Disabling Self-Service Purchases of Microsoft 365 Licenses

I dislike the mechanism which allows users to purchase licenses like Teams Premium without tenant administrator oversight or knowledge. I strongly believe that license management is a core competence of tenant administrators and that allowing users to purchase their own licenses is a guaranteed way to waste money on underused or unwanted licenses. Self-service licenses operate under the radar and can’t be detected by normal license reporting, even by the redoubtable Microsoft 365 tenant licensing report.

Starting with Power BI Pro and Premium licenses in 2019, Microsoft has gradually built out a set of 25 self-service purchases, including Windows 365, Python on Excel, Visio, and Dynamics 365. Users buy licenses using credit cards and can assign licenses to other users in the same tenant.

Naturally, I advise all tenants to disable this capability by using the odd MsCommerce PowerShell module. These commands are enough to do the job and produce the result shown in Figure 1.

Import-Module MsCommerce
Connect-MsCommerce
Get-MSCommerceProductPolicies -PolicyId AllowSelfServicePurchase | ForEach {Update-MSCommerceProductPolicy -PolicyId AllowSelfServicePurchase -ProductId $_.ProductId -Enabled $False }

Self-Service Sign Up Might Work for Some

I grudgingly admit that self-service purchases (or self-service sign-up as Microsoft refers to the capability) can work for some environments. Microsoft 365 serves many different kinds of organizations and some like to offload optional license management onto their users.

Organizations that permit self-service purchases will be delighted by the news in message center notification MC818889 (18 July 2024) that the Microsoft 365 admin center will soon post notifications (Figure 2) when users make self-service purchases. Notifications are due to start appearing in late July 2024 and should be available in all tenants by the end of August 2024 and will be seen by accounts holding the Global administrator and billing administrator roles. Notifications are turned on by default.

Microsoft says that the change is significant because:

• Awareness: Keeping you informed is crucial. With these notifications, you will stay updated on all activities in the tenant(s) you manage.
• Actionable Insights: We aim to empower you to take necessary steps. Whether it is managing subscriptions or ensuring security and compliance for vetted products, these insights will help align with your processes

One might ask why it’s taken Microsoft five years to realize that keeping tenant administrators informed is crucial, but that’s another day’s work. The point is that notifications will now happen, and that’s a welcome development.

Handling Self-Purchase Notifications

When administrators see notifications about self-service purchases, they can:

• Ignore the notification (the pretend it didn’t happen tactic).
• Realize that self-service purchases shouldn’t be happening and run the PowerShell command shown above to disable self-service purchases.
• Take over the licenses purchased by self-service sign ups.
• Cancel the self-service licenses

Taking over licenses (to cancel or absorb the licenses in the general set managed for the tenant) requires some work from administers. I’ve never done this because I have never allowed self-service purchases, but the process is covered in the self-service purchases FAQ.

Self-Service Notifications Can be Easily Overlooked

Receiving notifications when users take the plunge and buy a license for something like Power BI Premium is not enough to make me think that self-service licensing is a good idea. However, I acknowledge that it is a good step forward and will ease the administrative load in organizations where self-service purchases are allowed.

A nagging doubt that I have is that notifications are easily overlooked or dismissed without thinking, especially when people hurry to complete another task. A weekly digest of self-service purchases would round out the notification process. I guess that I shall wait another five years for that idea to arrive.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across the Microsoft 365 ecosystem. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.

Three Windows 365 Options Available for Purchase

Microsoft’s announcement of Windows 365 on July 14 created a great deal of excitement in some organizations seeking a way to deploy and manage PC assets more easily (here’s an independent view on the topic). Five days later, Microsoft notified Office 365 tenants in MC271483 that end users will be able to buy Windows 365 licenses through the self-purchase license mechanism in the Microsoft 365 admin center. By default, Microsoft enables self-service purchases of Windows 365 licenses, so if you don’t want this to happen, you must disable the self-purchase option for Windows 365 using PowerShell.

