Select Page

If it’s free, it’s better. This is basically my mantra for life and a really easy one to follow at that. You can apply it to all sorts of things: ice cream, candy, food. Okay, maybe just free food tastes better when you know you didn’t have to pay for it. Especially with this lovely inflation we’ve been experiencing. Am I the only one who feels like the value menu isn’t really a value anymore?? It’s outrageous! My children are already saying, “back in my day…” to when a Hot ‘n Spicy used to be a dollar. But to destroy my own mantra that I just told you I live by, not all free things are great. Sometimes you don’t want the free stuff because it’s garbage. Just like that psycho demon kitten that cute kid offered you that one time, Microsoft also likes to sweeten the deal with your O365 subscription. It’s a sweet deal for things you don’t want. And as an administrator it’s the things you don’t want your people to have either. You’re the Grinch of Cloud Apps and you can’t stand the fact that people will be Yammer‘ing, Sway‘ing, and Kaizala‘ing in your tenant. That’s great Grinchy, but the problem is when you assign a license it automatically enables all of those weird apps you hate. And there’s a bunch of them to hate. But don’t fret you Mean Green Machine, we’ll have that jolly free-app spirit crushed by the end of this post! Let’s look at how we can disable O365 apps in specific licenses via PowerShell.

\\\Ooey GUI

First, let’s check out the GUI method of doing this. Launch the O365 Admin Center and find a user you want to add a license to. Once you check the license, you’ll notice the “Apps” section below the “Licenses” area. By default, checking the box next to the license is going to enable all of the apps included in the license. How could we not want all that MS has to offer? And if we did, how could we refuse freebies from our overlord? Just a side note: depending on your license and how MS is feeling, you will see various apps/services included in each license over time. And while you can block sign-in for the entire application/service in Azure Active Directory (another post for another day), you might want to just disable the app for some users or disable it while you’re testing/configuring the app. That’s what we’ll cover here.

Now that we’re on the same page with what we’re trying to do, here is a brief overview of what we need to do:

  • Get the license SKU (these are specific to your tenant)
  • Get the apps/services listed in the license.
  • Create an array with the apps/services we want to disable.
  • Either assign a license with the disabled apps/services, or update the apps/services of a license already assigned to a user.

\\\Ex-SKU-SE Me??

First things first, let’s get those SKUs. Actually, the first thing is connecting to the MSOL service. Well, you do have to open up PowerShell/ISE before that. And I guess you do need to power on your computer to do any of this. Have you paid your electricity bill? Do you even have a computer? CaN YoU eVeN???

I think you’re picking up what I’m putting down. Connect to the MSOL service and then run:

Get-MsolAccountSku

You should get a list of the licenses you have in your tenant with their SkuId and how many you have purchased/assigned. Some of these are self-explanatory, but others are elusive. Thankfully, MS has a cheat sheet available to use to unravel the mystery of various products.

Well, that felt good. But how do we get the list of apps in the license with whatever pet names MS is calling them under the hood? Well, we can select a specific SKU and then expand the ServiceStatus property to get all of the individual services within the license:

Get-MsolAccountSku | where {$_.AccountSkuId -eq 'NameOfYourSKU'} | Select -Expand ServiceStatus

That gives us a great idea of what is included in our license bundle. Reminds me of the old HP Printer software. 350+ MB for a print driver…and 16 pieces of adware you sly devils. This is slightly better than that, but may bring back repressed memories. There’s actually a better way for us to do the do that we want to do.

