If it’s free, it’s better. This is basically my mantra for life and a really easy one to follow at that. You can apply it to all sorts of things: ice cream, candy, food. Okay, maybe just free food tastes better when you know you didn’t have to pay for it. Especially with this lovely inflation we’ve been experiencing. Am I the only one who feels like the value menu isn’t really a value anymore?? It’s outrageous! My children are already saying, “back in my day…” to when a Hot ‘n Spicy used to be a dollar. But to destroy my own mantra that I just told you I live by, not all free things are great. Sometimes you don’t want the free stuff because it’s garbage. Just like that psycho demon kitten that cute kid offered you that one time, Microsoft also likes to sweeten the deal with your O365 subscription. It’s a sweet deal for things you don’t want. And as an administrator it’s the things you don’t want your people to have either. You’re the Grinch of Cloud Apps and you can’t stand the fact that people will be Yammer‘ing, Sway‘ing, and Kaizala‘ing in your tenant. That’s great Grinchy, but the problem is when you assign a license it automatically enables all of those weird apps you hate. And there’s a bunch of them to hate. But don’t fret you Mean Green Machine, we’ll have that jolly free-app spirit crushed by the end of this post! Let’s look at how we can disable O365 apps in specific licenses via PowerShell.

\\\Ooey GUI

First, let’s check out the GUI method of doing this. Launch the O365 Admin Center and find a user you want to add a license to. Once you check the license, you’ll notice the “Apps” section below the “Licenses” area. By default, checking the box next to the license is going to enable all of the apps included in the license. How could we not want all that MS has to offer? And if we did, how could we refuse freebies from our overlord? Just a side note: depending on your license and how MS is feeling, you will see various apps/services included in each license over time. And while you can block sign-in for the entire application/service in Azure Active Directory (another post for another day), you might want to just disable the app for some users or disable it while you’re testing/configuring the app. That’s what we’ll cover here.

Now that we’re on the same page with what we’re trying to do, here is a brief overview of what we need to do:

  • Get the license SKU (these are specific to your tenant)
  • Get the apps/services listed in the license.
  • Create an array with the apps/services we want to disable.
  • Either assign a license with the disabled apps/services, or update the apps/services of a license already assigned to a user.

\\\Ex-SKU-SE Me??

First things first, let’s get those SKUs. Actually, the first thing is connecting to the MSOL service. Well, you do have to open up PowerShell/ISE before that. And I guess you do need to power on your computer to do any of this. Have you paid your electricity bill? Do you even have a computer? CaN YoU eVeN???

I think you’re picking up what I’m putting down. Connect to the MSOL service and then run:


You should get a list of the licenses you have in your tenant with their SkuId and how many you have purchased/assigned. Some of these are self-explanatory, but others are elusive. Thankfully, MS has a cheat sheet available to use to unravel the mystery of various products.

Well, that felt good. But how do we get the list of apps in the license with whatever pet names MS is calling them under the hood? Well, we can select a specific SKU and then expand the ServiceStatus property to get all of the individual services within the license:

Get-MsolAccountSku | where {$_.AccountSkuId -eq 'NameOfYourSKU'} | Select -Expand ServiceStatus

That gives us a great idea of what is included in our license bundle. Reminds me of the old HP Printer software. 350+ MB for a print driver…and 16 pieces of adware you sly devils. This is slightly better than that, but may bring back repressed memories. There’s actually a better way for us to do the do that we want to do.

\\\License Guinea Pig

Instead of getting the list of services in a SKU, we can configure a user as a “template.” Just configure a user in the O365 admin portal with the license and enabled/disabled apps you want and then we’ll use that joker as our guinea pig. Once you have the user configured to your liking, run the following command:

(Get-MsolUser -UserPrincipalName GUINEA_PIG@farmersonly.com).Licenses.ServiceStatus
We can see the name of each ServicePlan and its ProvisioningStatus within the license. We only want the ones that are disabled, and we’re going to build an array out of it. First, we’ll define an empty array ($DisabledPlans) and then we’ll loop through each ServicePlan and add the ServiceName to the array. It will look like this:
$DisabledPlans = @()
$GuineaPig = (Get-MsolUser -UserPrincipalName GUINEA_PIG@farmersonly.com).Licenses.ServiceStatus | ?{$_.ProvisioningStatus -eq 'Disabled'}
$GuineaPig | %{$DisabledPlans += $_.ServicePlan.ServiceName}
If you didn’t know:
? = where or Where-Object
% = ForEach.

\\\Two Roads Diverged…

Okay, so we now have our $DisabledPlans array of strings. Now what do we do with all of this power? Start disablin’ like a doubly dubious and diabolical dastard from Dublin! Well, we might need a little more finesse and forethought than my previous sentence led on, so here are 2 similar scenarios with slightly different commands:
1) User with No License Assigned
2) User with Existing License Assigned

$DisabledPlans = @()
$GuineaPig = (Get-MsolUser -UserPrincipalName GUINEA_PIG@farmersonly.com).Licenses.ServiceStatus | ?{$_.ProvisioningStatus -eq 'Disabled'}
$GuineaPig | %{$DisabledPlans += $_.ServicePlan.ServiceName}
$Options = New-MsolLicenseOptions -AccountSkuId 'NameOfYourSKU' -DisabledPlans $DisabledPlans
Set-MsolUserLicense -UserPrincipalName TARGET_PIG@farmersonly.com -AddLicenses 'NameOfYourSKU' -LicenseOptions $Options

Same as the User with No License, minus the “-AddLicense ‘NameOfYourSKU'” part of the last line. This is if the user already has the license assigned and you just want to disable apps within that license.

$DisabledPlans = @()
$GuineaPig = (Get-MsolUser -UserPrincipalName GUINEA_PIG@farmersonly.com).Licenses.ServiceStatus | ?{$_.ProvisioningStatus -eq 'Disabled'}
$GuineaPig | %{$DisabledPlans += $_.ServicePlan.ServiceName}
$Options = New-MsolLicenseOptions -AccountSkuId 'NameOfYourSKU' -DisabledPlans $DisabledPlans
Set-MsolUserLicense -UserPrincipalName TARGET_PIG@farmersonly.com -LicenseOptions $Options
And if for some reason the Grinch’s heart has tripled in size and now you want everybody to have everything Microsoft can give them, just remove the -LicenseOptions parameter from the Set-MsolUserLicense command. Such a big heart you have!


Get Entra Apps with Expiring Secrets

Secrets might not make friends, but they're really useful for locking down your app registrations in Entra. Although you might be tempted to go ahead and set them to expire 25 years into the future (if it was possible...is it possible???) so you never have to think...

Nested AD Managers (PowerShell)

So I had a somewhat odd request (isn't that how all truly great stories start) a long time ago in an IT galaxy far, far away. And it went something like this: we want to email an employee and CC their manager, but if their manager is inactive (took a one-way trip to...

6 Things I Wish I Had Known About PowerShell

About a hundred years ago when I stopped riding dinosaurs to work and started learning PowerShell, I struggled to know what to learn first and where to even begin. That blue box with white writing was intimidating to say the least. I finally worked up the courage to...

Index Scripts for Windows Search

So you just finished writing some code and you go to save your file. You summarize all of the important aspects this section of code contains into a nice, easy-to-read file name that your future self will immediately recognize. Fast forward to the future where you...

Array vs ArrayList (PowerShell)

For some tasks in life, being precise is a necessity. But most of us get away with rounding, paraphrasing, and hitting in the general vicinity most of the time. Depending on your personality, you may be one who strives for perfection and strains on every miniscule...