Office 365 on gal.vin

Automated Office 365 Licensing v1.1

Sun, 04 Nov 2018 10:05:10 +0000

Update 2019-06-16

I recently learned that Office 365 licensing can be managed via Azure Active Directory’s group based licensing feature and I have since switched to using this and have retired this script. I’ll leave this post and the script itself available here, on the Microsoft TechNet Gallery and GitHub, but I’ll not be developing the script any further. For more information on Azure Active Directory group-based licensing please check out Microsoft’s documentation here and here to start with.

PowerShell script to assign Office 365 license to users in an Active Directory OU structure.

Please consider donating to support my work:

You can support me with a one-time payment using PayPal.

If you have any questions or comments, please leave them below.

-Mike

Features and Requirements

This utility will assign a configurable Office 365 license to Active Directory user accounts within an OU or descending OUs. All options are added via command line switches. Options include:

The Office 365 Global Admin user and password to use.
The Office 365 license and usage location to assign.
Organisation Unit which contains to users to license.
The directory to output a log file to.
An optional email address to send the log file to.
This utility requires the MSOnline and Active Directory PowerShell modules to be installed.
The utility requires at least PowerShell 5.0.
This utility has been tested running on Windows Server 2016.

Generating A Password File For SMTP Authentication

The password used for SMTP server authentication must be in an encrypted text file. To generate the password file, run the following command in PowerShell, on the computer that is going to run the script and logged in with the user that will be running the script. When you run the command you will be prompted for a username and password. Enter the username and password you want to use to authenticate to your SMTP server.

Please note: This is only required if you need to authenticate to the SMTP server when send the log via e-mail.

1
2

$creds = Get-Credential
$creds.Password | ConvertFrom-SecureString | Set-Content c:\scripts\ps-script-pwd.txt

After running the commands, you will have a text file containing the encrypted password. When configuring the -Pwd switch enter the path and file name of this file.

Configuration

Here’s a list of all the command line switches and example configurations.

`1`	`-User365`

The Office 365 Admin user to use for the operation.

-Pwd365

The password for the Office 365 Admin user to use for the operation.

-Lic

The Office 365 license to apply to your users.

-UseLoc

The Office 365 usage location to use.

-OU

The top level OU that contains the users to license in Office 365.

-L

The path to output the log file to. The file name will be Office-365-Licensing.log

`1`	`-Subject`

The email subject that the email should have. Encapsulate with single or double quotes.

-SendTo

The e-mail address the log should be sent to.

-From

The e-mail address the log should be sent from.

-Smtp

The DNS name or IP address of the SMTP server.

-User

The user account to connect to the SMTP server.

-Pwd

The txt file containing the encrypted password for the user account.

-UseSsl

Configures the script to connect to the SMTP server using SSL.

Example

1
2

Office-365-Licensing.ps1 -User365 GAdmin@contosocom.onmicrosoft.com -Pwd365 P@ssw0rd -Lic contosocom:ENTERPRISEPACK -UseLoc GB -OU OU=MyUsers,DC=contoso,DC=com
-L C:\scripts\logs -Subject 'Server: O365 Licensing' -SendTo me@contoso.com -From Office-365-licensing@contoso.com -Smtp smtp.outlook.com -User user -Pwd c:\scripts\ps-script-pwd.txt -UseSsl

This will login to Office 365 with the specified user and assign licenses to the users in the MyUsers OU, and OUs below that. On completion it will e-mail the log file to the specified address with a custom subject line.

Change Log

2019-09-04 1.1

Added custom subject line for e-mail.

2018-04-11 1.0

Initial release.

Control and Automate the Licensing of Office 365 Users

Sat, 03 Feb 2018 12:56:00 +0000

Update 2018-11-04: I’ve evolved the script in this post into a more friendly utility which I’ve posted about here.

If you are familiar with my other PowerShell scripts/utilities this isn’t as complete or polished as them, but it get’s the job done, and that’s all we can really ask for right? Let’s say it’s in early beta.

The purpose of this script is to automate the process of setting the location and Office 365 license for users, using a local Active Directory to specify the users. You can of course just get all unlicensed users in Office 365 and licensed them, but this script is designed to allow you to control exactly which users are being licensed using your on premises Active Directory. This is not exactly a new topic, but hopefully this post will be of use to someone. For more information on assigning Office 365 licenses via PowerShell, please check out this post on docs.microsoft.com: Assign licenses to user accounts with Office 365 PowerShell

If you have any questions or comments, please leave them below.

-Mike

Installing the MSOnline PowerShell Module

We’ll be using the Connect-MsolService, Set-MsolUser and Set-MsolUserLicense cmdlets, so you’ll need to install the MSOnline PowerShell module. You can do this by running the following command in an elevated PowerShell command window:

`1`	`Install-Module MSOnline`

You’ll be asked if you want to install the module, you should choose “yes”. :) Once this is done, you should be able to run Connect-Msol in PowerShell and be prompted for credentials. Lets get into the PowerShell script. The first thing to do is connect to Office 365, you can do this by entering the password in the script, or you can create an encrypted file with the password for some actual security…but for the purposes of this post, we’ll be entering the password in plain text.