\\\License Guinea Pig

Instead of getting the list of services in a SKU, we can configure a user as a “template.” Just configure a user in the O365 admin portal with the license and enabled/disabled apps you want and then we’ll use that joker as our guinea pig. Once you have the user configured to your liking, run the following command:

(Get-MsolUser -UserPrincipalName GUINEA_PIG@farmersonly.com).Licenses.ServiceStatus
We can see the name of each ServicePlan and its ProvisioningStatus within the license. We only want the ones that are disabled, and we’re going to build an array out of it. First, we’ll define an empty array ($DisabledPlans) and then we’ll loop through each ServicePlan and add the ServiceName to the array. It will look like this:
$DisabledPlans = @()
$GuineaPig = (Get-MsolUser -UserPrincipalName GUINEA_PIG@farmersonly.com).Licenses.ServiceStatus | ?{$_.ProvisioningStatus -eq 'Disabled'}
$GuineaPig | %{$DisabledPlans += $_.ServicePlan.ServiceName}
If you didn’t know:
? = where or Where-Object
% = ForEach.

\\\Two Roads Diverged…

Okay, so we now have our $DisabledPlans array of strings. Now what do we do with all of this power? Start disablin’ like a doubly dubious and diabolical dastard from Dublin! Well, we might need a little more finesse and forethought than my previous sentence led on, so here are 2 similar scenarios with slightly different commands:
1) User with No License Assigned
2) User with Existing License Assigned

$DisabledPlans = @()
$GuineaPig = (Get-MsolUser -UserPrincipalName GUINEA_PIG@farmersonly.com).Licenses.ServiceStatus | ?{$_.ProvisioningStatus -eq 'Disabled'}
$GuineaPig | %{$DisabledPlans += $_.ServicePlan.ServiceName}
$Options = New-MsolLicenseOptions -AccountSkuId 'NameOfYourSKU' -DisabledPlans $DisabledPlans
Set-MsolUserLicense -UserPrincipalName TARGET_PIG@farmersonly.com -AddLicenses 'NameOfYourSKU' -LicenseOptions $Options

Same as the User with No License, minus the “-AddLicense ‘NameOfYourSKU'” part of the last line. This is if the user already has the license assigned and you just want to disable apps within that license.

$DisabledPlans = @()
$GuineaPig = (Get-MsolUser -UserPrincipalName GUINEA_PIG@farmersonly.com).Licenses.ServiceStatus | ?{$_.ProvisioningStatus -eq 'Disabled'}
$GuineaPig | %{$DisabledPlans += $_.ServicePlan.ServiceName}
$Options = New-MsolLicenseOptions -AccountSkuId 'NameOfYourSKU' -DisabledPlans $DisabledPlans
Set-MsolUserLicense -UserPrincipalName TARGET_PIG@farmersonly.com -LicenseOptions $Options
And if for some reason the Grinch’s heart has tripled in size and now you want everybody to have everything Microsoft can give them, just remove the -LicenseOptions parameter from the Set-MsolUserLicense command. Such a big heart you have!

OTHER POSTS YOU WANT TO READ

Spice Up HTML Emails with PowerShell – Part III

So far in this series we've fumbled our way around the kitchen and tried to wing it when sending HTML emails with PowerShell. It was clunky to say the least. We then went through our spice rack and built an HTML template, highlighting the nuances of each spicy element...

Spice up HTML Emails with PowerShell – Part II

In Part I of our scrumptious concoction we put our script into the oven to let it bake. But we forgot to add our secret sauce that's sure to leave our recipients drooling, which is clearly our goal. In this post we'll continue to spice up HTML emails with PowerShell...

Spice Up HTML Emails with PowerShell – Part I

I live in the South, specifically in God's country AKA TEXAS BABAY! There's plenty of amazing things about Texas and definitely some reasons to loathe being from Houston, but it's hard to knock our food. I mean, is there really even a debate between Whataburger vs...

Font Installer Script (PowerShell)

Things have smells. I know, this is a revolutionary idea and you may need to stop right here and take a breather while you process this massive revelation. Things that are brand new have a particular smell that vanishes shortly after hitting your nostrils. It's...

Exchange – Get All Mailbox Folder Permissions

As an IT professional—or as my daughter would call it: doing computer nerd things with your friends—we're into some weird stuff. And by weird, you know I mean amazing and super neato. There's something about the smell of a freshly created file share that just can't be...
%d bloggers like this: