AD Groups | Validate License rule – Cayosoft Help Center

Rule description

This hybrid rule queries the specified Active Directory groups and for each user that is a member of these groups, checks if selected license plans are assigned to the user. For each license option in these plans, the rule validates whether the On/Off state of the options in the rule matches the state in Office 365. License plans that are not selected in the rule are ignored. An Active Directory user account should have a corresponding Office 365 user account with an identical UserPrincipalName (UPN).

Note 1: Starting from version 6.2.0, this rule supports linked mailboxes. For more details please see Provisioning Linked Mailboxes article.

Note 2: Starting from version 7.3.0, this rule also supports mapping between Active Directory user account and Cloud user account by anchor attributes. For details, please see How to map Active Directory users to Office 365 cloud users article.

When to use this rule

Use this rule if you want to get the report and check the validity of Office 365 licenses assigned to Office 365 user accounts by AD group membership:

During rule configuration, check license options that should be assigned to Office 365 user accounts.
Run the rule and open the created report:
1. If a user has a license option assigned and this option is also checked in the rule, you will see on the value in the report next to the corresponding license option.
2. If a user doesn't have a license option assigned and this option is not checked in the rule, you will see off value in the report next to the corresponding license option.
3. If a user has a license option assigned and this option is not checked in the rule, you will see ON (violation) value in the report next to the corresponding license option.
4. If a user doesn't have a license option assigned and this option is checked in the rule, you will see OFF (violation) value in the report next to the corresponding license option.
5. If a user doesn't have the license plan, specified in the rule, you will see off value in the report next to the corresponding license options.

Note: If you don't select a license plan, this plan will be ignored by the rule and won't be checked. Thus, even the user has this plan assigned, the report would contain off value for every license option in this plan.

Rule configuration:

Specify AD groups list
Specify license options for validation.

Rule Settings

Query Section

Setting name	Description
Include AD Group Members	Specify Distinguished Names of AD groups to validate Office 365 licenses, assigned to these groups' members.
Properties to Display	To display additional Office 365 properties for each object found by the query, add those properties to the list.
Sort by	Sort result objects list.
License options	Select Microsoft Office 365 plans that should be validated for user accounts. In these plans, select and unselect options to compare to the options assigned to the user. Then, report on each selected option. Tip: If user accounts have the assigned license options different from the license options, checked in the rule, you will see Violation mark in the report.
Show Only Objects with Violations	It is possible to display in the report only those user accounts, whose Office 365 licenses plans and options different from those that specified in validation rule.
Stop rule if tenant licensing change detected	It is recommended to stop the rule execution if tenant licensing change discovered. Tip: If licensing change detected, you should click Update License in Microsoft Office 365 extension. For details, see KB20181017-1.
More options
Exclude AD Group Members	Specify AD groups Distinguished Names, which members will be excluded from Office 365 license validation. Tip: Use this setting to exclude some group members from Office 365 license validation. If the group, specified in Include AD Group Members, contains the same members as the group, defined in Exclude AD Group Members, these users Office 365 licenses won't be validated.
Exclude disables users from hybrid mapping	Excluding disabled AD user accounts from the hybrid mapping is possible.
Exclude shared mailboxes	Excluding shared mailboxes is possible.
Maximum number of users	By default, all objects that you have provisioned in Microsoft Office 365 are returned. Tip: It is possible to change the default value in Microsoft Office 365 extension settings.
Initialization Script
Script	Usually, rules use query criteria to limit the query search scope. It improves the performance of the executed rule. Due to PowerShell limitations, it is not possible to use calculated expressions in query criteria. That is the point where the initialization script can help. You can initialize a global variable in this setting and then use it in query criteria. Important: To use a variable, declared in the initialization script, in the query scope, it must be global: $global:<variable name>. Example: Update AD users, created in the last ten days. Add this initialization script: {$global:DatePeriod = (Get-Date).AddDays(-10)} Use $DatePeriod variable in query criteria builder:

Output Section

This section defines the output format of this rule.

To get more information about this section, please see the Output section article.

Enforce/Schedule section

This section defines the schedule for how often to run the rule.

To get more information about this section, please see the Enforce/Schedule section article.

Change History

Version	Notes
7.3.0	The rule supports mapping between Active Directory user account and Cloud user account by anchor attributes.
6.3.1	Exclude shared mailboxes setting is added.
6.2.0	The rule supports linked mailboxes.
5.4.0	The rule was optimized and updated.

Articles in this section

AD Groups | Validate License rule