Decision to Rationalize License Management Not Popular

I think it’s fair to say that Microsoft’s decision to rationalize license management in the Microsoft 365 admin center has not met with universal approval. Among the complaints made are that license management in the Microsoft 365 admin center is slow, unwieldy, and lacks functionality when compared to the Entra admin center.

Some of the reaction is due to change. People don’t like change when they perceive it to be for no good reason. The argument advanced by Microsoft is that it makes more sense to collect all license management into a single console. Given that the majority of license management involves Microsoft 365 solutions, the Microsoft 365 admin center seems like the best place. What’s unsaid is that rationalization delivers reduced engineering, documentation, and support costs for Microsoft, none of which benefits the consumer. There’s no prospect of a reduction in Microsoft 365 license monthly fees due to a fall in Microsoft development costs.

Potential for Benefit

Even though I sympathize with those who dislike the change, the potential for benefit exists if Microsoft exploits the new focus on license management through the Microsoft 365 admin center to drive feature improvements. Hopefully, performance improves too. There’s nothing more annoying than waiting several seconds for a screen to display data when you know that better response is possible. The Entra admin center proves that greater alacrity can be achieved, as anyone who has worked with the Graph APIs for license management knows that the APIs are not slow.

The nature of cloud services is that customers don’t get to vote about the details of service delivery. Microsoft provides license management functionality. How they deliver that functionality and how quickly the UI responds is entirely up to the service provider.

Change in User and License Management Roles

Which brings me to message center notification MC810926 (last updated 15 August 2024) covering the enablement of the user administrator and license administrator roles to be able to process self-service license requests through the Microsoft 365 admin center. Previously, only those holding the global administrator role could process self-service license requests but the deployment of the change to enable the other roles should be complete worldwide by the end of August.

Microsoft says that the change brings consistency with the Azure portals (Azure, Entra, and Intune) where user and license administrators can already approve (or deny) requests. Of course, the fact that license management is rationalizing in the Microsoft 365 admin center has nothing to do with the change.

Of course, before anyone can process requests, administrators must enable products like Visio and Power BI Premium for self-service. As discussed in this article, many tenants use the infamous MsCommerce PowerShell module to manage the set of products permitted for self-purchase (or to disable all products). Microsoft 365 Copilot is the latest product (id CCFQ7TTC0MM8RS) to join the set.

According to message center notification MC853238 (6 August 2024), Microsoft plans to introduce a GUI (Figure 1) to allow tenant administrators to control self-service purchases and trials for individual products. Not having to use the dreaded MsCommerce module is good enough reason to welcome this capability.

Some Signs that Change Will Deliver for Administrators

As noted earlier, some don’t like to embrace change. It’s up to Microsoft to demonstrate that the rationalization of license management into the Microsoft 365 admin center is a good idea. Making sure that the Microsoft 365 admin center offers the same capabilities as the Entra admin center is mandatory. Introducing new functionality like the GUI to manage self-service license purchases and informing administrators when users make self-service purchases are two examples of how rationalizing around a single admin center makes the change better for all.

Keep up with the changing world of the Microsoft 365 ecosystem by subscribing to the Office 365 for IT Pros eBook. Monthly updates mean that our subscribers learn about new developments as they happen.

License Management is All a Matter of Identifiers (GUIDs)

A reader asked how to use the Graph SDK to remove the Exchange Online Plan 2 license from 2,000 users who have been upgraded to the Microsoft 365 E3 license. This can be a challenging task if you’re not accustomed to dealing with Microsoft 365 licenses using Graph SDK cmdlets and understand how to use the identifiers assigned to products and service plans.

The task seems complete but it’s not complicated, especially since Microsoft supported license stacking for Exchange Online (the ability for an account to have multiple Exchange Online licenses). In this instance, the accounts have Exchange Online Plan 2 licenses purchased prior to the upgrade to Microsoft 365 E3. The E3 licenses also have an Exchange Online Plan 2 service plan, meaning that if you remove the Exchange Online Plan 2 license from accounts, the accounts retain access to their mailboxes through the Exchange Online Plan 2 service plan included in Microsoft 365 E3.

