Disabling Self-Service Purchases of Microsoft 365 Licenses

I dislike the mechanism which allows users to purchase licenses like Teams Premium without tenant administrator oversight or knowledge. I strongly believe that license management is a core competence of tenant administrators and that allowing users to purchase their own licenses is a guaranteed way to waste money on underused or unwanted licenses. Self-service licenses operate under the radar and can’t be detected by normal license reporting, even by the redoubtable Microsoft 365 tenant licensing report.

Starting with Power BI Pro and Premium licenses in 2019, Microsoft has gradually built out a set of 25 self-service purchases, including Windows 365, Python on Excel, Visio, and Dynamics 365. Users buy licenses using credit cards and can assign licenses to other users in the same tenant.

Naturally, I advise all tenants to disable this capability by using the odd MsCommerce PowerShell module. These commands are enough to do the job and produce the result shown in Figure 1.

Import-Module MsCommerce
Connect-MsCommerce
Get-MSCommerceProductPolicies -PolicyId AllowSelfServicePurchase | ForEach {Update-MSCommerceProductPolicy -PolicyId AllowSelfServicePurchase -ProductId $_.ProductId -Enabled $False }

Self-Service Sign Up Might Work for Some

I grudgingly admit that self-service purchases (or self-service sign-up as Microsoft refers to the capability) can work for some environments. Microsoft 365 serves many different kinds of organizations and some like to offload optional license management onto their users.

Organizations that permit self-service purchases will be delighted by the news in message center notification MC818889 (18 July 2024) that the Microsoft 365 admin center will soon post notifications (Figure 2) when users make self-service purchases. Notifications are due to start appearing in late July 2024 and should be available in all tenants by the end of August 2024 and will be seen by accounts holding the Global administrator and billing administrator roles. Notifications are turned on by default.

Microsoft says that the change is significant because:

• Awareness: Keeping you informed is crucial. With these notifications, you will stay updated on all activities in the tenant(s) you manage.
• Actionable Insights: We aim to empower you to take necessary steps. Whether it is managing subscriptions or ensuring security and compliance for vetted products, these insights will help align with your processes

One might ask why it’s taken Microsoft five years to realize that keeping tenant administrators informed is crucial, but that’s another day’s work. The point is that notifications will now happen, and that’s a welcome development.

Handling Self-Purchase Notifications

When administrators see notifications about self-service purchases, they can:

• Ignore the notification (the pretend it didn’t happen tactic).
• Realize that self-service purchases shouldn’t be happening and run the PowerShell command shown above to disable self-service purchases.
• Take over the licenses purchased by self-service sign ups.
• Cancel the self-service licenses

Taking over licenses (to cancel or absorb the licenses in the general set managed for the tenant) requires some work from administers. I’ve never done this because I have never allowed self-service purchases, but the process is covered in the self-service purchases FAQ.

Self-Service Notifications Can be Easily Overlooked

Receiving notifications when users take the plunge and buy a license for something like Power BI Premium is not enough to make me think that self-service licensing is a good idea. However, I acknowledge that it is a good step forward and will ease the administrative load in organizations where self-service purchases are allowed.

A nagging doubt that I have is that notifications are easily overlooked or dismissed without thinking, especially when people hurry to complete another task. A weekly digest of self-service purchases would round out the notification process. I guess that I shall wait another five years for that idea to arrive.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across the Microsoft 365 ecosystem. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.