{"id":5411,"date":"2020-12-21T17:47:27","date_gmt":"2020-12-21T17:47:27","guid":{"rendered":"https:\/\/rakhesh.com\/?p=5411"},"modified":"2020-12-21T18:02:54","modified_gmt":"2020-12-21T18:02:54","slug":"azure-ad-remove-licenses-via-powershell","status":"publish","type":"post","link":"https:\/\/rakhesh.com\/azure\/azure-ad-remove-licenses-via-powershell\/","title":{"rendered":"Azure AD – Remove licenses via PowerShell"},"content":{"rendered":"

The Azure AD Powershell cmdlets are a bit quirky. They don’t behave like regular PowerShell cmdlets don’t (they don’t seem to work with switches like -Verbose<\/code> or -ErrorAction<\/code> for instance) and in general seem to be wrappers for some API requests that run behind the scenes. I am thankful they exist of course, coz the last thing I want to do is make API queries, but it would be nice if they behaved better.<\/p>\n

Here’s one quirk I ran into today. I wanted to remove licenses from a bunch of users. There’s a cmdlet Set-AzureADUserLicense<\/code> and it’s well documented<\/a> too with an example:<\/p>\n

$LicensedUser = Get-AzureADUser -ObjectId \"TemplateUser@contoso.com\"  \r\n$License = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicense $License.SkuId = $LicensedUser.AssignedLicenses.SkuId \r\n\r\n$Licenses = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicenses $Licenses.AddLicenses = $License \r\n\r\n$User = Get-AzureADUser -ObjectId \"User@contoso.com\"  \r\nSet-AzureADUserLicense -ObjectId $User.ObjectId -AssignedLicenses $Licenses<\/pre>\n
Basically you find a user who already has the licenses you are interested in assigned to them and set these to a variable (that’s lines 1-3 above). This variable is called $License<\/code> above and is of type Microsoft.Open.AzureAD.Model.AssignedLicense<\/code>. Then you define a new variable (called $Licenses<\/strong><\/code>) of type Microsoft.Open.AzureAD.Model.AssignedLicenses<\/strong><\/code> and assign the licenses captured in the $License<\/code> variable to this via an AddLicenses()<\/code> method (lines 5 &6).<\/p>\n
Finally you assign this to user. Straightforward.<\/p>\n
I wanted to remove licenses so I figured why not do the same but in reverse.<\/p>\n
The $Licenses.SkuID<\/code> property seems to be a string. It looks to be something like this for an example user:<\/p>\n
84a661c4-e949-4bd2-a560-ed7766fcaf2b 2bc9d149-a1dc-4d8f-bcd8-e9c5750a59b5 05e9a617-0261-4cee-bb44-138d3ef5d965<\/pre>\n
That’s three GUIDs corresponding to three licenses this user has. Say I want to remove the first of these licenses, so all I really need to do is the following:<\/p>\n
$LicensedUser = Get-AzureADUser -ObjectId \"TemplateUser@contoso.com\" \r\n$License = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicense \r\n$License.SkuId = $LicensedUser.AssignedLicenses.SkuId\r\n\r\n# view the GUIDs\r\n$License.SkuId\r\n\r\n# remove the ones I am not interested and assign the rest back to the variable\r\n$License.SkuId = \"2bc9d149-a1dc-4d8f-bcd8-e9c5750a59b5 05e9a617-0261-4cee-bb44-138d3ef5d965\"<\/pre>\n
Now let’s create the $Licenses<\/code> variable as before and set the above to be removed:<\/p>\n
$Licenses = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicenses \r\n$Licenses.RemoveLicenses = $License<\/pre>\n
So far so good. Now let me go ahead and set this for a user:<\/p>\n
$User = Get-AzureADUser -ObjectId \"User@contoso.com\" \r\nSet-AzureADUserLicense -ObjectId $User.ObjectId -AssignedLicenses $Licenses<\/pre>\n
But that doesn’t work! I get the following error:<\/p>\n
Set-AzureADUserLicense : Error occurred while executing SetUserLicenses\r\nCode: Request_BadRequest\r\nMessage: Cannot convert a primitive value to the expected type 'Edm.Guid'. See the inner exception for more details.\r\nRequestId: 5ec7936d-aea0-43c3-ad67-348402a45415\r\nDateTimeStamp: Mon, 21 Dec 2020 13:24:49 GMT\r\nHttpStatusCode: BadRequest\r\nHttpStatusDescription: Bad Request\r\nHttpResponseStatus: Completed\r\nAt line:1 char:84\r\n+ ... ObjectId)\"; Set-AzureADUserLicense -ObjectId $_.ObjectId -AssignedLic ...\r\n+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n    + CategoryInfo          : NotSpecified: (:) [Set-AzureADUserLicense], ApiException\r\n    + FullyQualifiedErrorId : Microsoft.Open.AzureAD16.Client.ApiException,Microsoft.Open.AzureAD16.PowerShell.SetUserLicenses<\/pre>\n
First I thought maybe it was something to do with my manually removing a license from the variable. Maybe it looks like a string but not really a string and I messed something up. So I tried removing all licenses without any changes and still got the same error.<\/p>\n
