Overview

In this exercise, we will license Office 365 users for the various workloads: SharePoint Online, Lync Online, and Exchange Online using the MOP UI as well as using the Microsoft Online Services Module for Windows PowerShell. We will license users individually, license in bulk, and count and check licenses in use by workload.
 

License users individually in the MOP UI

1.       Browse to MOP (http://portal.microsoftonline.com) and sign into your Office 365 tenant

2.       On the Admin tab of MOP, click Users under Management

 

 

 

3.       Check the checkbox next to a user account in the Users list

4.       Click Edit in the toolbar at the top

 

 

Note: You can also simply click the individual user name to get to the licensing screen. The checkboxes are useful when assigning licenses for multiple users.

 

5.       Check the checkbox next to your plan (i.e. - Microsoft Office 365 Plan E3)

6.       Check all of the checkboxes next to Office, Lync, Office Web Apps, SharePoint, and Exchange

7.       Click Save

 

License users in bulk in the MOP UI

1.       Check the checkbox next to multiple user accounts in the Users list

2.       Click Edit in the toolbar at the top

3.       Click Next twice since we are not making any Details or Settings changes

4.       You should now be on the Licenses screen with 3 options:

a.       Retain current license assignments

b.      Replace existing license assignments

c.       Add to existing license assignments

5.       Select Replace existing license assignments and check the checkboxes for all available workloads:

 

 

6.       Click Submit and click Finish

 

 

 

License users individually using the Microsoft Online Services Module for Windows PowerShell

1.       Launch Microsoft Online Services Module for Windows PowerShell

2.       Connect-MsolService

3.       Type your tenant Global Administrator credentials in the pop-up

 

Note: If there is a newer version of the PowerShell module, you will see yellow warning text explaining that a newer version is available. We should always be sure that we are running the latest version of the module.

 

4.       We need to obtain the AccountSkuId values so that we are licensing within a licensing pack that the tenant is set up for. In our example here, we have an E3 trial tenant, which has an ENTERPRISEPACK AccountSkuId prefixed with our tenant name, which contains:

a.       OFFICESUBSCRIPTION (Office 2010)

b.      MCOSTANDARD (Lync Online)

c.       SHAREPOINTWAC (SharePoint Online)

d.      SHAREPOINTENTERPRISE (SharePoint Online)

e.      EXCHANGE_S_ENTERPRISE (Exchange Online)

 

Get-MsolAccountSku

 

You’ll see the AcountSkuId, ActiveUnits, WarningUnits, and ConsumedUnits.

 

Get-MsolAccountSku | Format-Table AccountSkuId, SkuPartNumber

 

The second column in this list is referenced in the next command as SkuPartNumber. We only have ENTERPRISEPACK, but need to keep in mind that you may have multiple packs to choose from. Replace SkuPartNumber in the following command with ENTERPRISEPACK.

 

$ServicePlans = Get-MsolAccountSku | Where {$_.SkuPartNumber -eq "SkuPartNumber"}

 

$ServicePlans.ServiceStatus

 

This returns all the service plans. We will choose to disable MCOSTANARD (Lync Online). The cmdlet we use to set user licenses requires a LicenseOption object as input. The following command gets us a LicenseOption object

 

$myO365Sku = New-MsolLicenseOptions -AccountSkuId your-tenant-name:ENTERPRISEPACK -DisabledPlans MCOSTANDARD

 

$myO365Sku.GetType()

 

Notice this is a LicenseOption object.

 

5.       Next, we can assign licenses to a user object

 

Users must have a UsageLocation value set prior to accepting licensing. UsageLocation is a 2-letter value representing the country in which the user will utilize the account:

 

Set-MSOLUser –UserPrincipalName your-user-UPN –UsageLocation US

 

Set the licensing. The following command will assign all licenses for the ENTERPRISEPACK:

 

Set-MsolUserLicense -UserPrincipalName your-user-UPN -AddLicenses your-tenant-name:ENTERPRISEPACK

 

Note: Similar to the –AddLicenses parameter, Set-MsolUserLicense also has a –RemoveLicenses parameter which can be used to remove license packs from a user object.