License Management Based on Licenses and Service Plans

I admit that it can be confusing when a product is licensed through a separate license and a service plan that’s part of a license. For instance, the Exchange Online Plan 2 product has an identifier of 19ec0d23-8335-4cbd-94ac-6050e30712fa. The product contains a single service plan, also called Exchange Online Plan 2 with an identifier of efb87545-963c-4e0d-99df-69c6916d9eb0.

You might ask why two objects involved with licensing exist with the same name. The good news is that this doesn’t happen very often. The easiest way to think about it is that a license can be purchased by customers and becomes part of the tenant subscriptions. Service plans cannot be purchased and are always part of a license. The good thing about service plans is that they can be selectively disabled and enabled to remove access to functionality. For instance, Office 365 E5 spans over 50 service plans, including Exchange Online Plan 2.

To complete the task, we need to:

• Find user accounts with the Exchange Online Plan 2 license.
• Check if those accounts have a Microsoft 365 E3 license.
• If they have, remove the Exchange Online Plan 2 license. Users will continue to have access to their mailboxes through the Exchange Online Plan 2 service plan included in Microsoft 365 E3.

Removing Licenses from Accounts

The first step is to find the product identifier for the Exchange Online Plan 2 license. This code uses the Get-MgSubscribedSku cmdlet to find the set of subscriptions (licenses) in a tenant and extracts the Exchange Online Plan 2 identifier before calling Get-MgUser to find the accounts with the license.

$ExchangePlan2SKU = Get-MgSubscribedSku -All | Where-Object SkuPartNumber -eq ‘EXCHANGEENTERPRISE’ | Select-Object -ExpandProperty SkuId
[array]$Users = Get-MgUser -Filter "assignedLicenses/any(s:s/skuId eq $ExchangePlan2SKU)" -All -Property Id, displayName, assignedLicenses

The next step is a matter of looping through the set of accounts to find if they have a Microsoft 365 E3 license. If they do, the script runs the Set-MgUserLicense cmdlet to remove the Exchange Online Plan 2 license.

$Microsoft365E3SkuId = "05e9a617-0261-4cee-bb44-138d3ef5d965"
ForEach ($User in $Users) {
  If ($Microsoft365E3SkuId -in $User.AssignedLicenses.SkuId) {
     Write-Host ("Removing the Exchange Online Plan 2 license from the {0} account" -f $User.displayName)
     Set-MgUserLicense -UserId $User.Id -RemoveLicenses $ExchangePlan2SKU -AddLicenses @()

  } Else {
     Write-Host ("The {0} account doesn't have a Microsoft 365 E3 license" -f $User.displayName)
 }
}

That’s it. The code is simple even if the concepts of licenses and service plans take a little time to get to know

If you use group-based licensing rather than direct assignments, the task is even easier because it then becomes a matter of removing users from the group that controls the Exchange Online Plan 2 license..

License Management is a Core Competence

License management is a core competence for Microsoft 365 tenant administrators. It’s a good idea to become accustomed to working with license assignments through PowerShell. Apart from being able to generate reports from the license information stored in user accounts, knowing how to manipulate licenses will help the tenant manage licenses efficiently.

Learn how to exploit the data available to Microsoft 365 tenant administrators through the Office 365 for IT Pros eBook. We love figuring out how things work.

License Stacking Allows Workloads to Manage Multiple Licenses

The Exchange Online blog post of January 20 “Introducing Support for Concurrent Exchange Online License Assignments” caused some furrowed brows because on first glance it doesn’t seem like an important announcement. The impact of the change depends on the size of a Microsoft 365 tenant and the processes used for license management. If your tenant is small and licenses are relatively static, you can safely ignore this topic. But those who run large tenants and use features like group-based license assignments are likely to be much more interested.

License stacking means that an Azure AD user account can hold multiple licenses for the same workload. Some of the licenses might be inherited from products (SKUs) that bundle multiple service plans (a not-for-sale license included in a SKU). Others come from specific products or add-ons. For instance, an account might hold the Teams Exploratory license and also have a license for Teams through the Office 365 E3 or E5 SKUs. When license stacking is in place, the workload is responsible for resolving the capabilities made available through the different licenses and allowing the account access to the feature set available from the best (“most superior”) license. In the example above, Teams would respect the license from Office 365 E3 or E5 because it covers more functionality than the Teams Exploratory license.

