Licensing and Graph cmdlets

As a continuation to my previous two posts on Graph and licensing…

Recently we switched to E5 licenses. These include the PowerBI Pro licensing as a service plan, so there’s no need to assign the Power BI Pro license any more via its previous groups.

So my first task was to go through all our groups that have the E5 license applied and ensure they don’t disable Power BI Pro. I did that the following way:

$licensedSkus = Get-MgSubscribedSku
$skuId = ($licensedSkus | Where-Object{ $_.SkuPartNumber -eq "SPE_E5" }).SkuId
# Get the plan id of "Power BI Pro" (appears as "BI_AZURE_P2") in the E5 license
$planId = (($licensedSkus | Where-Object{ $_.SkuPartNumber -eq "SPE_E5" }).ServicePlans | Where-Object { $_.ServicePlanName -match "BI"}).ServicePlanId

$graphFilter = "startsWith(DisplayName,'<replace as needed>')"
foreach ($groupObj in Get-MgGroup -All -Filter $graphFilter -Property assignedLicenses,Id,DisplayName) {
    $groupName = $groupObj.DisplayName
    $planDisabled = ($groupObj.AssignedLicenses | Where-Object { $_.SkuId -eq $skuId }).DisabledPlans -contains $planId
    "$groupName - $planDisabled"
}

$licensedSkus = Get-MgSubscribedSku

$skuId = ($licensedSkus | Where-Object{ $_.SkuPartNumber -eq "SPE_E5" }).SkuId

# Get the plan id of "Power BI Pro" (appears as "BI_AZURE_P2") in the E5 license

$planId = (($licensedSkus | Where-Object{ $_.SkuPartNumber -eq "SPE_E5" }).ServicePlans | Where-Object { $_.ServicePlanName -match "BI"}).ServicePlanId

$graphFilter = "startsWith(DisplayName,'<replace as needed>')"

foreach ($groupObj in Get-MgGroup -All -Filter $graphFilter -Property assignedLicenses,Id,DisplayName) {

$groupName = $groupObj.DisplayName

$planDisabled = ($groupObj.AssignedLicenses | Where-Object { $_.SkuId -eq $skuId }).DisabledPlans -contains $planId

"$groupName - $planDisabled"

}

First I get the SKU Id of the E5 license. Then I get the Service Plan ID of Power BI Pro.

Next I pull all the groups I am interested in (replace the <replace as needed> bit in the code). When pulling the info I also get the license assignments. And finally, for each group I get the E5 license, enumerate the disabled plans, and check if it contains the Power BI Pro plan. I output this along with the group name.

My next task was to go through all the groups that currently have the Power BI Pro license, double check that these users indeed have a Power BI Pro license assigned via a E5 license, and if not flag such users.

$licensedSkus = Get-MgSubscribedSku
$skuId = ($licensedSkus | Where-Object{ $_.SkuPartNumber -eq "SPE_E5" }).SkuId
# Get the plan id of "Power BI Pro" (appears as "BI_AZURE_P2") in the E5 license
$planId = (($licensedSkus | Where-Object{ $_.SkuPartNumber -eq "SPE_E5" }).ServicePlans | Where-Object { $_.ServicePlanName -match "BI"}).ServicePlanId

Get-MgGroup -All -Filter "startsWith(DisplayName,'<replace>')" | 
ForEach-Object {
    "$($_.DisplayName)"
    $userObjs = Get-MgGroupMember -GroupId $_.Id -All
    "Found $($userObjs.Count) users"

    foreach ($userObj in $userObjs) {
        $assignedLicenses = (Get-MgUser -UserId $userObj.Id -Property assignedLicenses,Id,mail).AssignedLicenses
        if ($assignedLicenses.SkuId -notcontains $skuId) {
            "$($userObj.mail) doesn't have an E5 license"
        }

        if ($assignedLicenses.SkuId -contains $skuId) {
            if (($assignedLicenses | Where-Object { $_.SkuId -eq $skuId }).DisabledPlans -contains $planId) {
                "$($userObj.mail) has E5 license but no Power BI Pro plan"
            }
        }
    }
}

