If it’s free, it’s better. This is basically my mantra for life and a really easy one to follow at that. You can apply it to all sorts of things: ice cream, candy, food. Okay, maybe just free food tastes better when you know you didn’t have to pay for it. Especially with this lovely inflation we’ve been experiencing. Am I the only one who feels like the value menu isn’t really a value anymore?? It’s outrageous! My children are already saying, “back in my day…” to when a Hot ‘n Spicy used to be a dollar. But to destroy my own mantra that I just told you I live by, not all free things are great. Sometimes you don’t want the free stuff because it’s garbage. Just like that psycho demon kitten that cute kid offered you that one time, Microsoft also likes to sweeten the deal with your O365 subscription. It’s a sweet deal for things you don’t want. And as an administrator it’s the things you don’t want your people to have either. You’re the Grinch of Cloud Apps and you can’t stand the fact that people will be Yammer‘ing, Sway‘ing, and Kaizala‘ing in your tenant. That’s great Grinchy, but the problem is when you assign a license it automatically enables all of those weird apps you hate. And there’s a bunch of them to hate. But don’t fret you Mean Green Machine, we’ll have that jolly free-app spirit crushed by the end of this post! Let’s look at how we can disable O365 apps in specific licenses via PowerShell.
\\\Ooey GUI
First, let’s check out the GUI method of doing this. Launch the O365 Admin Center and find a user you want to add a license to. Once you check the license, you’ll notice the “Apps” section below the “Licenses” area. By default, checking the box next to the license is going to enable all of the apps included in the license. How could we not want all that MS has to offer? And if we did, how could we refuse freebies from our overlord? Just a side note: depending on your license and how MS is feeling, you will see various apps/services included in each license over time. And while you can block sign-in for the entire application/service in Azure Active Directory (another post for another day), you might want to just disable the app for some users or disable it while you’re testing/configuring the app. That’s what we’ll cover here.
Now that we’re on the same page with what we’re trying to do, here is a brief overview of what we need to do:
- Get the license SKU (these are specific to your tenant)
- Get the apps/services listed in the license.
- Create an array with the apps/services we want to disable.
- Either assign a license with the disabled apps/services, or update the apps/services of a license already assigned to a user.
\\\Ex-SKU-SE Me??
First things first, let’s get those SKUs. Actually, the first thing is connecting to the MSOL service. Well, you do have to open up PowerShell/ISE before that. And I guess you do need to power on your computer to do any of this. Have you paid your electricity bill? Do you even have a computer? CaN YoU eVeN???
I think you’re picking up what I’m putting down. Connect to the MSOL service and then run:
Get-MsolAccountSkuYou should get a list of the licenses you have in your tenant with their SkuId and how many you have purchased/assigned. Some of these are self-explanatory, but others are elusive. Thankfully, MS has a cheat sheet available to use to unravel the mystery of various products.
Well, that felt good. But how do we get the list of apps in the license with whatever pet names MS is calling them under the hood? Well, we can select a specific SKU and then expand the ServiceStatus property to get all of the individual services within the license:
Get-MsolAccountSku | where {$_.AccountSkuId -eq 'NameOfYourSKU'} | Select -Expand ServiceStatusThat gives us a great idea of what is included in our license bundle. Reminds me of the old HP Printer software. 350+ MB for a print driver…and 16 pieces of adware you sly devils. This is slightly better than that, but may bring back repressed memories. There’s actually a better way for us to do the do that we want to do.
\\\License Guinea Pig
Instead of getting the list of services in a SKU, we can configure a user as a “template.” Just configure a user in the O365 admin portal with the license and enabled/disabled apps you want and then we’ll use that joker as our guinea pig. Once you have the user configured to your liking, run the following command:
(Get-MsolUser -UserPrincipalName GUINEA_PIG@farmersonly.com).Licenses.ServiceStatus$DisabledPlans) and then we’ll loop through each ServicePlan and add the ServiceName to the array. It will look like this:$DisabledPlans = @()
$GuineaPig = (Get-MsolUser -UserPrincipalName GUINEA_PIG@farmersonly.com).Licenses.ServiceStatus | ?{$_.ProvisioningStatus -eq 'Disabled'}
$GuineaPig | %{$DisabledPlans += $_.ServicePlan.ServiceName}? = where or Where-Object% = ForEach.\\\Two Roads Diverged…
Okay, so we now have our $DisabledPlans array of strings. Now what do we do with all of this power? Start disablin’ like a doubly dubious and diabolical dastard from Dublin! Well, we might need a little more finesse and forethought than my previous sentence led on, so here are 2 similar scenarios with slightly different commands:
1) User with No License Assigned
2) User with Existing License Assigned
$DisabledPlans = @()
$GuineaPig = (Get-MsolUser -UserPrincipalName GUINEA_PIG@farmersonly.com).Licenses.ServiceStatus | ?{$_.ProvisioningStatus -eq 'Disabled'}
$GuineaPig | %{$DisabledPlans += $_.ServicePlan.ServiceName}
$Options = New-MsolLicenseOptions -AccountSkuId 'NameOfYourSKU' -DisabledPlans $DisabledPlans
Set-MsolUserLicense -UserPrincipalName TARGET_PIG@farmersonly.com -AddLicenses 'NameOfYourSKU' -LicenseOptions $OptionsSame as the User with No License, minus the “-AddLicense ‘NameOfYourSKU'” part of the last line. This is if the user already has the license assigned and you just want to disable apps within that license.
$DisabledPlans = @()
$GuineaPig = (Get-MsolUser -UserPrincipalName GUINEA_PIG@farmersonly.com).Licenses.ServiceStatus | ?{$_.ProvisioningStatus -eq 'Disabled'}
$GuineaPig | %{$DisabledPlans += $_.ServicePlan.ServiceName}
$Options = New-MsolLicenseOptions -AccountSkuId 'NameOfYourSKU' -DisabledPlans $DisabledPlans
Set-MsolUserLicense -UserPrincipalName TARGET_PIG@farmersonly.com -LicenseOptions $Options-LicenseOptions parameter from the Set-MsolUserLicense command. Such a big heart you have!