Decision to Rationalize License Management Not Popular

I think it’s fair to say that Microsoft’s decision to rationalize license management in the Microsoft 365 admin center has not met with universal approval. Among the complaints made are that license management in the Microsoft 365 admin center is slow, unwieldy, and lacks functionality when compared to the Entra admin center.

Some of the reaction is due to change. People don’t like change when they perceive it to be for no good reason. The argument advanced by Microsoft is that it makes more sense to collect all license management into a single console. Given that the majority of license management involves Microsoft 365 solutions, the Microsoft 365 admin center seems like the best place. What’s unsaid is that rationalization delivers reduced engineering, documentation, and support costs for Microsoft, none of which benefits the consumer. There’s no prospect of a reduction in Microsoft 365 license monthly fees due to a fall in Microsoft development costs.

Potential for Benefit

Even though I sympathize with those who dislike the change, the potential for benefit exists if Microsoft exploits the new focus on license management through the Microsoft 365 admin center to drive feature improvements. Hopefully, performance improves too. There’s nothing more annoying than waiting several seconds for a screen to display data when you know that better response is possible. The Entra admin center proves that greater alacrity can be achieved, as anyone who has worked with the Graph APIs for license management knows that the APIs are not slow.

The nature of cloud services is that customers don’t get to vote about the details of service delivery. Microsoft provides license management functionality. How they deliver that functionality and how quickly the UI responds is entirely up to the service provider.

Change in User and License Management Roles

Which brings me to message center notification MC810926 (last updated 15 August 2024) covering the enablement of the user administrator and license administrator roles to be able to process self-service license requests through the Microsoft 365 admin center. Previously, only those holding the global administrator role could process self-service license requests but the deployment of the change to enable the other roles should be complete worldwide by the end of August.

Microsoft says that the change brings consistency with the Azure portals (Azure, Entra, and Intune) where user and license administrators can already approve (or deny) requests. Of course, the fact that license management is rationalizing in the Microsoft 365 admin center has nothing to do with the change.

Of course, before anyone can process requests, administrators must enable products like Visio and Power BI Premium for self-service. As discussed in this article, many tenants use the infamous MsCommerce PowerShell module to manage the set of products permitted for self-purchase (or to disable all products). Microsoft 365 Copilot is the latest product (id CCFQ7TTC0MM8RS) to join the set.

According to message center notification MC853238 (6 August 2024), Microsoft plans to introduce a GUI (Figure 1) to allow tenant administrators to control self-service purchases and trials for individual products. Not having to use the dreaded MsCommerce module is good enough reason to welcome this capability.

Some Signs that Change Will Deliver for Administrators

As noted earlier, some don’t like to embrace change. It’s up to Microsoft to demonstrate that the rationalization of license management into the Microsoft 365 admin center is a good idea. Making sure that the Microsoft 365 admin center offers the same capabilities as the Entra admin center is mandatory. Introducing new functionality like the GUI to manage self-service license purchases and informing administrators when users make self-service purchases are two examples of how rationalizing around a single admin center makes the change better for all.

Keep up with the changing world of the Microsoft 365 ecosystem by subscribing to the Office 365 for IT Pros eBook. Monthly updates mean that our subscribers learn about new developments as they happen.

New Version of the MSCommerce PowerShell Module Released

Microsoft’s drive to liberate the great downtrodden masses of Microsoft 365 users from the baleful oversight of tenant administrators continues and there are now 25 different licenses available for self-purchase. That’s all very well if you buy into the theory that it’s good for people to buy their own licenses for products like Python on Excel or Viva Learning. It’s less welcome in organizations that like to exert control over licenses to keep monthly charges within reasonable boundaries.