Exchange Online Licenses

In the case of Exchange Online, four licenses are available:

• Exchange Online Essentials (BPOS_S_Essentials).
• Exchange Online Kiosk (BPOS_S_Deskless).
• Exchange Online Plan 1 (BPOS_S_Standard).
• Exchange Online Plan 2 (BPOS_S_Enterprise).

BPOS refers to Business Productivity Online Suite, a predecessor to Office 365 based on Exchange 2007.

Microsoft says that they have updated the Get-ExoMailbox (Get-Mailbox) and Get-Recipient cmdlets to give tenants insight into the Exchange capabilities assigned to accounts through the licenses assigned to the accounts. I found that the data isn’t fully populated for all mailboxes (this will happen over time). However, it’s possible to run a command like this to report assignments:

Get-Recipient -RecipientTypeDetails UserMailbox -ResultSize Unlimited | Format-Table DisplayName, RootCapabilities

DisplayName                             RootCapabilities
-----------                             ----------------
Tony Redmond                            BPOS_S_Enterprise
Ben Owens (DCPG)                        None
Andy Ruth (Director)                    BPOS_S_Standard, BPOS_S_Enterprise
James Ryan                              BPOS_S_Enterprise

The Ben Owens account is an example where the assignment information isn’t yet populated. The Andy Ruth account is an example where two licenses are in place that include an Exchange service plan (one for Exchange Online Plan 1, the other for Plan 2). In this case, because Exchange Online Plan 2 enables more functionality than Plan 1, it’s the one that Exchange Online respects.

Concurrent License Assignments for Exchange Online

Traditionally, Exchange Online has not supported license stacking, which means that an Azure AD account can hold a single Exchange Online license. Most of the time this doesn’t matter because the usual situation is for an account to receive an Exchange Online license through a product SKU. For instance, Office 365 E3 and E5 both include the Exchange Online Plan 2 service plan.

However, it’s possible that an account might start out with a Microsoft 365 Business Basic license that includes Exchange Online Plan 1. The account belongs to a user who’s promoted to a management position that the organization requires to come within the scope of a retention policy and have an online archive. These features require Exchange Online Plan 2, so the organization removes the Microsoft 365 Business Basic license and assigns the account an Office 365 E3 license.

Exchange Online mandates that all user mailboxes have licenses. When the organization removes the Exchange Online Plan 1 license from the account, a chance exists that Exchange Online might soft-delete the mailbox and make it unavailable. The mailbox becomes available again when the account gains the Exchange Online Plan 2 license through Office 365 E3, but it’s not a great situation to be in if a user loses access to their mailbox while license administration is in progress.

Why Exchange Online License Stacking is Helpful

Support for license stacking (multiple concurrent licenses) means that the organization can assign the superior license to the account before removing the other license. This might happen through an automated process. For instance, a group-based licensing assignment might occur and assign the license because of the user’s new job means that they join a group. Later, another process might remove the inferior license from the account to return it to the unused license pool. Automated license assignment by reference to a property of Azure AD accounts is very common, both through Azure AD group-based assignment and purpose-built license management tools. Organizations often go down this route because of the complexity that’s sometimes found in understanding the combinations and permutations available in Azure AD licensing.

Group-Based Licensing for All

In August 2021, as part of their announcement about the retirement of the license assignment cmdlets in the Azure AD and MSOL PowerShell cmdlets. Microsoft promised to remove the additional licensing requirement for group-based licensing. That hasn’t happened yet because Microsoft has had to delay the move to the new licensing platform for Microsoft 365.

The current schedule deprecates the licensing cmdlets on March 31, 2023, and perhaps this will mark the point when Microsoft allows everyone to use group-based licensing. If you haven’t already migrated PowerShell scripts that do license management to the Microsoft Graph PowerShell SDK, it’s time to get going.

Good Housekeeping Change

Microsoft is rolling stacked licenses support for Exchange Online in  the commercial clouds. Government clouds are next and will be done by the end of H1 2023. It’s not an exciting change, but it’s a good example of a housekeeping enhancement that will stop users losing access to their mailboxes due to internal license management.