I’ve got a file on my machine with various PowerShell snippets. While that’s useful as a quick reference I want to also put these somewhere I can easily refer to when I don’t have that file handy. Plus who knows maybe it’s useful for others too. This blog post is for that. I’ll keep updating it as I learn.<\/p>\n
Note<\/strong>: There’s two set of cmdlets. The I was moving over from assigning users licenses directly to assigning them via a group. Thought I had moved over everyone but there was a discrepency in the free count so I used the following to find everyone directly assigned a license:<\/p>\n I discovered this from StackOverflow<\/a>. The original post removed the licenses instead of outputting the info. So it had the following instead of the This is probably a good time to highlight yesterday’s post<\/a> where I used the newer Whereas The older cmdlet is:<\/p>\n Its output is like this:<\/p>\n The newer cmdlet is:<\/p>\n And its output is like this:<\/p>\n In the old cmdlet the SkuId is the “ In the new cmdlet the Id is “ I came across this snippet from the official docs<\/a>, thought I’d add it here as a reference for myself:<\/p>\n I didn’t understand the part about disabling plans. A license\/ SKU like E3 has service plans within it (you can see it in the Web UI too) and what the snippet above does is enable a specific service plan and not the entire license (I think).<\/p>\n To assign\/ remove licenses I can do what I blogged about yesterday<\/a>:<\/p>\n <\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":" I’ve got a file on my machine with various PowerShell snippets. While that’s useful as a quick reference I want to also put these somewhere I can easily refer to when I don’t have that file handy. Plus who knows maybe it’s useful for others too. This blog post is for that. I’ll keep updating … Continue reading AzureAD license PowerShell snippets<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[887],"tags":[982,986,227],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/5418"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=5418"}],"version-history":[{"count":0,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/5418\/revisions"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=5418"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=5418"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=5418"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}AzureAD<\/code> ones are the newer<\/a> and Graph API based ones. The MSOnline<\/code> ones (shortened to Msol<\/code> usually) are the older<\/a>. I use both below. Each requires us to connect to Azure AD – the former via Connect-AzureAD<\/code> and the latter via Connect-MsolService<\/code>.<\/p>\nGet all users without a license<\/h3>\n
Get-AzureADUser -All:$true | %{\u00a0\r\n if ($(Get-AzureADUserLicenseDetail -ObjectId $_.UserPrincipalName) -eq $null) { $_.DisplayName } \r\n}<\/pre>\n<\/div>\nA variant that filters out AD disabled accounts<\/h4>\n
Get-AzureADUser -All:$true | ?{ \r\n $(Get-AzureADUserLicenseDetail -ObjectId $_.UserPrincipalName) -eq $null } | ?{ \r\n $(Get-ADUser -Filter 'UserPrincipalName -eq $_.UserPrincipalName').Enabled -eq $true } | select DisplayName<\/pre>\nFind all users with directly assigned licenses<\/h3>\n
Get-MsolUser -All | %{ \r\n $user = $_\r\n\r\n foreach ($license in $user.Licenses) {\r\n if ($license.GroupsAssigningLicense[0].ToString() -eq $user.ObjectId) {\r\n Write-Host \"$($User.UserPrincipalName) has $($license.AccountSkuId) assigned directly\"\r\n }\r\n }\r\n}\r\n<\/pre>\nWrite-Host<\/code> statement:<\/p>\nSet-MsolUserLicense -UserPrincipalName $user.UserPrincipalName -RemoveLicenses $license.AccountSkuId<\/pre>\n
Add\/ Remove licenses<\/h3>\n
Set-AzureADUserLicense<\/code> cmdlet to add remove licenses. The Set-MsolUserLicense<\/code> cmdlet used above is the older method.<\/p>\nSet-MsolUserLicense<\/code> can take the -AddLicenses<\/code> switch to add licenses.<\/p>\nSet-AzureADUserLicense<\/code> took a GUID as the license SKU, Set-MsolUserLicense<\/code> takes a more friendly name. Example: contoso:ENTERPRISEPACK<\/code>.<\/p>\nViewing license SKUs<\/h3>\n
Get-MsolAccountSku<\/pre>\n
AccountSkuId ActiveUnits WarningUnits ConsumedUnits\r\n------------ ----------- ------------ -------------\r\ntenantname:AAD_PREMIUM_P2 1940 0 1940\r\ntenantname:SPE_E3 1940 0 1940\r\n<\/pre>\n
Get-AzureADSubscribedSku<\/pre>\n
ObjectId SkuPartNumber PrepaidUnits ConsumedUnits\r\n-------- ------------- ------------ -------------\r\ncd8e1d4f-5295-4de8-b18a-1d85b4195a17_2bc9d149-a1dc-4d8f-bcd8-e9c5750a59b5 M365_INFO_PROTECTION_GOVERNANCE class LicenseUnitsDetail {... 1940\r\ncd8e1d4f-5295-4de8-b18a-1d85b4195a17_b05e124f-c7cc-45a0-a6aa-8cf78c946968 EMSPREMIUM class LicenseUnitsDetail {... 0\r\ncd8e1d4f-5295-4de8-b18a-1d85b4195a17_6470687e-a428-4b7a-bef2-8a291ad947c9 WINDOWS_STORE class LicenseUnitsDetail {... 0\r\n<\/pre>\ntenantname:license<\/code>“. Thie tenantname is not your custom domain name, but the one before onmicrosoft.com<\/code>. (You can view all your domain names via Get-MsolDomain<\/code>).<\/p>\ntenantguid-licenseguid<\/code>“. In the new cmdlet the SkuPartNumber has the license name. You can get the tenant GUID from Get-AzureADTenantDetail<\/code>.<\/p>\nAssigning licenses to a user<\/h3>\n
#The user that will get a license\r\n$UserToLicense = Get-AzureADUser -ObjectId \"<upn of the user for which you want to assign a license>\"\r\n \r\n#Define the plans that will be enabled (Exchange Online, Skype for Business and Office 365 ProPlus)\r\n$EnabledPlans = 'O365_BUSINESS_PREMIUM'\r\n\r\n#Get the LicenseSKU and create the Disabled ServicePlans object\r\n$LicenseSku = Get-AzureADSubscribedSku | Where-Object {$_.SkuPartNumber -eq 'O365_BUSINESS_PREMIUM'} \r\n\r\n#Loop through all the individual plans and disable all plans except the one in $EnabledPlans\r\n$DisabledPlans = $LicenseSku.ServicePlans | ForEach-Object -Process { \r\n $_ | Where-Object -FilterScript {$_.ServicePlanName -notin $EnabledPlans }\r\n}\r\n \r\n#Create the AssignedLicense object with the License and DisabledPlans earlier created\r\n$License = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicense\r\n$License.SkuId = $LicenseSku.SkuId\r\n$License.DisabledPlans = $DisabledPlans.ServicePlanId\r\n \r\n#Create the AssignedLicenses Object \r\n$AssignedLicenses = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicenses\r\n$AssignedLicenses.AddLicenses = $License\r\n$AssignedLicenses.RemoveLicenses = @()\r\n\r\n#Assign the license to the user\r\nSet-AzureADUserLicense -ObjectId $UserToLicense.ObjectId -AssignedLicenses $AssignedLicenses\r\n<\/pre>\nGet-AzureADSubscribedSku | ?{ $_.SkuPartNumber -eq \"SPE_E3\" } | select -ExpandProperty ServicePlans\r\n\r\nAppliesTo ProvisioningStatus ServicePlanId ServicePlanName\r\n--------- ------------------ ------------- ---------------\r\nUser Success 041fe683-03e4-45b6-b1af-c0cdc516daee POWER_VIRTUAL_AGENTS_O365_P2\r\nUser Success 95b76021-6a53-4741-ab8b-1d1f3d66a95a CDS_O365_P2\r\nUser Success 31b4e2fc-4cd6-4e7d-9c1b-41407303bd66 PROJECT_O365_P2\r\nUser Success 4ff01e01-1ba7-4d71-8cf8-ce96c3bbcf14 DYN365_CDS_O365_P2\r\nUser Success 199a5c09-e0ca-4e37-8f7c-b05d533e1ea2 MICROSOFTBOOKINGS\r\nUser Success aebd3021-9f8f-4bf8-bbe3-0ed2f4f047a1 KAIZALA_O365_P3\r\nCompany Success 94065c59-bc8e-4e8b-89e5-5138d471eaff MICROSOFT_SEARCH\r\n...\r\n<\/pre>\n# create an object as before of the single license type \r\n$License = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicense \r\n\r\n# if I want to add a license assign it to the SkuId property. this can take multiple GUIDs. \r\n$License.SkuId = \"84a661c4-e949-4bd2-a560-ed7766fcaf2b 2bc9d149-a1dc-4d8f-bcd8-e9c5750a59b5\" \r\n\r\n# create an object as before of the multiple license type \r\n$Licenses = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicenses \r\n\r\n# add the previously created license SKU as something to be added \r\n$Licenses.AddLicenses = $License \r\n\r\n# and to remove any licenses, I just assign them directly.\r\n$Licenses.RemoveLicenes = \"05e9a617-0261-4cee-bb44-138d3ef5d965 ace9a617-0261-4cee-bb44-138d3ef5d964\" \r\n\r\nGet-AzureADUser <upn of user> | Set-AzureADUserLicense -ObjectId $_.ObjectId -AssignedLicenses $Licenses<\/pre>\n