## Log in to the O365 service
$O365User = "adminuser@contoso.onmicrosoft.com"
$O365Pwd = ConvertTo-SecureString "P@ssw0rd" -AsPlainText -Force
$O365Cred = New-Object System.Management.Automation.PSCredential $O365User, $O365Pwd
 
## Connect to Azure AD
Connect-MsolService -Credential $O365Cred

Now we’ll query the on-premises Active Directory to get the users we want to license for Office 365. In this example, I’m querying an Organisation Unit, but you could query a group, by an attribute or indeed any way that you can query AD.

1
2

## Get Users from local AD to compare to Azure AD
$ADUsers = Get-ADUser -Filter * -SearchBase 'OU=people,DC=contoso,DC=com'

In this example, I’m querying a group for the users.

1
2

## Get users from a local AD group
$ADUsers = Get-ADGroupMember -identity "O365_Users" -Recursive | Get-ADUser

Next we’ll count the number of unlicensed users, using our list of users obtained previously. The script here is going through each of the users from the query of AD above, using the UserPrincipalName attribute from local AD and finding the user in Office 365. If the user is unlicensed, the script outputs some text to the variable $LicNo, which we then count in the next section.

## Count the users who are not licensed
$LicNo = ForEach ($ADUser in $ADUsers)
{
    ## Get Azure AD users by UPN
    $UserLic = Get-MsolUser -UserPrincipalName $ADUser.UserPrincipalName
 
    ## If user has no license, output something so we can count it
    If ($UserLic.IsLicensed -eq $false)
    {
        Write-output "$($ADUser.UserPrincipalName) is unlicensed"
    }
}

Now the script counts the users which are unlicensed. If the number does not equal zero, it continues. If it does equal zero, the script completes without doing any more tasks. Once again the user is obtained by using the data from the local AD query. The user in Office 365 is obtained by the UPN and then if the user has no license, the location and license is set. To find out what your licenses are, run Get-MsolAccountSku in an elevated PowerShell session. For the Usage Location, Microsoft say that it must be a “valid ISO 3166-1 alpha-2 country code” for example: US for United Sates, FR for France, GB for Great Britain. Source: Assign licenses to user accounts with Office 365 PowerShell

If ($LicNo.count -ne 0)
{
    ## For each user
    ForEach ($ADUser in $ADUsers)
    {
        ## Get Azure AD users by UPN
        $UserLic = Get-MsolUser -UserPrincipalName $ADUser.UserPrincipalName
 
        ## If user has no license, set one.
        If ($UserLic.IsLicensed -eq $false)
        {
            Set-MsolUser -UserPrincipalName $ADUser.UserPrincipalName –UsageLocation GB
            Set-MsolUserLicense -UserPrincipalName $ADUser.UserPrincipalName -AddLicenses contosocom:ENTERPRISEPACK
        }
    }
}
## End

I have posted the complete script at the end of this post. Once run, this script should appropriately license the specified users for Office 365. You could set this up as a Scheduled Task to automate the process completely. I have added my standard logging and e-mail features to my own version of this script and will post the final, more complete package in the near future.

Thanks for reading, I hope this helps you out. If you’d like to get in touch with me, please leave a comment or tweet me.

-Mike

The Complete Script

## Log in to the O365 service
$O365User = "adminuser@contoso.onmicrosoft.com"
$O365Pwd = ConvertTo-SecureString "P@ssw0rd" -AsPlainText -Force
$O365Cred = New-Object System.Management.Automation.PSCredential $O365User, $O365Pwd
  
## Connect to Azure AD
Connect-MsolService -Credential $O365Cred
 
## Get Users from local AD to compare to Azure AD
$ADUsers = Get-ADUser -Filter * -SearchBase 'OU=people,DC=contoso,DC=com'
 
## Count the users who are not licensed
$LicNo = ForEach ($ADUser in $ADUsers)
{
    ## Get Azure AD users by UPN
    $UserLic = Get-MsolUser -UserPrincipalName $ADUser.UserPrincipalName
  
    ## If user has no license, output something so we can count it
    If ($UserLic.IsLicensed -eq $false)
    {
        Write-output "$($ADUser.UserPrincipalName) is unlicensed"
    }
}
 
If ($LicNo.count -ne 0)
{
    ## For each user
    ForEach ($ADUser in $ADUsers)
    {
        ## Get Azure AD users by UPN
        $UserLic = Get-MsolUser -UserPrincipalName $ADUser.UserPrincipalName
  
        ## If user has no license, set one.
        If ($UserLic.IsLicensed -eq $false)
        {
            Set-MsolUser -UserPrincipalName $ADUser.UserPrincipalName –UsageLocation GB
            Set-MsolUserLicense -UserPrincipalName $ADUser.UserPrincipalName -AddLicenses contosocom:ENTERPRISEPACK
        }
    }
}
## End