Powershell script help for pulling AD Users from Office 365 with a specific license

[Jay9xx]

Trying to run the script below to filter out users to input into another script.

$ADUsers = Get-ADUser -filter * -Properties * | ? {$_.extensionAttribute6 -eq "TESTATT"}

 

Foreach ($ADUser in $ADUsers) {

 

$MSOusers = Get-msoluser -userprincipalname $ADUser.userPrincipalName | where-object {$_.Licenses.AccountSkuId -eq "mydomain:STANDARDWOFFPACK_STUDENT"}

 

}

The first line runs correctly and will output the correct results if I echo them out in the format below.

[email protected]

[email protected]

 

When I get to the next part (Foreach) I get the error I posted in the subject below.

Cannot convert 'System.Object[]' to the type 'System.String' required by parameter 'UserPrincipalName'. Specified method is not supported.

Any suggestions on what I'm doing wrong or lacking in the script?

[HPlum78]

First things first can we sort out the -Filter * -Properties *

 

In itself it seems like a minor thing but you start doing that on a AD directory with any amount of objects you will be most unpopular! If you want more on this I will point you at Jeff Snover and Don Jones they love this as much as i do...

 

So I would do something like:

Get-ADUser -Filter {extensionAttribute6 -like "TESTATT"} | select UserPrincipalName

 

Would do I think (need to be in front of a computer!) but demonstrates what I am driving at.

Edited August 25, 2020 by HPlum78

[Jay9xx]

I tried that at first, because I didn't want to pull the -filter * and -properties *, but for some reason it wasn't capturing the extensions attribute unless I did that. Not sure what was up with that, but to your credit I thought for the hell of it I'll try it again and now it is freaking working, but I used the -eq instead of -notlike. So thanks for bringing that back up. The cleaner I can make the powershell the better.

 

But however that still has no bearing on fixing the problem at hand unfortunately.

Edited August 25, 2020 by Jay9xx

[HPlum78]

I always find myself doing -like -eq head bang I never get it even after all this time..

[HPlum78]

So if you use my above line of code with your var you should get the UserPrincipalName of all the users that match your filter. From there you can use:

 

$ADUsers.UserPrincipalName.ForEach({

$MSOusers =Get-msoluser -userprincipalname $ADUser.userPrincipalName |where-object{$_.Licenses.AccountSkuId-eq "mydomain:STANDARDWOFFPACK_STUDENT"}

})

[HPlum78]

I think that should do the trick, I have said this a number of times the -.ForEach method is quick due to the work the -.Net team has put in under the hood (although only available in later versions of PS) is the easiest way to put it.

[Jay9xx]

Getting the error below now. You mentioned a later version of powershell. What version should this work on? That could by my problem. I'm running 5.1.19041.1.

 

Get-MsolUser : Cannot bind argument to parameter 'UserPrincipalName' because it is null.At C:\temp\msousers.ps1:4 char:43+ ... ers=Get-msoluser -userprincipalname $ADUser.userPrincipalName |where- ...+                                         ~~~~~~~~~~~~~~~~~~~~~~~~~    + CategoryInfo          : InvalidData: ( [Get-MsolUser], ParameterBindingValidationException    + FullyQualifiedErrorId : ParameterArgumentValidationErrorNullNotAllowed,Microsoft.Online.Administration.Automation.GetUser

[HPlum78]

Ah I see what's going on give me a sec should have cast my eye over the code in the foreach

 

So that line there:

$MSOusers =Get-msoluser -userprincipalname $ADUser.userPrincipalName

 

Should probably be something like:

$MSOusers =Get-msoluser -userprincipalname $_

 

And your good with the version not the issue here.

 

But then that leads us to the next issue you are going to find.... Try it make sure it returns a user then will will sort the next part out.

Edited August 25, 2020 by HPlum78

[Jay9xx]

Cool beans HPlum! Really appreciate the help with this. I'll try and get back soon!