 

Finally, we need to disable Lync Online for this user:

 

Set-MsolUserLicense -UserPrincipalName your-user-UPN –LicenseOptions $myO365Sku

 

 

 

 

6.       Let’s take a look at a user who has licensing added to get a feel for what the object should look like in PowerShell when the user object has been licensed for at least one workload. Your Global Administrator account is a good choice.

 

Get-MsolUser –UserPrincipalName “your-Global-Admin-UPN”

 

Notice that the default view shows us a column that shows isLicensed = True. This means that this object has been licensed for at least one workload.

 

Get-MsolUser –UserPrincipalName “your-Global-Admin-UPN” | Format-List

 

This shows us several of the object’s attributes and their values. Notice that the Licenses attribute shows us the value of the AccountSkuId. Let’s dig further into the Licenses property to see what else we can find out about how this user is licensed:

 

$existingLicense = (Get-MsolUser –UserPrincipalName “your-Global-Admin-UPN” ).Licenses

 

$existingLicense.GetType()

 

 

Notice that this is a List object. If you run $existingLicense.Count, you’ll see that it has just one item in the list.

 

Next, we’ll break apart the list item:

 

$existingLicenseDetail = $existingLicense[0]

 

You can now see all of the properties of our new variable by appending it with a “.” and tabbing through the property list:

 

$existingLicenseDetail. (use the Tab key to cycle through the property list)

 

We can see that $existingLicenseDetail is a UserLicense object by running:

 

$existingLicenseDetail.GetType()

 

 

We can see the AccountSkuId for this user’s licenses:

 

$existingLicenseDetail.AccountSkuId

 

We can see the licensed workloads and also the provisioning status for each workload:

 

$existingLicenseDetail.ServiceStatus

 

Our Global Administrator shows that he is licensed for all available workloads and the ProvisioningStatus shows a Success status for each workload:

 

 

Finally, here is a one-liner which will show you licensing for a specific user:

 

(Get-MSOLUser –UserPrincipalName your-user-UPN).Licenses[0].ServiceStatus

 

Try the one-liner command to verify that you successfully licensed your user for everything in ENTERPRISEPACK except Lync Online:

 

 

License users in bulk using the Microsoft Online Services Module for Windows PowerShell

1.       Set $myO365Sku so that there are no service plans disabled

$myO365Sku = New-MsolLicenseOptions –AccountSkuId your-tenant-name-ENTERPRISEPACK

 

Dump out $myO365Sku so you can see that DisabledServicePlans is $null

 

$myO365Sku

 

2.       Set UsageLocation for all of your users

 

You can pipe the output from Get-MsolUser as input to another cmdlet which normally requires you to specify a user object:

 

Get-MsolUser -All | Set-MsolUser –UsageLocation US

 

3.       License all of your users for everything in ENTERPRISEPACK

 

The following command will error for any user who has a license in the ENTERPRISEPACK already:

 

Get-MsolUser -All | Set-MsolUserLicense -AddLicenses your-tenant-name:ENTERPRISEPACK

 

Set LicenseOptions to ensure that all users are licensed for all workloads in the ENTERPRISEPACK:

 

Get-MsolUser -All | Set-MsolUserLicense –LicenseOptions $myO365Sku

 

Note: Rather than set licensing for all users, PowerShell offers you the flexibility to filter user objects so that you are licensing only a subset of your user base. Filter example:

 

Get-MsolUser -All | where {$_.UserPrincipalName -match "contoso.com"} | Set-MsolUserLicense -LicenseOptions $myO365Sku

 

 

Get licenses for an individual user using Microsoft Online Services Module for Windows PowerShell

((Get-MsolUser -UserPrincipalName your-user-UPN).Licenses[0]).ServiceStatus
 

Get a list of users who are licensed or not licensed per workload

If you look at the AccountSkuId for a P tenant, you’ll see your-tenant-name:LITEPACK
 

P Tenant Product

ProvisioningStatus Index to Use
Lync Online
0
SharePoint Online
1
Exchange Online
2
 
Referring to an E3 tenant, if you look at the AccountSkuId, you’ll see your-tenant-name:ENTERPRISEPACK
 
E3 Tenant Product
ProvisioningStatus Index to Use
Office
0
Lync Online
1
SharePoint Online
3
Exchange Online
4
 
The ServiceStatus.ServicePlan is ordered consistently between objects, so we can do things like finding out who is licensed for each service individually, or who is missing a license for each service.
The following examples apply to any E3 SKU:
 
Note: We are making sure they are licensed for at least one service, and then working through array elements and checking to see if the value is “Disabled”.
 