$licensedSkus = Get-MgSubscribedSku

$skuId = ($licensedSkus | Where-Object{ $_.SkuPartNumber -eq "SPE_E5" }).SkuId

# Get the plan id of "Power BI Pro" (appears as "BI_AZURE_P2") in the E5 license

$planId = (($licensedSkus | Where-Object{ $_.SkuPartNumber -eq "SPE_E5" }).ServicePlans | Where-Object { $_.ServicePlanName -match "BI"}).ServicePlanId

Get-MgGroup -All -Filter "startsWith(DisplayName,'<replace>')" |

ForEach-Object {

"$($_.DisplayName)"

$userObjs = Get-MgGroupMember -GroupId $_.Id -All

"Found $($userObjs.Count) users"

foreach ($userObj in $userObjs) {

$assignedLicenses = (Get-MgUser -UserId $userObj.Id -Property assignedLicenses,Id,mail).AssignedLicenses

if ($assignedLicenses.SkuId -notcontains $skuId) {

"$($userObj.mail) doesn't have an E5 license"

}

if ($assignedLicenses.SkuId -contains $skuId) {

if (($assignedLicenses | Where-Object { $_.SkuId -eq $skuId }).DisabledPlans -contains $planId) {

"$($userObj.mail) has E5 license but no Power BI Pro plan"

}

Last one. Some days ago I had to copy all the licenses assigned on one group to another. And also make ensure only the plans that are enabled in the source group are enabled on the destination group.

$srcGroupObj = $null
try {
    $srcGroupObj = Get-MgGroup -Filter "DisplayName eq '$srcGroupName'" -Property assignedLicenses,Id,DisplayName
    if ($null -eq $srcGroupObj) {
        Write-Host "$srcGroupName cannot be found"
        return
    }

} catch {
    Write-Host "Something went wrong getting the group: $($_.Exception.Message)"
}

$dstGroupObj = $null
try {
    $dstGroupObj = Get-MgGroup -Filter "DisplayName eq '$dstGroupName'" -Property assignedLicenses,Id,DisplayName
    if ($null -eq $dstGroupObj) {
        Write-Host "$dstGroupName cannot be found"
        return
    }

} catch {
    Write-Host "Something went wrong getting the group: $($_.Exception.Message)"
}

foreach ($license in $srcGroupObj.AssignedLicenses) {
    if ($dstGroupObj.AssignedLicenses.SkuId -contains $license.SkuId -and $skipIfPresent) {
        Write-Host "$($license.SkuId) is already present, skipping..."
        continue
    }
    
    # https://learn.microsoft.com/en-us/graph/api/group-assignlicense?view=graph-rest-1.0&tabs=powershell
    $params = @{
        addLicenses = @(
            @{
                disabledPlans = $license.DisabledPlans
                skuId = $license.SkuId
            }
        )
        removeLicenses = @(
        )
    }

    Set-MgGroupLicense -GroupId $dstGroupObj.Id -BodyParameter $params
}

$srcGroupObj = $null

try {

$srcGroupObj = Get-MgGroup -Filter "DisplayName eq '$srcGroupName'" -Property assignedLicenses,Id,DisplayName

if ($null -eq $srcGroupObj) {

Write-Host "$srcGroupName cannot be found"

return

}

} catch {

Write-Host "Something went wrong getting the group: $($_.Exception.Message)"

}

$dstGroupObj = $null

try {

$dstGroupObj = Get-MgGroup -Filter "DisplayName eq '$dstGroupName'" -Property assignedLicenses,Id,DisplayName

if ($null -eq $dstGroupObj) {

Write-Host "$dstGroupName cannot be found"

return

}

} catch {

Write-Host "Something went wrong getting the group: $($_.Exception.Message)"

}

foreach ($license in $srcGroupObj.AssignedLicenses) {

if ($dstGroupObj.AssignedLicenses.SkuId -contains $license.SkuId -and $skipIfPresent) {

Write-Host "$($license.SkuId) is already present, skipping..."

continue

}

# https://learn.microsoft.com/en-us/graph/api/group-assignlicense?view=graph-rest-1.0&tabs=powershell

$params = @{

addLicenses = @(

disabledPlans = $license.DisabledPlans

skuId = $license.SkuId

}

)

removeLicenses = @(

)

}

Set-MgGroupLicense -GroupId $dstGroupObj.Id -BodyParameter $params

}