Microsoft 365 license assignment & enforcement

Cayosoft Administrator provides both: Automated License Assignment and Manual License Assignment. Automatic license assignment is accomplished by creating rules in the Cayosoft Administrator Console. Control over manual license assignment is accomplished through the Web Portal.

Automate Microsoft 365 licenses with rules

The Cayosoft Administrator Microsoft 365 license enforcement rules both assign a license with the specified options and then provide ongoing enforcement of that license and options. If a license is changed by an administrator, the license will be reset to the desired state defined by the rule, the very next time the rule executes.

TIP: To get the list of the rules for Microsoft 365 management, please see the Microsoft Hybrid & License Management section in the Index of Automation Rules article.

Create license enforcement rule

1. In the Cayosoft Administrator console, click New Rule.

2. Check Microsoft Hybrid & License Management then click Next.

3. Check Licenses then click Next.

4. Check the Microsoft 365 Users | Enforce License rule then click Next.

5. Select the desired output type then click Next.

6. Update or change the rule name as desired.

7. Change the rule label if needed. Labels represent folders in the navigation tree into which the rule will be created.

8. Click Finish.

Rule Query section

Filters vs. Query Criteria

Both Filters and Query Criteria can be used to refine the list of objects that will be affected by the rule when it is executed. Filters are more flexible, but they are applied only after data has been returned from Microsoft 365. Query Criteria are less flexible, but may improve performance because the criteria are sent at the time Microsoft 365 is queried and so they limit the amount of data that must be sent over the network connection. Filters and Query Criteria can be used together to optimize the performance of the License Enforcement Rule.

Filters

Applying a filter to a license enforcement query narrows down the selection of users who will receive the license assignment. Filters allow you to specify multiple detailed criteria so that licenses are applied to a specific set of users.

Criteria Builder

Clicking the selection button (shown here in red) to the right of the Filter field will display the criteria builder. The criteria builder provides a point-and-click interface for constructing complex detailed filters.

Query Criteria

Query criteria can be used to narrow the scope of the query being sent to Microsoft 365 so that the amount of data returned is reduced and thereby improving the License Enforcement Rule’s performance.

Rule Action Section

Choose License & Options

Displayed in the Action section of the Rule are the licenses available for the Microsoft 365 tenant configured under Configuration > Microsoft 365. Select the license(s) that will be applied to the users returned by the Query section of the rule.

1. Assign - license and its apps and services will be assigned to the users.

2. Assign (partially) - license and some of its apps and services will be assigned to the users.

3. Update apps - license should be already assigned to the users and only its' apps and services will be updated. If the license is not assigned its apps and services won't be updated for the users.

4. Unassign - license and its apps and services will be revoked.

5. Ignore - license and its apps and services won't be taken into consideration. Those users that have this license and its apps and services assigned would preserve them. Those users that don't have this license and its apps and services assigned would preserve that state.

License apps and services can be set to Enable, Disable or Ignore.

All other licenses settings mean all other licenses that are not specified in License options. They can be ignored or unassigned.

Rule Enforcement Section

Schedule License Assignment

After you have configured and tested the license enforcement rule, you can schedule it to automatically run on schedule. By running the rule on schedule, you will ensure that users maintain the correct license.

Microsoft 365 License assignment by Active Directory group

Cayosoft Administrator lets you use the membership of an Active Directory group to assign licenses to Microsoft 365 users. When Cayosoft Administrator reads the group membership in the On-premises Active Directory, it then searches for a corresponding account in Microsoft 365. If (and only if) a matching account is found will the license specified in the Action section of the rule, be applied to the user.

Create a License Enforcement rule

1. In the Cayosoft Administrator console, click New Rule.

2. Check Microsoft Hybrid & License Management then click Next.

3. Check Licenses then click Next.

4. Check the AD Groups | Enforce License rule then click Next.

5. Select the desired output type then click Next.

6. Update or change the rule name as needed.

7. Change the rule label if needed. Labels represent folders in the navigation tree into which the rule will be created.

8. Click Finish.

Specify the Licensing Group

To specify an Active Directory group whose members will be licensed by the rule, click the selection button to the right of the AD Group (DN) field.

Cayosoft Dynamic Groups

Cayosoft Dynamic Groups can be used when specifying the group that contains the users who will receive the Microsoft 365 license. Cayosoft Dynamic Groups have memberships that are automatically maintained (users added or removed) by a query that identifies the group’s membership. Like license assignment rules, Dynamic Groups are also scheduled periodically to update the Dynamic Group’s Membership so that the group membership is always correct. Learn more in:  Creating Dynamic Groups.

Control manual Microsoft 365 Licenses assignments in the Web Portal

There are several ways to allow administrators to assign Microsoft 365 licenses manually to users when using the Web Portal.

Configure the New User or Clone User Actions

1. Navigate to the New User Web Action.

2. Expand the License Option section.

3. Set the options as desired and then save the rule.

License Option Descriptions

• Use Automated License Rule – This allows you to define a default license so no choice is needed during user creation. This option runs the rule namedCayosoft Administrator > Rules > WebAdmin Rules (Pre-configured) > New User | Office 365 User Enforce License. To see or set the default license simply adjust that rule. (See Configure a Default License for the New User or Clone User Actions section below).

• User Selects license during creation – This displays a link with the available licenses displayed. If a user fails to set a license, then the system falls back to the Use Automated License Rule. (See Configure a Default License for the New User or Clone User Actions section below).

• Do not assign license during creation – This will option will not assign a license. If the user asked for a Microsoft 365 or Exchange Remote mailbox to be created an error will occur.

Configure a Default License for the New User or Clone User Actions

1. Navigate to Home > Rules > WebAdmin Rules (Pre-configured).

2. Select the New User | Office 365 User Enforce License rule.

3. Assign licenses and options to be assigned to new users.

4. Click Save Changes to save the rule.

NOTE: Assigning a low-cost license and then only assigning the Exchange Online option is a popular method for initial license assignment. This approach limits initial user licensing costs but provisions the account with a mailbox. This approach can also be used in conjunction with fully automated license assignment rules that are run later or by manual license assignment capabilities of the Web Portal.

Manually assign Microsoft 365 licenses to new users

1. In the Cayosoft Administrator Console, navigate to the New User Web Action.

2. Select User selects license during creation.

3. Save the rule.

4. Navigate to the New User | Office 365 User Enforce License rule.

5. Select the default license that will be assigned to new users when Remote Mailbox or Microsoft 365 Mailbox is selected.

   NOTE: You must choose an option that includes an Exchange Online Mailbox, and the options selected must not conflict.

6. Save the rule.