0 votes

I am having an issue running a powershell script through Adaxes. I am trying to have this run as a business rule when a user has an office365 license assigned to the user. This script disables OneDrive for that user. I am receiving no errors running this on the server (Powershell v4) but receive the error code below. Has anyone attempted to do this before or knows how to get around this error?

Exception setting "DisabledServicePlans": "Cannot convert the "ONEDRIVESTANDARD" value of type "System.String" to type "System.Collections.Generic.List`1[System.String]"."

The code I am running is here. (Note: I did remove the company name and the code providing the PSCreds)

import-module MSOnline
#license and options
Connect-MsolService -Credential $creds 
$optOffice = New-MsolLicenseOptions –AccountSkuId "companyName:OFFICESUBSCRIPTION"
$optoffice.DisabledServicePlans = "ONEDRIVESTANDARD"
 Set-MsolUserLicense -UserPrincipalName %userPrincipalName% -LicenseOptions $optOffice
by (50 points)

1 Answer

0 votes
by (215k points)
selected by
Best answer

Hello,

There are a few issues with your script. First of all, how many Office 365 Tenants do you have? The thing is that Office 365 allows connection to only 1 Office 365 Tenant from 1 process at a time. A single Windows process is not allowed to connect to 2 or more tenants simultaneously. For this purpose, if you have multiple tenants registered, Adaxes needs to connect to the registered Office 365 tenants queuing up requests to a certain specific tenant and reconnecting between tenants from time to time. To reconnect to another tenant, Adaxes uses the Connect-MsolService cmdlet.

In your script, you also use this cmdlet. If you have only 1 tenant registered in Adaxes, this won't make any harm (though this is not necessary since Adaxes is already connected to your tenant via PowerShell remoting), however if you have multiple tenants registered, this will disrupt the whole queue that Adaxes builds to correctly connect to the tenants. This can result in unpredictable results, for which purpose we usually don't recommend using the Connect-MsolService cmdlet in scripts run by Business Rules, Custom Commands and Scheduled Tasks.

Secondly, you are assigning the DisabledServicePlans property of an MsolLicenseOptions object to a single string, however the property requires a string list, not a single string.

Probably, when you setting the property via the PowerShell console, PowerShell v. 4 converts a string into a string list consisting of 1 item. However, in Business Rules, Scheduled Tasks and Custom Commands Adaxes loads PowerShell v. 2.0, which, probably, does not perform such an automatic conversion.

Here's a version of your script that will work if you have only 1 tenant registered in Adaxes:

Import-Module MSOnline

$disabledLicensePlans = @()
$disabledLicensePlans += "ONEDRIVESTANDARD"

$optOffice = New-MsolLicenseOptions –AccountSkuId "companyName:OFFICESUBSCRIPTION" -DisabledPlans $disabledLicensePlans
Set-MsolUserLicense -UserPrincipalName %userPrincipalName% -LicenseOptions $optOffice

A version that will work in an environment with multiple tenants will be a bit more complicated. This version of the script creates a new powershell.exe session as a separate Windows process. Since it is another powershell.exe session, not the one that's created by Adaxes by default, the limit of having only 1 tenant connection does not apply, and connecting to Office 365 in this separate thread won't create issues for Adaxes. However, you need to keep in mind that this workaround has a drawback: if an error occurs while running this script, you won't be able to see the error in Adaxes.

# Get Office 365 Tenant credentials
$office365Cred = $Context.GetOffice365Credential()
$adminName = $office365Cred.Username
$password = $office365Cred.GetNetworkCredential().Password

$scriptBlock = {
    Import-Module MSOnline

    # Connect to Office 365
    $password = ConvertTo-SecureString -AsPlainText -Force -String $password
    $credential = New-Object System.Management.Automation.PsCredential($adminName,$password)

    Connect-MsolService -Credential $credential

    $disabledLicensePlans = @()
    $disabledLicensePlans += "ONEDRIVESTANDARD"

    $optOffice = New-MsolLicenseOptions –AccountSkuId "companyName:OFFICESUBSCRIPTION" -DisabledPlans $disabledLicensePlans
    Set-MsolUserLicense -UserPrincipalName %userPrincipalName% -LicenseOptions $optOffice
}

# Start Windows PowerShell as a separate process and run the script block in that process
$powershellPath = "$env:windir\system32\windowspowershell\v1.0\powershell.exe"
Start-Process $powershellPath -NoNewWindow -ArgumentList ("-ExecutionPolicy Bypass -noninteractive -noprofile `$adminName = '$adminName'; `$password = '$password'; `$objectId = '$objectId'; `$objectLocation = '$objectLocation';" + $scriptBlock )

Pay attention that the script uses the $Context.GetOffice365Credential() method of the built-in $Context variable that allows you to retrieve credentials of an Office 365 tenant associated with a user.

Related questions

0 votes
1 answer

Adaxes is set up to manage two forests. The server that Adaxes is running on is a member of the main corporate forest and we added the other untrusted forest (single ... -add @{info=$grouplist} } $Context.LogMessage("Removed from all groups", "Information")

asked Dec 31, 2012 by jiambor (1.2k points)
0 votes
1 answer

When running a PowerShell script as an action in a custom command, you can set the script to run as a different account and then use the RunAs property in the ... Is there another way to get the Adaxes service account's credentials from within the script?

asked Mar 31 by KelseaIT (320 points)
0 votes
0 answers

I have several windows powershell scripts that work perfectly with AD- however, I can not get these to run as an Adaxes script (Scheduled Task) It is very simple, as ... Rename-Item -Path PDL-Members.csv -NewName PDL-Members_Con1_$(Get-Date -f yyyy_MM_dd).csv

asked Jan 17, 2017 by alextame (70 points)
0 votes
1 answer

Hello, I have been working on a way that will allow us to provision accounts and enable them automatically on their specified start date. I'm using an ... $DisabledUsers) { Set-ADmUser $DisabledUser -Enabled $True -Clear "extensionAttribute2" } Exit Thanks,

asked Jun 14, 2018 by JoCCCsa (100 points)
0 votes
1 answer

Hi, I'm currently facing a problem where I want to set up a powershell script that should report all accounts (enabled, disabled, expired) matching a specific employeeType ... something else, just the plain Info Can you help me with this? kind regards Ingemar

asked Sep 4, 2015 by ijacob (960 points)
2,779 questions
2,512 answers
6,574 comments
26,506 users