License Assignments Cease in Entra Admin Center from September 1, 2024

Microsoft hasn’t announced the change formally yet, but a notice posted in the Entra admin center and associated documentation proclaims that from September 1, 2024, administrators won’t be able to assign any form of license to user accounts or groups through the Licenses page of the Entra admin center (Figure 1). In addition, it will no longer be possible to assign or update licenses by editing user account properties in the Entra admin center. Instead, administrators must make license assignments through the Microsoft 365 admin center.

Following the switchover, it will still be possible for administrators to view license assignments in the Entra admin centre. Only license assignments and updates for current assignments are blocked.

According to Microsoft documentation, the change will “streamline the license management process within the Microsoft ecosystem.” A case can certainly be argued that it’s better to centralize license management in one place, even for Entra P1 and P2 premium licenses. Given that Microsoft 365 consumes most licenses, it is logical to focus licensing activity on the Microsoft 365 admin center.

PowerShell Remains Unaffected

The change only affects the GUI in the Entra admin center. Licenses can still be assigned to users and groups via the Microsoft Graph PowerShell SDK or Graph API requests. Any tools written based on the SDK or Graph requests such as the Microsoft 365 Licensing Report remain unaffected.

Microsoft 365 Admin Center Updates

License management has been present in the Microsoft 365 admin center for a while. Group-based license management is a relatively new addition (Figure 2) and supports the same feature set as the Entra admin center.

One nagging doubt that I have about the move is that the Microsoft 365 admin center is invariably slower at dealing with anything to do with licensing than the Entra admin center is. Perhaps folks who work on the Microsoft 365 admin center need some help about efficient license management techniques from their Entra colleagues. Another is that the Microsoft 365 admin center doesn’t support administrative units in the same way as the Entra admin center does (albeit requiring Entra P1 licenses). Hopefully, administrative unit support will appear in the Microsoft 365 admin center soon.

Overall, I don’t think making the Microsoft 365 admin center the fulcrum for license assignments will discomfort anyone except people who write about license assignments. Proving the value of ePublishing, we’ll document this change in the September 2024 update of the Office 365 for IT Pros eBook (2025 edition).

Self-Service Purchases Get a GUI

A change that might have more impact is the one announced in message center notification MC853238 (6 August 2024). For years, tenant administrators have complained about the way Microsoft opened up self-service purchases to users and the need to use the awful MSCommerce PowerShell module to disable the ability for users to buy licenses.

MC853238 says that in mid-September 2024, the Microsoft 365 admin center will have a new Self-service trials and purchases option under Org Settings (Figure 3) to enable or disable self-service license purchases previously only manageable through PowerShell.

Administrators can choose to:

• Allow self-service trials and purchases: Users are allowed to apply for trial licenses and buy self-service licenses.
• Allow trials only. Even after a successful trial, the user cannot purchase a license.
• Do not allow purchases: Users cannot purchase self-service licenses.

It’s surprising that Microsoft has taken so long to introduce the GUI to manage self-service purchases, but at least it’s happening now.

Friday Happiness

These changes are good examples of the kind of updates that flow through Microsoft 365 on an ongoing basis. Neither are earthshattering. They won’t cause processes to stop working unless you really depend on the Entra admin center for license assignments. Even if you do, the switch to the Microsoft 365 admin center is easy. Everyone should ignore some of the breathless hype around these changes and have a nice weekend, which is what I plan to do.

New Version of the MSCommerce PowerShell Module Released

Microsoft’s drive to liberate the great downtrodden masses of Microsoft 365 users from the baleful oversight of tenant administrators continues and there are now 25 different licenses available for self-purchase. That’s all very well if you buy into the theory that it’s good for people to buy their own licenses for products like Python on Excel or Viva Learning. It’s less welcome in organizations that like to exert control over licenses to keep monthly charges within reasonable boundaries.

It’s a while since I looked at self-purchase licenses. The last time I checked was after Microsoft added Teams Premium licenses to the self-service roster. This time round, my interest was sparked by the release of V2.0 of the MSCommerce PowerShell module and its rapid replacement by a V2.2 release on April 1. That version was subsequently unlisted by Microsoft and is currently unavailable, despite the publication of message center notification MC767477 (3 April) saying that V2.2 contains vital security updates and should be used. According to MC767477, all prior versions of the module will cease to work on April 17, 2024. Let’s hope that Microsoft gets V2.2 back online before then.