Users licensed for Office Subscription
Get-MsolUser -All | where {$_.isLicensed -eq $true -and $_.Licenses[0].ServiceStatus[0].ProvisioningStatus -ne "Disabled"}
 
Users NOT licensed for Office Subscription
Get-MsolUser -All | where {$_.isLicensed -eq $true -and $_.Licenses[0].ServiceStatus[0].ProvisioningStatus -eq "Disabled"}
 
Users licensed for Lync Online
Get-MsolUser -All | where {$_.isLicensed -eq $true -and $_.Licenses[0].ServiceStatus[1].ProvisioningStatus -ne "Disabled"}
 
Users NOT licensed for Lync Online
Get-MsolUser -All | where {$_.isLicensed -eq $true -and $_.Licenses[0].ServiceStatus[1].ProvisioningStatus -eq "Disabled"}
 
Users licensed for SharePoint Online
Get-MsolUser -All | where {$_.isLicensed -eq $true -and $_.Licenses[0].ServiceStatus[3].ProvisioningStatus -ne "Disabled"}
 
Users NOT licensed for SharePoint Online
Get-MsolUser -All | where {$_.isLicensed -eq $true -and $_.Licenses[0].ServiceStatus[3].ProvisioningStatus -eq "Disabled"}
 
Users licensed for Exchange Online
Get-MsolUser -All | where {$_.isLicensed -eq $true -and $_.Licenses[0].ServiceStatus[4].ProvisioningStatus -ne "Disabled"}
 
Users NOT licensed for Exchange Online
Get-MsolUser -All | where {$_.isLicensed -eq $true -and $_.Licenses[0].ServiceStatus[4].ProvisioningStatus -eq "Disabled"}
 
 

Check provisioning status across the board or per workload

You can make a simple modification to see if we have any provisioning issues for any users.
 
Provisioning SUCCESS for ALL products
Get-MsolUser -All | where {$_.isLicensed -eq $true -and $_.Licenses[0].ServiceStatus[0].ProvisioningStatus -eq "Success" -and $_.Licenses[0].ServiceStatus[1].ProvisioningStatus -eq "Success" -and $_.Licenses[0].ServiceStatus[3].ProvisioningStatus -eq "Success" -and $_.Licenses[0].ServiceStatus[4].ProvisioningStatus -eq "Success"}
 
Provisioning NOT COMPLETE for ALL products
Get-MsolUser -All | where {$_.isLicensed -eq $true -and $_.Licenses[0].ServiceStatus[0].ProvisioningStatus -ne "Disabled"-and $_.Licenses[0].ServiceStatus[0].ProvisioningStatus -ne "Success” -and $_.Licenses[0].ServiceStatus[1].ProvisioningStatus -ne "Disabled"-and $_.Licenses[0].ServiceStatus[1].ProvisioningStatus -ne "Success” -and $_.Licenses[0].ServiceStatus[3].ProvisioningStatus -ne "Disabled"-and $_.Licenses[0].ServiceStatus[3].ProvisioningStatus -ne "Success” -and $_.Licenses[0].ServiceStatus[4].ProvisioningStatus -ne "Disabled"-and $_.Licenses[0].ServiceStatus[4].ProvisioningStatus -ne "Success”}
 
Provisioning SUCCESS for Office Subscription
Get-MsolUser -All | where {$_.isLicensed -eq $true -and $_.Licenses[0].ServiceStatus[0].ProvisioningStatus -eq "Success"}
 
Provisioning NOT COMPLETE for Office Subscription
Get-MsolUser -All | where {$_.isLicensed -eq $true -and $_.Licenses[0].ServiceStatus[0].ProvisioningStatus -ne "Disabled"-and $_.Licenses[0].ServiceStatus[0].ProvisioningStatus -ne "Success” }
 
Provisioning SUCCESS for Lync Online
Get-MsolUser -All | where {$_.isLicensed -eq $true -and $_.Licenses[0].ServiceStatus[1].ProvisioningStatus -eq "Success"}
 
