUBSCRIPTION_STUDENT","[sKUID]:STANDARDWOFFPACK_STUDENT" -LicenseOptions $LicOptions

[markwilfan]

I do this within azure ad with security group. Much easier

[cookie_monsta]

Thanks Mark; Sadly we dont employ AAD in that manner. Our AD is still on-prem.

 

I guess my search goes on :/

 

I do this within azure ad with security group. Much easier

[Boredguy]

Are you not using Azure AD Sync for putting your users into 365 in the first place @cookie_monsta or you just relying purely on CSV?

 

If you are using the sync, then the Azure AD portal will let you assign licence based on your local AD group membership, and it is included in the free section of Azure.

[Norphy]

Even if you aren't using Azure AD Connect to sync your AD with Office 365, you can still create in-cloud groups using the Azure AD Portal (https://portal.azure.com) and assign users and licenses to it. Believe me, it's a lot easier to assign licenses to users this way than it is to assign them to individual users.

[cookie_monsta]

Hi @Norphy and @Boredguy,

 

We are using AAD to sync between on premise AD and EMC and O365. I will investigate the Azure AD portal option and then suggest this to the powers that be. Ideally we wanted a script that any global admin can run when and if needed but if its more efficient (and easier) using cloud based group instead; I will suggest this.

 

Thanks again

 

Cookie

 

Are you not using Azure AD Sync for putting your users into 365 in the first place @cookie_monsta or you just relying purely on CSV?

 

If you are using the sync, then the Azure AD portal will let you assign licence based on your local AD group membership, and it is included in the free section of Azure.

 

Even if you aren't using Azure AD Connect to sync your AD with Office 365, you can still create in-cloud groups using the Azure AD Portal (https://portal.azure.com) and assign users and licenses to it. Believe me, it's a lot easier to assign licenses to users this way than it is to assign them to individual users.

[Boredguy]

Well you could assign the users via a local group in AD, and that in turn automatically updates the licence and the apps. That way no script is needed and it's just a case of adding user to a group

[pete]

^ Yeah, we assign licenses based on membership of DomainName\Pupils and DomainName\Staff local groups so they're properly provisioned as soon as local AD syncs to Office 365 / Azure.

 

There's some corner cases where we still need to assign manually because we only want a subset of features, but the above covers 99% of the license allocation.

[cookie_monsta]

Hi Norphy,

 

I have tidied up our target year group OUs in on-prem AD, ensure that the they have the correct group membership etc. I have also created a new Global group in on-prem AD - for example, I have called it Year 1 students, and it is now also appearing in the Azure portal in group.

 

I think I have see where/how I can assign a licences. I cannot thank you enough for your advice.

 

Now to make this work before my Easter weekend begins. Hope you have a great one!!

 

Cheers

 

Cookie

 

 

Even if you aren't using Azure AD Connect to sync your AD with Office 365, you can still create in-cloud groups using the Azure AD Portal (https://portal.azure.com) and assign users and licenses to it. Believe me, it's a lot easier to assign licenses to users this way than it is to assign them to individual users.

[markwilfan]

Glad you sorted this. I learnt this from edugeekers too

[snagrat]

Don’t you need a special Azure AD premium subscription to be able to assign licenses based on groups?

[Boredguy]

Nope @snagrat it's available in the free section

[Davit2005]

There's some corner cases where we still need to assign manually because we only want a subset of features, but the above covers 99% of the license allocation.

 

This the issue we had, we only wanted certain features available. It was about 4 years ago now that I implemented Office365 and apart from manually assigning licenses this appeared the only way we could do it.

 

I rolled out Live@EDU back in 2009/2010 at another org which was also an interesting project to replace RM EasyMail.

[kennysarmy]

Is it possible to assign just the Office 365 Pro Plus part of the Office 365 Pro Plus licence to all my students using powershell?

 

 

We migrated our on-prem email solution at Easter to O365 and are now slowly slowly allowing the staff and students to use more of the O365 apps etc.

 

I know I can select 100 students at a time and manually apply but if it's easy enough to do this via Powershell I'll give it a go.

 

If it helps we've got a hybrid setup.

[kennysarmy]

It looks like from research that I should be able to deploy licences using AD groups.

 

https://practical365.com/blog/simplifying-office-365-license-control-azure-ad-group-based-license-management/

 

But when I log in to Azure I don't see any of my AD groups listed, does anyone know if this is a good solution and if so how do I get my AD Azure connect to sync my groups as well as my users?

[fredbayker]

It looks like from research that I should be able to deploy licences using AD groups.

 

https://practical365.com/blog/simplifying-office-365-license-control-azure-ad-group-based-license-management/

 

But when I log in to Azure I don't see any of my AD groups listed, does anyone know if this is a good solution and if so how do I get my AD Azure connect to sync my groups as well as my users?

 

You need to reconfigure your azure Ad connect tool/ADsync to include group. This should help:

https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-configure-filtering

 

We have it configured and assign licences based on membership of specific groups. Once configured, licence assignment is pretty much automated.

[kennysarmy]

I've managed to successfully sync my two groups from AD to O365.

 

They are named : O365-Faculty & O365-Students

 

However I still can't locate them when I try to assign a licence - ideas anyone?

 

 

[Norphy]

That's odd, licensing is just another menu item on mine:

 

This could be an access rights thing. What roles does your Azure AD user hold?

 

/edit

 

That group is a distribution group rather than a security group. That could be the issue.

Edited June 27, 2019 by Norphy

[kennysarmy]

My groups are Global Distribution Groups with the correct AD attributes set : Name, DisplayName, ProxyAddress, Mail.

[kennysarmy]

That's odd, licensing is just another menu item on mine:

[ATTACH=CONFIG]54014[/ATTACH]

 

This could be an access rights thing. What roles does your Azure AD user hold?

 

/edit

 

That group is a distribution group rather than a security group. That could be the issue.

 

Can I just edit the group properties in AD and change it to a Security Group?

[Norphy]

Can I just edit the group properties in AD and change it to a Security Group?

 

Yes, you can

[kennysarmy]

Great.

 

Groups have updated to Azure and I've now sorted the staff so they are assigned their O365 licences via the group they belong to in AD, did take a few minutes to go through and delete all their "Directly Assigned" licences.

 

When I come to do the same for my students - is there a quicker way to do this?

 

In the Azure Active Directory Admin Center I cannot see a way to quickly select multiple users :/ so I can remove their licence...

[Norphy]

The easiest way would be to use PowerShell and the AzureAD PowerShell Module. There's a pretty good guide here: https://practical365.com/blog/managing-office-365-licenses-with-azure-ad-v2-powershell-module/