Articles in this section

See more
Print

Microsoft 365 Groups | Enforce Licenses rule (New)

  • Updated
Follow

Rule description

This rule queries the specified Microsoft 365 group and for each member of this group assigns the selected Microsoft 365 license plans and options.

The rule allows assigning/unassigning required Microsoft 365 licenses to the members of the specified groups and updating applications and services in the licenses that are already assigned. Also, assigned licenses can be ignored or unassigned by setting All other licenses to Ignore or Unassign.

Ignore value means that if a user already has assigned options from this plan, these options will be preserved. If a user doesn't have the options from this plan, these options won't be assigned.

Unassign means that the license itself and all its' apps/services will be unassigned.

 

When to use this rule

These are some typical license assignment scenarios, supplied with the recommendations on an optimal configuration for the rule settings:

  1. Assign Microsoft 365 license to newly created Microsoft 365 user accounts that have not been licensed:

    1. Specify Azure AD Administrative Unit.
    2. Set the Include licensed users to Licenses users only to enforce licenses only to unlicensed users.
    3. Set the User state setting to Show enabled only to exclude Microsoft 365 disabled user accounts.
    4. For the License options setting, select the plan to be assigned and configure its option.
  2. Ensure that all members of the group have a specific license  assigned, and other conflicting plans revoked:
    1. Set Include licensed users to All users.
    2. Set the User state setting to Enabled to exclude Microsoft 365 disabled user accounts.
    3. For the License options setting, select the plan to be assigned and configure its options. Set Unassign setting for conflicting plans. Set Ignore setting for all the other plans.

  3. Add or remove license plan or option in bulk, to all users in the specified scope:

    1. Set  Include licensed users to All users.
    2. Set the User state setting to Enabled to exclude Microsoft 365 disabled user accounts.
    3. For the License options setting, select the plan or option to be assigned. Set Ignore setting for all the other plans.

Rule configuration:

  1. Query section: specify MS365 groups.

  2. Action section: specify license plans and options to enforce Microsoft 365 users. Set Enable or Disable next to license plans and options.  

  3. Select Ignore option next to the plans you want to exclude from the rule execution and preserve its current assignment state on users.

 

Rule Settings

Query Section

Setting name Description

Include  MS365 Group members

Specify cloud-only MS365 Group. 

Tip: Synced groups are not available for selection. If you want to assign the licenses based on synced groups, you need to use another rule: AD Groups | Enforce License rule.

Other Query Settings

  

Properties to Display

To display additional Microsoft 365 properties for each object found by the query, add those properties to the list. 

Sort by

Sort result objects list.
Post-query filter

To hide unwanted data based on criteria, not supported by the target system in the query criteria, set the filtering conditions here.

Example: filter by the found object Distinguished Name.

Tip: For optimal performance, use the Query criteria above to filter objects whenever possible.
Sort by

Sort result objects list.
Maximum number of users

The maximum number of users returned from Microsoft 365 by default is 2000.

Tip: It is possible to change the default value in Microsoft Microsoft 365 extension settings.
MS Graph query condition (OData)

By default, Query criteria are used. But when the MS Graph query condition is specified, it overrides the Query criteria setting.

See this article for examples: How to use Query Builder dialog for Query Criteria and Filter rule settings – Cayosoft Help Center.
Initialization script

 
Script

Usually, rules use query criteria to limit the query search scope. It improves the performance of the executed rule.

Due to PowerShell limitations, it is not possible to use calculated expressions in query criteria. That is the point where the initialization script can help. You can initialize a global variable in this setting and then use it in query criteria.

Important: To use a variable, declared in the initialization script, in the query scope, it must be global: $global:<variable name>.

Example: Update AD users, created in the last ten days.

  1. Add this initialization script:
{$global:DatePeriod = (Get-Date).AddDays(-10)}
  1. Use $DatePeriod variable in query criteria builder:

 

Action Section

Setting name Description

License options

Select which Microsoft 365 licenses and apps/services should be updated for the users:

  1. Assign - license and its apps and services will be assigned to the users.
  2. Assign (partially) - license and some of its apps and services will be assigned to the users.
  3. Update apps - license should be already assigned to the users and only its' apps and services will be updated. If the license is not assigned its apps and services won't be updated for the users.
  4. Unassign - license and its apps and services will be revoked.
  5. Ignore - license and its apps and services won't be taken into consideration. Those users that have this license and its apps and services assigned would preserve them. Those users that don't have this license and its apps and services assigned would preserve that state.

License's apps and services can be set to Enable, Disable or Ignore.

All other licenses settings mean all other licenses that are not specified in License options. They can be ignored or unassigned.

Change UsageLocation only if not set

Specify whether to keep the current user's usage location or change it to a new one.

Usage Location

Select the usage location.

Important: If Microsoft 365 user accounts don't have a location attribute set, Microsoft 36 license won't be applied to them, and the rule will stop with the error.

 

Output Section

This section defines the output format of this rule.

To get more information about this section, please see the Output section article.

 

Enforce/Schedule section

This section defines the schedule for how often to run the rule.

To get more information about this section, please see the Enforce/Schedule section article.

 

Change History

Version Notes
9.1.0 The rule has been added to the product.

 

Related articles

Comments

0 comments

Please sign in to leave a comment.