Provisioning NOT COMPLETE for Lync Online
Get-MsolUser -All | where {$_.isLicensed -eq $true -and $_.Licenses[0].ServiceStatus[1].ProvisioningStatus -ne "Disabled"-and $_.Licenses[0].ServiceStatus[1].ProvisioningStatus -ne "Success” }
 
Provisioning SUCCESS for SharePoint Online
Get-MsolUser -All | where {$_.isLicensed -eq $true -and $_.Licenses[0].ServiceStatus[3].ProvisioningStatus -eq "Success"}
 
Provisioning NOT COMPLETE for SharePoint Online
Get-MsolUser -All | where {$_.isLicensed -eq $true -and $_.Licenses[0].ServiceStatus[3].ProvisioningStatus -ne "Disabled"-and $_.Licenses[0].ServiceStatus[3].ProvisioningStatus -ne "Success” }
 
Provisioning SUCCESS for Exchange Online
Get-MsolUser -All | where {$_.isLicensed -eq $true -and $_.Licenses[0].ServiceStatus[4].ProvisioningStatus -eq "Success"}
 
Provisioning NOT COMPLETE for Exchange Online
 
 
 
Get-MsolUser -All | where {$_.isLicensed -eq $true -and $_.Licenses[0].ServiceStatus[4].ProvisioningStatus -ne "Disabled"-and $_.Licenses[0].ServiceStatus[4].ProvisioningStatus -ne "Success” }



Additional Samples

#get MSOL users who do not have a license assigned into a collection (array)
[Array]$AllUnlicensedUsers = Get-MsolUser -UnlicensedUsersOnly
 
#show a count of all unlicensed MSOL users
If ($AllUnlicensedUsers -ne $null)
{
      $AllUnlicensedUsers.Count
}
 
#get MSOL users who are in the default domain into a collection (array)
[Array]$DefaultDomUsers = Get-MsolUser -All | Where { $_.UserPrincipalName -match "onmicrosoft.com" }
 
#show a count of all MSOL users in the default domain
If ($DefaultDomUsers -ne $null)
{
      $DefaultDomUsers.Count
}
 
#get MSOL users who are in a specific vanity domain into a collection (array)
[Array]$VanityDomUsers = Get-MsolUser -All | Where { $_.UserPrincipalName -match "enter-vanity-domain-here" }
 
#show a count of all MSOL users in the vanity domain
If ($VanityDomUsers -ne $null)
{
      $VanityDomUsers.Count
}
 
#combine the logic into a single command: get MSOL users who are in a specific domain and are not licensed (array)
[Array]$VanityDomUnlicensedUsers = Get-MsolUser -UnlicensedUsersOnly | Where { $_.UserPrincipalName -match "enter-vanity-domain-here" }
 
#show a count of all MSOL users in the vanity domain who are not licensed
If ($VanityDomUnlicensedUsers -ne $null)
{
      $VanityDomUnlicensedUsers.Count
}
 
#whichever collection of users you select, you can use the pipe '|' character with a ForEach-Object statement to perform license assignment
If ($VanityDomUnlicensedUsers -ne $null)
{
      #a supported UsageLocation must be set for each user prior to assigning a license
      $VanityDomUnlicensedUsers | ForEach-Object
      {
            #set UsageLocation
            Set-MsolUser -UserPrincipalName $_.UserPrincipalName  –UsageLocation "enter-usage-location-here"
            #assign license pack
            Set-MsolUserLicense -UserPrincipalName $_.UserPrincipalName -AddLicenses "enter-license-pack-name-here"
      }
}
 
#after licenses have been assigned, you'll want to check your work
#get all MSOL users who remain unlicensed
[Array]$AllUnlicensedUsers = Get-MsolUser -UnlicensedUsersOnly
 
#show a count of all unlicensed MSOL users
If ($AllUnlicensedUsers -ne $null)
{
      $AllUnlicensedUsers.Count
}
 
#get all MSOL users who have the expected license assignment
[Array]$AllSuccessfulLicensedUsers = Get-MsolUser -All | Where { $_.Licenses.AccountSkuId -match "enter-license-pack-name-here" }
 
#show a count of all unlicensed MSOL users
If ($AllSuccessfulLicensedUsers -ne $null)
{
      $AllSuccessfulLicensedUsers.Count
}