Still Not an Interesting Module

In any case, when an update increases the major version number, you always hope that the developers have done something exciting to warrant the appearance of a new version. Regretfully, the MsCommerce PowerShell module is still not very interesting and it seems like the developers increased the major version number out of boredom rather than for any other good reason. The module requires Windows PowerShell (version 5) and doesn’t support PowerShell 7.*. The module cmdlets behave in their own way, but at least the module seems to be stable, which is not something that has always been the case in the past (and might have been the reason why the V2.0 module was replaced so quickly).

In any case, I used the Get-MSCommerceProductPolicies cmdlet to find out how many products are now available for self-purchase. The number is now 25. Proving that I haven’t been keeping an eye on things, 12 products were enabled for self-purchase in my tenant.

Turning Off Self-Purchase for Enabled Licenses

Disabling self-purchase for all eligible licenses is quickly done by finding the set of enabled products and updating their enabled status to False. After connecting to the Commerce endpoint with the Connect-MsCommerce cmdlet, (your account needs to hold either the global or billing administrator role), running this PowerShell command did the trick:

Get-MSCommerceProductPolicies -PolicyId AllowSelfServicePurchase | Where-Object {$_.PolicyValue -match 'Enabled'} | ForEach {Update-MSCommerceProductPolicy -PolicyId AllowSelfServicePurchase -ProductId $_.ProductId -Enabled $False}

To check the status, run this command:

Get-MSCommerceProductPolicies -PolicyId AllowSelfServicePurchase | Sort-Object ProductName | Format-Table ProductName, PolicyValue

ProductName                                            PolicyValue
-----------                                            -----------
Dynamics 365 Marketing                                 Disabled
Dynamics 365 Marketing Additional Application          Disabled
Dynamics 365 Marketing Additional Non-Prod Application Disabled
Dynamics 365 Marketing Attach                          Disabled
Microsoft 365 F3                                       Disabled
Microsoft ClipChamp                                    Disabled
Microsoft Purview Discovery                            Disabled
Power Apps per user                                    Disabled
Power Automate per user                                Disabled
Power Automate Per User with Attended RPA Plan         Disabled
Power Automate RPA                                     Disabled
Power BI Premium per user                              Disabled
Power BI Pro                                           Disabled
Project Plan 1                                         Disabled
Project Plan 3                                         Disabled
Python On Excel                                        Disabled
Teams Exploratory                                      Disabled
Teams Premium                                          Disabled
Visio Plan 1                                           Disabled
Visio Plan 2                                           Disabled
Viva Goals                                             Disabled
Viva Learning                                          Disabled
Windows 365 Business                                   Disabled
Windows 365 Business with Windows Hybrid Benefit       Disabled
Windows 365 Enterprise                                 Disabled

Although it’s easy to disable all the self-service product licenses, it’s a pain to have to check periodically for newly enabled products and disable them. One potential solution seemed to be to create a runbook for Azure Automation to execute on a scheduled basis. Regretfully, it seems that the MsCommerce PowerShell module can’t cope with Azure Automation. At least, I can find no information about getting the module to work in a runbook apart from this GitHub thread lamenting the lack of support. As commented within the thread, it would be nice if MsCommerce supported a Graph API. Perhaps Microsoft doesn’t want to make it too easy for tenants to disable self-service purchases?

Back to a Manual Check

Until the module behaves like a mature PowerShell component, I have a monthly reminder to check the enabled state for self-service purchases in my tenant. Oh well, it could be worse. At least I know that a manual check will always work.

Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365.

Three Windows 365 Options Available for Purchase

Microsoft’s announcement of Windows 365 on July 14 created a great deal of excitement in some organizations seeking a way to deploy and manage PC assets more easily (here’s an independent view on the topic). Five days later, Microsoft notified Office 365 tenants in MC271483 that end users will be able to buy Windows 365 licenses through the self-purchase license mechanism in the Microsoft 365 admin center. By default, Microsoft enables self-service purchases of Windows 365 licenses, so if you don’t want this to happen, you must disable the self-purchase option for Windows 365 using PowerShell.

Windows 365 comes in two versions. Microsoft’s definitions for the two are:

• Windows 365 Enterprise is for organizations that want to manage their Cloud PCs with Microsoft Endpoint Manager and take advantage of integrations with other Microsoft services, including Azure Active Director and Microsoft Defender for Endpoint.
• Windows 365 Business is for smaller organizations that want a simple way to buy, deploy, and manage Cloud PCs.