Then I realized the error message says: Cannot convert a primitive value to the expected type ‘Edm.Guid<\/strong>‘.<\/p>\n
Hmm, sounds like wants a GUID instead of the object I was passing. What if I change things a bit to pass the GUIDs? Actually, a single GUID… coz it expects that and not an array of them. Here we go:<\/p>\n
$LicensedUser = Get-AzureADUser -ObjectId \"TemplateUser@contoso.com\" \r\n$License = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicense \r\n$License.SkuId = $LicensedUser.AssignedLicenses.SkuId \r\n\r\n# view the GUIDs \r\n$License.SkuId \r\n\r\n# remove the ones I am not interested and assign the rest back to the variable \r\n# I could assign this to any new variable too, doesn't matter\r\n$License.SkuId = \"2bc9d149-a1dc-4d8f-bcd8-e9c5750a59b5 05e9a617-0261-4cee-bb44-138d3ef5d965\"\r\n\r\n# now go through each license and remove it\r\nforeach ($lic in $($License.SkuId -split ' ')) {\r\n  Set-AzureADUserLicense -ObjectId $User.ObjectId -AssignedLicenses $lic\r\n}<\/pre>\n
And that worked! So it turns out removing licenses works differently to adding licenses. When adding you need to pass an object, while for removing you pass the GUID. Also, I don’t really need to get the license object from an existing user… all I need is the GUIDs of the licenses I want to add or remove.<\/p>\n
So here’s my adding and removing licenses just to show the difference:<\/p>\n
# create an object as before of the single license type\r\n$License = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicense\r\n\r\n# if I want to add a license assign it to the SkuId property. this can take multiple GUIDs.\r\n$License.SkuId = \"84a661c4-e949-4bd2-a560-ed7766fcaf2b 2bc9d149-a1dc-4d8f-bcd8-e9c5750a59b5\"\r\n\r\n# create an object as before of the multiple license type\r\n$Licenses = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicenses\r\n\r\n# add the previously created license SKU as something to be added\r\n$Licenses.AddLicenses = $License\r\n\r\n# and to remove any licenses, I just assign them directly. this only takes a single GUID.\r\n$Licenses.RemoveLicenes = \"05e9a617-0261-4cee-bb44-138d3ef5d965\"\r\n\r\n# just to spice things up here I am then doing the add\/ remove across multiple users\r\nGet-AzureADUser -All $true | %{ Set-AzureADUserLicense -ObjectId $_.ObjectId -AssignedLicenses $Licenses }<\/pre>\n
Update<\/strong>: After writing this post I looked at the properties of the Microsoft.Open.AzureAD.Model.AssignedLicenses<\/code> object and to be fair it does show the two methods as being different. My bad for not examining this to begin with.<\/p>\n
   TypeName: Microsoft.Open.AzureAD.Model.AssignedLicenses\r\n\r\nName           MemberType Definition\r\n----           ---------- ----------\r\nEquals         Method     bool Equals(System.Object obj), bool Equals(Microsoft.Open.AzureAD.Model.AssignedLicenses other), bool IEquatable[AssignedLicenses].Equals(Microsoft.Open.AzureAD.Model.AssignedLicenses other)\r\nGetHashCode    Method     int GetHashCode()\r\nGetType        Method     type GetType()\r\nToJson         Method     string ToJson()\r\nToString       Method     string ToString()\r\nValidate       Method     System.Collections.Generic.IEnumerable[System.ComponentModel.DataAnnotations.ValidationResult] Validate(System.ComponentModel.DataAnnotations.ValidationContext validationContext), System.Collect...\r\nAddLicenses    Property   System.Collections.Generic.List[Microsoft.Open.AzureAD.Model.AssignedLicense] AddLicenses {get;set;}\r\nRemoveLicenses Property   System.Collections.Generic.List[string] RemoveLicenses {get;set;}\r\n<\/pre>\n
And it looks like RemoveLicenses<\/code> too takes an array. So I can pass it multiple GUIDs.<\/p>\n","protected":false},"excerpt":{"rendered":"
The Azure AD Powershell cmdlets are a bit quirky. They don’t behave like regular PowerShell cmdlets don’t (they don’t seem to work with switches like -Verbose or -ErrorAction for instance) and in general seem to be wrappers for some API requests that run behind the scenes. I am thankful they exist of course, coz the … Continue reading Azure AD – Remove licenses via PowerShell<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[887],"tags":[982,986,227],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/5411"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=5411"}],"version-history":[{"count":0,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/5411\/revisions"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=5411"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=5411"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=5411"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}