Managing Users with PowerShell Cmdlets for Office 365

PowerShell cmdlet for Office 365

Managing Users with PowerShell Cmdlets for Office 365

By Vlad Catrinescu | August 03, 2017

Have you ever wondered what IT would be like if there was one clear answer for any given issue? For example, let’s say that your overseas department is dealing with connectivity issues (whether it’s a server or on-prem issue). Imagine how incredible it would be to hit “F5 + Shift + Esc” to solve that issue instantaneously—all without regarding individual configurations and potential setups.

Unfortunately, there will always be an endless number of issues and an even greater number of solutions to address those problems. Similarly, when it comes to managing users on Office 365, there’s no one-size-fits-all strategy.

How Can PowerShell Cmdlets for Office 365 Help?

We’ve all dealt with real-world scenarios that stem from head-scratching questions like, “Is it possible to grant an SPO Admin access to manage O365 Groups without granting them Global Admin Access?” or “How does O365 modern authentication affect user management?

The good news is that regardless all of the questions surrounding Office 365 user management, there can be an all-encompassing approach with PowerShell. In this blog, we’ll discuss a few highly impactful ways to use PowerShell cmdlets to begin managing users on Office 365.

Connecting to Office 365 with PowerShell Cmdlets

If you’re looking to begin managing your users on Office 365, the first thing you’ll have to do is connect to Office 365. You can achieve this by accessing these modules:

Once you have those modules, open PowerShell as an administrator and run the following cmdlet to save your Office 365 login credentials in a variable called $cred:

$cred = Get-Credential

Subsequently, this will open a pop-up window where you will need to enter your Office 365 username and password:

Windows PowerShell credential request

You will then have to import the MSOnline module, which includes all of the PowerShell cmdlets to both connect to Office 365 and manage users in Office 365. To do so, you can use the following cmdlets:

  • Import-Module MSOnline
  • Connect-MsolService -Credential $cred

If you followed these instructions properly, you should now be connected to Office 365! However, if you entered an incorrect password in the credentials dialog, then you may be unable to connect. To bypass this roadblock, simply run the Get-Credential cmdlet again and input the correct username and password.

Viewing All Unlicensed Users with PowerShell Cmdlets

By using PowerShell, you can view all of the unlicensed users within your Office 365 environment who are not licensed. To do so, you must first aggregate a list of all of these users by using the Get-MsolUser cmdlet. This will effectively gather all of the users in your tenant.

Administrator Windows PowerShell window

From here, simply filter those who are licensed. Fortunately, every user has a “IsLicensed” property, which is either “True” or “False.” By refining this selection, you can choose to show only non-licensed users by adding a “Where” clause, as seen below:

Windows PowerShell display name window

Finally, to ensure that the list actually shows the non-licensed users, select the filter to display only the "UserName" and the "IsLicensed" property:

Windows PowerShell IsLicensed window


In the end, the final cmdlet is:  

Get-MsolUser | Where {-Not $_.IsLicensed} | Select UserPrincipalName, isLicensed

After you’ve identified and gathered a list of all of your non-licensed users, how do you follow through with licensing them?

Assigning Licenses with PowerShell Cmdlets

Before assigning licenses, you must first identify the names of the License SKUs within your tenant. You can do this by using the Get-MsolAccountSku cmdlet, as seen below:

PowerShell cmdlets window

The example above shows that I currently have two types of licenses: one for PowerApps and a EnterprisePack (which is an E3 license). In this vein, if you want to assign an E3 license to a user, you must first assign them the globomanticsorg:ENTERPRISEPACK license. One of the unlicensed users in the example shown is “student1@globomantics.org,” so let’s try to assign that user a license.

First, it’s important to relay to Office 365 where that user will be using Office 365 from. You can accomplish this by using the Set-MsolUser cmdlet and specifying the UsageLocation parameter. This parameter accepts a two-letter country code, so CA = Canada, not California!

Set-MsolUser -UserPrincipalName student1@globomantics.org -UsageLocation Ca

From here, you can assign the license to the user with the Set-MsolUser license:

Set-MsolUserLicense -UserPrincipalName "student1@globomantics.org" -AddLicenses "globomanticsorg:EnterprisePack"

PowerShell cmdlets screen

By following these instructions, you should have successfully added an E3 license to a user! However, what happens when you want to assign an E3 license, but exclude certain products from it?

Assigning a Custom License with PowerShell Cmdlets

With PowerShell cmdlets for Office 365, you can assign custom licenses to your users. For example, you can customize a specific license like: “An E3 license excluding Yammer, because the company is not yet ready for it.

To create a custom license, you need to create a new MsolLicenseOption cmdlet and specify a starting point (such as the E3 license) as well as the plans you want it to exclude. In other words: Don’t think of it as “Build Your Own Burger,” but rather, “I Want This Burger, Minus the Tomatoes.” If you want to create a License Option that encapsulates an E3 license without Yammer, you can use the following cmdlet:

$NewSkU = New-MsolLicenseOptions -AccountSkuId globomanticsorg:EnterprisePack -DisabledPlans YAMMER_ENTERPRISE

Then, you will need to assign the License Option to the respective user with this cmdlet:

Set-MsolUserLicense -UserPrincipalName student1@globomantics.org -LicenseOptions $NewSkU

The end result is that your user should be licensed with an E3 license, and Yammer Enterprise should be disabled!

Windows Product Licenses window

Conclusion

While Microsoft has enabled the Office 365 Administrator to access incredible functionalities within the Office 365 Admin Center, the most advanced settings are only available via PowerShell. PowerShell not only enables you to automate certain tasks, but gives you access to settings that may be unique to your organization.

As an “IT expert,” you’ve probably faced issues that you had no idea how to most effectively address. However, by exploring all of the components hidden within Office 365, you can quickly ascend to “IT guru” and ensure that you understand how to approach any number of issues that may come your way.

Reach Out to Metalogix

Still stuck trying to figure out PowerShell cmdlets for Office 365? At Metalogix, we understand that it can be a bit convoluted. It certainly takes time to grow familiar with this toolset, so if you’re looking for some additional support, reach out to our award-winning Help Desk!

Hoping to get an even more advanced user management tool for Office 365? Let Essentials for Office 365 help you streamline control over your administration and security.


Vlad Catrinescu

Vlad is a SharePoint and Office 365 Consultant specializing in SharePoint and SharePoint Online deployments as well as hybrid scenarios. As a Pluralsight Author, Microsoft Certified Trainer and recognized international speaker, Vlad has helped thousands of users and IT Pros across the globe to better understand and to get the most out of SharePoint. Vlad is also a Microsoft Most Valuable Professional (MVP) in SharePoint since 2013 and has his own blog at www.absolute-sharepoint.com and he often shares his knowledge by speaking at local conferences and community events. Vlad also blogs at CMSWire as well as Computerworld and is often featured in other Microsoft sites such as Redmond Channel Partner.

Written By: Vlad Catrinescu

Leave a Comment

Add new comment