According to Microsoft, self-service purchases are integrated into the two versions as follows:

• Microsoft 365 Enterprise: IT admins who use Microsoft Endpoint Manager (MEM) will be able to purchase a license during the resize action on a user’s Cloud PC if their organization does not have any licenses available. 
• Microsoft 365 Business: Any user can purchase a license from windows365.com and automatically have a Cloud PC created for them.

Self-Service Purchase Options

Three Windows 365 options are available for self-purchase. Microsoft won’t confirm prices until August 1.

• Windows 365 Enterprise (CFQ7TTC0HHS9).
• Windows 365 Business with Windows Hybrid Benefit (“).
• Windows 365 Business (CFQ7TTC0J203). Apparently, this two CPU, 4GB RAM, and 128GB of storage option costs $31/month.

Self-service purchases are unavailable for government and academic tenants.

Using PowerShell to Block Windows 365 Self-Service License Purchases

Control over Windows 365 self-service license purchases uses the same mechanism as Power Apps, Power Automate, Power BI, Visio, Project Online, and (most recently) Power BI Premium and Power Automate with RPA. Here’s what you need to do:

First, if your workstation doesn’t already have version 1.6 of the MSCommerce PowerShell module, download and install the module. After the installation finishes, run the Connect-MSCommerce cmdlet to connect to the Commerce endpoint, authenticating using a global tenant administrator account.

Connect-MSCommerce

You can disable each Windows 365 option separately. For instance, here’s how to disable Windows 365 Business:

Update-MSCommerceProductPolicy -PolicyId AllowSelfServicePurchase -ProductId CFQ7TTC0J203 -Enabled $False

To disable the three Windows 365 self-service purchase options, use this code:

$Windows365Options = @("CFQ7TTC0HHS9", "CFQ7TTC0HX99", "CFQ7TTC0J203")
ForEach ($Option in $Windows365Options) {
   Update-MSCommerceProductPolicy -PolicyId AllowSelfServicePurchase -ProductId $Option -Enabled $False }

Finally, check the current enablement status for each product available for self-purchase with:

Get-MSCommerceProductPolicies -PolicyId AllowSelfServicePurchase

ProductName                                      ProductId    PolicyId                 PolicyValue
-----------                                      ---------    --------                 -----------
Windows 365 Enterprise                           CFQ7TTC0HHS9 AllowSelfServicePurchase Disabled
Windows 365 Business with Windows Hybrid Benefit CFQ7TTC0HX99 AllowSelfServicePurchase Disabled
Windows 365 Business                             CFQ7TTC0J203 AllowSelfServicePurchase Disabled
Power Automate per user                          CFQ7TTC0KP0N AllowSelfServicePurchase Disabled
Power Apps per user                              CFQ7TTC0KP0P AllowSelfServicePurchase Disabled
Power Automate RPA                               CFQ7TTC0KXG6 AllowSelfServicePurchase Disabled
Power BI Premium (standalone)                    CFQ7TTC0KXG7 AllowSelfServicePurchase Disabled
Visio Plan 2                                     CFQ7TTC0KXN8 AllowSelfServicePurchase Disabled
Visio Plan 1                                     CFQ7TTC0KXN9 AllowSelfServicePurchase Disabled
Project Plan 3                                   CFQ7TTC0KXNC AllowSelfServicePurchase Disabled
Project Plan 1                                   CFQ7TTC0KXND AllowSelfServicePurchase Disabled
Power BI Pro                                     CFQ7TTC0L3PB AllowSelfServicePurchase Disabled

To Block or Not to Block

Self-service licensing has its place in some organizations. Others consider it inappropriate and unhelpful to allow end users to drive what they consider should be organization-led purchasing. If you’re in the latter category, go ahead and run the couple of lines of PowerShell given above to block users. If not, consider how to educate people about how self-service licensing works and when it should be used.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across Office 365. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what’s happening.

MSCommerce PowerShell Module Now Available

Updated May 21, 2020 – see below

Microsoft got itself in quite a mess when it announced that users in Office 365 tenants would be able to make self-service purchases for the Power Platform. Some frantic backtracking resulted in a decision to postpone the introduction of the feature until January 14, 2020 and a commitment to deliver administrative controls to allow tenants to disable self-service purchases. Self-service purchase capabilities are not available for Office 365 Government, Nonprofit, and Education tenants.

