Assign O365 license using group membership (with availability checks)

Question

I am struggling with following task:

• lets say I have group "license_E3"
• before user or group is allowed to be added to this group, check whether there is enough free E3 licenses
  • if it is, add such member and assign the license
  • if it isn't, show error message
• if member is removed from this group, remove its E3 license too

Make the solution generic so it can be scalable for several "license_XXX" groups.

I've read following articles but still I am unsure how to do this task the right way.

https://www.adaxes.com/help/AutomaticallyAssignOffice365Licenses/ https://www.adaxes.com/help/AddUsersToGroupsByDepartment/ https://www.adaxes.com/script-repository/assign-office-365-license-based-on-availability-s472.htm

Thanks in advance

Comments

Hello,

before user or group is allowed to be added to this group, check whether there is enough free E3 licenses

In case of adding a single user to a group, it is obvious that you need to check that there is at least one available license. But what should be checked when a group is added to a group?

Make the solution generic so it can be scalable for several "license_XXX" groups.

What exactly do you mean? Do you have groups named after Microsoft 365 licenses? Pay attention, that only SKU part numbers can be used to check/assign licenses.

For your information, Microsoft 365 has a group-based licensing feature which does exactly what you described. The following article should be helpful: https://learn.microsoft.com/en-us/azure/active-directory/enterprise-users/licensing-groups-assign.

---

In case of adding a single user to a group, it is obvious that you need to check that there is at least one available license. But what should be checked when a group is added to a group?

That there is enough licenses for every group member. Ideally skip disabled ones and such that already has such license (thanks to membership in other already added group etc).

What exactly do you mean? Do you have groups named after Microsoft 365 licenses? Pay attention, that only SKU part numbers can be used to check/assign licenses.

I meant I want solution that will use one (or as few as possible) custom rule (or whatever) that will accept parameters aka it will be possible to use one rule for all those "licensing groups". So the maintenance of such solution will be easy and it will be easily understandable.

I am really looking for the logic how to set this up, more than the scripts. Aka create business rule, scope it to xyz, create custom command with following parameters and attach it to the business rule etc.

For your information, Microsoft 365 has a group-based licensing feature which does exactly what you described. The following article should be helpful: https://learn.microsoft.com/en-us/azure/active-directory/enterprise-users/licensing-groups-assign.

Yes I know, but I want have mentioned pre-checks that will warn user that there is not enough licenses aka he wont be able to add new members to "licensing group" before needed licenses will be purchased.

Answer 1

Hello,

Thank you for all the provided details. The easiest way to configure such a workflow is as follows:

• Enable group-based licensing in Microsoft 365.
• Add the SKU part numbers of the corresponding Microsoft 365 licenses to an attribute of the corresponding groups. For example, you can use an Adaxes custom sttribute, CustomAttributeText1.
• Create a business rule triggering After adding a member to a group and add the licensing groups to the Activity Scope of the rule. In the rule, there will be a script checking the license count and either do nothing or cancel the operation.
• There will be no need to do for the removing members part as it will be automatically handled by Microsoft 365.

Comments

Hello, nice idea but there is one reason why we don't want to use Azure group-based licensing in Microsoft 365. If you try to add (using group membership) license plan with conflicting sub-license it will cause an error and the license won't be added. We want to make sure this won't happen therefore pure adaxes way is I believe better? Do you solve this kind of issues or it must be scripted. And if so, can you please provide such script that will add license plan without conflicting sub-licenses.

Thanks in advance

---

Hello,

The license assignment can only be done using scripts. As we understand, you mean that the Microsoft 365 licenses already assigned to a user might have services that will conflict with the license being assigned by the workflow. If that is correct, that is not something you can check using scripts. The actual check is performed on the side of Microsoft 365.