It’s a while since I looked at self-purchase licenses. The last time I checked was after Microsoft added Teams Premium licenses to the self-service roster. This time round, my interest was sparked by the release of V2.0 of the MSCommerce PowerShell module and its rapid replacement by a V2.2 release on April 1. That version was subsequently unlisted by Microsoft and is currently unavailable, despite the publication of message center notification MC767477 (3 April) saying that V2.2 contains vital security updates and should be used. According to MC767477, all prior versions of the module will cease to work on April 17, 2024. Let’s hope that Microsoft gets V2.2 back online before then.

Still Not an Interesting Module

In any case, when an update increases the major version number, you always hope that the developers have done something exciting to warrant the appearance of a new version. Regretfully, the MsCommerce PowerShell module is still not very interesting and it seems like the developers increased the major version number out of boredom rather than for any other good reason. The module requires Windows PowerShell (version 5) and doesn’t support PowerShell 7.*. The module cmdlets behave in their own way, but at least the module seems to be stable, which is not something that has always been the case in the past (and might have been the reason why the V2.0 module was replaced so quickly).

In any case, I used the Get-MSCommerceProductPolicies cmdlet to find out how many products are now available for self-purchase. The number is now 25. Proving that I haven’t been keeping an eye on things, 12 products were enabled for self-purchase in my tenant.

Turning Off Self-Purchase for Enabled Licenses

Disabling self-purchase for all eligible licenses is quickly done by finding the set of enabled products and updating their enabled status to False. After connecting to the Commerce endpoint with the Connect-MsCommerce cmdlet, (your account needs to hold either the global or billing administrator role), running this PowerShell command did the trick:

Get-MSCommerceProductPolicies -PolicyId AllowSelfServicePurchase | Where-Object {$_.PolicyValue -match 'Enabled'} | ForEach {Update-MSCommerceProductPolicy -PolicyId AllowSelfServicePurchase -ProductId $_.ProductId -Enabled $False}

To check the status, run this command:

Get-MSCommerceProductPolicies -PolicyId AllowSelfServicePurchase | Sort-Object ProductName | Format-Table ProductName, PolicyValue

ProductName                                            PolicyValue
-----------                                            -----------
Dynamics 365 Marketing                                 Disabled
Dynamics 365 Marketing Additional Application          Disabled
Dynamics 365 Marketing Additional Non-Prod Application Disabled
Dynamics 365 Marketing Attach                          Disabled
Microsoft 365 F3                                       Disabled
Microsoft ClipChamp                                    Disabled
Microsoft Purview Discovery                            Disabled
Power Apps per user                                    Disabled
Power Automate per user                                Disabled
Power Automate Per User with Attended RPA Plan         Disabled
Power Automate RPA                                     Disabled
Power BI Premium per user                              Disabled
Power BI Pro                                           Disabled
Project Plan 1                                         Disabled
Project Plan 3                                         Disabled
Python On Excel                                        Disabled
Teams Exploratory                                      Disabled
Teams Premium                                          Disabled
Visio Plan 1                                           Disabled
Visio Plan 2                                           Disabled
Viva Goals                                             Disabled
Viva Learning                                          Disabled
Windows 365 Business                                   Disabled
Windows 365 Business with Windows Hybrid Benefit       Disabled
Windows 365 Enterprise                                 Disabled

Although it’s easy to disable all the self-service product licenses, it’s a pain to have to check periodically for newly enabled products and disable them. One potential solution seemed to be to create a runbook for Azure Automation to execute on a scheduled basis. Regretfully, it seems that the MsCommerce PowerShell module can’t cope with Azure Automation. At least, I can find no information about getting the module to work in a runbook apart from this GitHub thread lamenting the lack of support. As commented within the thread, it would be nice if MsCommerce supported a Graph API. Perhaps Microsoft doesn’t want to make it too easy for tenants to disable self-service purchases?

Back to a Manual Check

Until the module behaves like a mature PowerShell component, I have a monthly reminder to check the enabled state for self-service purchases in my tenant. Oh well, it could be worse. At least I know that a manual check will always work.

Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365.