Recently working with a client they wanted to automate the licensing of Office 365 accounts, this client had multiple Active Directory forests being sync and cloud users in their Office 365 tenant. For those that have to assign licenses to users in Office 365 know it’s a two step process:
- Set user location
- Assign Office 365 license
To do this requires you to login to Office 365 and assign the information, We all know to run a local scheduled task, credentials can be stored in the task, however this is not possible (…Not that I’ve found) to store Office 365 credentials and pass them thru PowerShell from the scheduled task. For this reason you need to store the password on the local system. Before we get to this you need to make sure the user account your using has the correct permissions to assign licenses. Office 365 has a number of Admin roles Office 365 Admin Roles
So the only roles that can assign licenses are Global Admin and User Management Admin.
I’ve broken the PowerShell into five sections:
- Get Office 365 Credentials
- Connect to Office 365
- Set user usage location
- Get Office 365 license SKU
- Assign License
Get Office 365 Credentials
To be able to pass the password from the schedule task to PowerShell the password needs to be stored in plain text, to store passwords in plain text is never recommend. For this reason I’ve not used a domain account, I’ve used a cloud only account with a complex password. The location of the password is a local domain server which has restricted logons and additional NTFS permissions can be added to the location.
## MSOL Credentials
$MsolAdmUser = “MSOL@yourdomain.onmicrosoft.com”
$pwd = Get-Content C:\Common\msol.txt | ConvertTo-SecureString -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential $MsolAdmUser, $pwd
Connect to Office 365
To connect to Office 365 you need the follow these instructions Manage Azure AD using Windows PowerShell as Prerequisites. Once these steps have been completed. you will be able to connect:
## Connect To Office 365
Import-Module MSOnline
Connect-MsolService -Credential $cred
Set user usage location
A colleague of mine pointed me to this script in the TechNet Gallery, this script makes the local Active Directory country/region field to the Office 365 usage. Download and store this script.
## Set Usage Location for MSOl Users
C:\Common\Set-MSOLUsageLocation.ps1
Get Office 365 license SKU
Before a license can be assigned, we need to get the correct SKU.
## Get Office 365 Account SKUs
$AccountSku = Get-MsolAccountSku
Its possible that you will have a number of different SKU’s on your tenant, you can list individual SKU:
## Account SKU Array
$AccountSku[0].AccountSkuId
$AccountSku[1].AccountSkuId
$AccountSku[2].AccountSkuId
For this project we’re only assign one type of SKU to all users, I’ll post another blog later how to assign different SKU’s within the same script.
Assign Licenses
Last but not least is to assign the license to the users. This takes data from the previous steps and assigns licenses:
## Set License for MSOL Users
$Users = Get-MsolUser -All -UnlicensedUsersOnly
$users = $users | ? {$_.Country -ne $null}ForEach ($User in $Users)
{
Set-MsolUserLicense -UserPrincipalName $user.UserPrincipalName -AddLicenses $AccountSku[0].AccountSkuId
}
Put all of these steps together in a PS1 script and set a scheduled task. Next steps are to put a query/variable into the Set-MsolUSerLicense this will allow different types of SKU’s to be applied in the same script, I’ll post this once complete…
Disclaimer: All scripts and other PowerShell references on this blog are offered "as is" with no warranty. While these scripts are tested and working in my test environment, it is recommended that you test these scripts in your own test environment before using in any production environment.