Windows 365 comes in two versions. Microsoft’s definitions for the two are:

• Windows 365 Enterprise is for organizations that want to manage their Cloud PCs with Microsoft Endpoint Manager and take advantage of integrations with other Microsoft services, including Azure Active Director and Microsoft Defender for Endpoint.
• Windows 365 Business is for smaller organizations that want a simple way to buy, deploy, and manage Cloud PCs.

According to Microsoft, self-service purchases are integrated into the two versions as follows:

• Microsoft 365 Enterprise: IT admins who use Microsoft Endpoint Manager (MEM) will be able to purchase a license during the resize action on a user’s Cloud PC if their organization does not have any licenses available. 
• Microsoft 365 Business: Any user can purchase a license from windows365.com and automatically have a Cloud PC created for them.

Self-Service Purchase Options

Three Windows 365 options are available for self-purchase. Microsoft won’t confirm prices until August 1.

• Windows 365 Enterprise (CFQ7TTC0HHS9).
• Windows 365 Business with Windows Hybrid Benefit (“).
• Windows 365 Business (CFQ7TTC0J203). Apparently, this two CPU, 4GB RAM, and 128GB of storage option costs $31/month.

Self-service purchases are unavailable for government and academic tenants.

Using PowerShell to Block Windows 365 Self-Service License Purchases

Control over Windows 365 self-service license purchases uses the same mechanism as Power Apps, Power Automate, Power BI, Visio, Project Online, and (most recently) Power BI Premium and Power Automate with RPA. Here’s what you need to do:

First, if your workstation doesn’t already have version 1.6 of the MSCommerce PowerShell module, download and install the module. After the installation finishes, run the Connect-MSCommerce cmdlet to connect to the Commerce endpoint, authenticating using a global tenant administrator account.

Connect-MSCommerce

You can disable each Windows 365 option separately. For instance, here’s how to disable Windows 365 Business:

Update-MSCommerceProductPolicy -PolicyId AllowSelfServicePurchase -ProductId CFQ7TTC0J203 -Enabled $False

To disable the three Windows 365 self-service purchase options, use this code:

$Windows365Options = @("CFQ7TTC0HHS9", "CFQ7TTC0HX99", "CFQ7TTC0J203")
ForEach ($Option in $Windows365Options) {
   Update-MSCommerceProductPolicy -PolicyId AllowSelfServicePurchase -ProductId $Option -Enabled $False }

Finally, check the current enablement status for each product available for self-purchase with:

Get-MSCommerceProductPolicies -PolicyId AllowSelfServicePurchase

ProductName                                      ProductId    PolicyId                 PolicyValue
-----------                                      ---------    --------                 -----------
Windows 365 Enterprise                           CFQ7TTC0HHS9 AllowSelfServicePurchase Disabled
Windows 365 Business with Windows Hybrid Benefit CFQ7TTC0HX99 AllowSelfServicePurchase Disabled
Windows 365 Business                             CFQ7TTC0J203 AllowSelfServicePurchase Disabled
Power Automate per user                          CFQ7TTC0KP0N AllowSelfServicePurchase Disabled
Power Apps per user                              CFQ7TTC0KP0P AllowSelfServicePurchase Disabled
Power Automate RPA                               CFQ7TTC0KXG6 AllowSelfServicePurchase Disabled
Power BI Premium (standalone)                    CFQ7TTC0KXG7 AllowSelfServicePurchase Disabled
Visio Plan 2                                     CFQ7TTC0KXN8 AllowSelfServicePurchase Disabled
Visio Plan 1                                     CFQ7TTC0KXN9 AllowSelfServicePurchase Disabled
Project Plan 3                                   CFQ7TTC0KXNC AllowSelfServicePurchase Disabled
Project Plan 1                                   CFQ7TTC0KXND AllowSelfServicePurchase Disabled
Power BI Pro                                     CFQ7TTC0L3PB AllowSelfServicePurchase Disabled

To Block or Not to Block

Self-service licensing has its place in some organizations. Others consider it inappropriate and unhelpful to allow end users to drive what they consider should be organization-led purchasing. If you’re in the latter category, go ahead and run the couple of lines of PowerShell given above to block users. If not, consider how to educate people about how self-service licensing works and when it should be used.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across Office 365. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what’s happening.