[Jay9xx]

Ok, the script didn't error out this time, but it's not returning any users. I currently have two users set that the first line should feed back and it does. Basically if I do "echo $ADUsers.userprincipalname" I will see the following.

 

[email protected]

[email protected]

 

But after I run the next part now, I'm not getting any errors at all, but when I run the last part, it should only showing me [email protected], as [email protected] doesn't match the license criteria I have set at the end part of the script. That is assuming that I should be able to do "echo $MSOUsers" and see either the UPN or details for [email protected] who does match the license criteria I have set at the last part of the script. Maybe?

[Jay9xx]

Ok, my bad it does work as long as I don't run the first line in the same script. If I run the first line, then run the line next separately it is reporting correctly and I see [email protected] output that I should see. Really strange. For some reason, if I put both in the same script, I get a null value for $ADUsers, so that is why I was getting nothing for $MSOusers previously. Not sure if there is something I can do to get them to work in the same script though.

[HPlum78]

Just post the code that you have thus far please.

[Jay9xx]

Just post the code that you have thus far please.

 

 

$ADUsers=Get-ADUser -Filter {extensionAttribute6 -like "TESTATT"} | select UserPrincipalName

$ADUsers.UserPrincipalName.ForEach({$MSOusers=Get-msoluser -userprincipalname $_ |where-object{$_.Licenses.AccountSkuId-eq "domain:STANDARDWOFFPACK_STUDENT"} > .\usersmso.txt
})

 

The last part > .\usersmso.txt I'm just using to test output when running using a .bat file calling powershell. But it works when ran separately still though.

Edited August 25, 2020 by Jay9xx

[Jay9xx]

Never mind. It seems to be working now. I think my text editor was putting in some strange characters causing it to be off. Cool beans I should be able to get it from here ...maybe..hehe. I really do appreciate your time and help with the syntax on this.

[HPlum78]

NP good luck.

[Jay9xx]

I feel kinda dumb now. I found out what was going on and why I wasn't seeing things after I ran them in a script. Apparently I think that is how it is supposed to work. My mistake was piece milling it together instead of just trying to run all of it at once. When I would run the script, and then try to use the cli to get values for the variables using the echo command, apparently anything ran inside the script environment stays within that environment and doesn't propagate to the open command line, if that makes sense? For example I could run the script you helped me with, then expect to issue "echo $MSOusers" and see the value for $MSOusers but it wouldn't show up at all. But if I included the echo MSOusers in the script, it would produce the output I was looking for after I ran the script showing "[email protected]".

 

So I went ahead and put the rest of my script together and it worked fine. Wasn't sure if you knew that or not, but in case not I wanted to let you know what was happening and thanks again for all the help. This script will go a long way to help automate a task that has been a bit of a pain lately.

[HPlum78]

Yeah I know the pain of outputting in interactive and non interactive scripts there are ways of dealing with this seemed a bit much to get into whilst trying to get something in and working.

 

That said I am happy to cover the ins and outs of all this, I do love me a PowerShell and will always turn to it to for automation.

There is another way to report on licensing that I noticed the other day using the graph API. I was going to take a look at the PS and graph calls to see what I could come up with will let you know how that goes.

 

One other note is when writing scripts use try catch blocks these will help you in your scripting endeavours in the future. Look at some of my previous post on error trapping in the scripts thread on here.

[Jay9xx]

Awesome. I definitely will keep that in mind. Everyday is a new learning experience with powershell. So much you can accomplish with it.

[HPlum78]

So there is a graph API call that can be used here are the details:

https://docs.microsoft.com/en-us/graph/api/user-list-licensedetails?view=graph-rest-1.0&tabs=http

 

I will code something up and post it here when I have something.

[Jay9xx]

Cool beans! I will give it a look. That has been something I've been needing to learn about as well. I haven't had a chance to play around with the graph API stuff yet. It will be cool to see!

 

Jay