Without any fuss, Microsoft quietly updated their self-service FAQ on November 19 with the statement that:

“Admins can also control whether users in their organization can make self-service purchases. For more information see Use AllowSelfServicePurchase for the MSCommerce PowerShell module.”

Subsequently, Microsoft published Office 365 notification MC196205 to announce the news.

Administrative control over self-service purchases is available through the MSCommerce PowerShell module. Version 1.2 of the module is the latest version, released via the PowerShell Gallery on November 15. This isn’t a particularly feature-rich or easy-to-use module, but it gets the job done.

Installing and Connecting

To install the module and connect to the MSCommerce endpoint, start PowerShell as an administrator to install the module. Then connect to the endpoint as shown below. You’ll be prompted for credentials: because you’re going to interact with the tenant configuration, make sure to use an account belonging to an Office 365 tenant or billing administrator. After connecting, run Get-Command to see the set of cmdlets loaded by the module.

Install-Module -Name MSCommerce -Scope AllUsers -Force
Import-Module MSCommerce
Connect-MSCommerce

Get-Command *-mscommerce*                                                            
CommandType     Name                                               Version    Source
-----------     ----                                               -------    ------
Function        Connect-MSCommerce                                 1.2        mscommerce
Function        Get-MSCommercePolicies                             1.2        mscommerce
Function        Get-MSCommercePolicy                               1.2        mscommerce

The MsCommerce endpoint only supports TLS 1.2, so make sure that your workstation supports this protocol.

Policy-Driven Management

As is the norm for many Office 365 management entities these days, control is exerted through policies. If you run the Get-MSCommercePolicies cmdlet, you’ll find that there’s only one policy defined, called AllowSelfServicePurchase.

Get-MSCommercePolicies | fl                                                          

Description  : This policy allows you to manage whether members of your organization can buy
               specified products using self-service purchasing. You can set this policy on a
               per-product basis.
PolicyId     : AllowSelfServicePurchase
DefaultValue : Enabled

Get-MSCommercePolicy -PolicyId AllowSelfServicePurchase | fl

Looking at the AllowSelfServicePurchase policy, we find:

Get-MSCommerceProductPolicies -PolicyId AllowSelfServicePurchase 
                    
ProductName    ProductId    PolicyId                 PolicyValue
-----------    ---------    --------                 -----------
Power Apps     CFQ7TTC0KP0P AllowSelfServicePurchase Enabled
Power BI Pro   CFQ7TTC0L3PB AllowSelfServicePurchase Enabled
Power Automate CFQ7TTC0KP0N AllowSelfServicePurchase Enabled

Disabling Self-Service Purchases for One or More Products

So we know that the three apps in the Power Platform are covered by this policy. There’s no granular disablement possible on an account basis; if you disable self-service purchases for a product, it’s off for everyone in the tenant. With that in mind, the Update-MSCommerceProductPolicy cmdlet is the way to disable self-service purchases. An inconsistency is that the other cmdlets report the enabled status as the PolicyValue property while this cmdlet uses the Enabled boolean as the control.

Update-MSCommerceProductPolicy -PolicyId AllowSelfServicePurchase -ProductId CFQ7TTC0KP0P -Enabled $False
Update policy product success

ProductName ProductId    PolicyId                 PolicyValue
----------- ---------    --------                 -----------
Power Apps  CFQ7TTC0KP0P AllowSelfServicePurchase Disabled

To disable self-service for all three products, run the command for each product or run:

Get-MSCommerceProductPolicies -PolicyId AllowSelfServicePurchase | ? {$_.PolicyValue -eq "Enabled" }| ForEach {Update-MSCommerceProductPolicy -PolicyId AllowSelfServicePurchase -ProductId $_.ProductId -Enabled $False }

Self Service Purchase User Request Workflow

Everyone loves a trier and the Microsoft team responsible for self-service purchases of Power Platform licenses are firmly in this category. Rebuffed in their first attempt to make self-service purchases available to all Office 365 tenants, Office 365 notification MC213897 (21 May) announces that in situations where tenants block self-service purchases, users will be able to request purchases of Power Platform licenses and have those requests added to a queue. Administrators can then review the request and assign licenses to users, if some are available in the tenant. If licenses aren’t available, Microsoft hopes that administrators will respond to user demand and buy some licenses. The feature will start rolling out in mid-June and is scheduled for completion in mid-July 2020.

Administration of an Office 365 tenant can be a pain at times. Learn how to work smarter through the Office 365 for IT Pros eBook.