Forum Discussion
dmarquesgn
Jan 10, 2023Iron Contributor
Find who assigned licenses to users
Hi, I need to get a report of who is assigning licenses to users. We're using AAD groups to manage licensing, but a lot of licensing is done directly and we need to find that. I've tried to searc...
dmarquesgn
Jan 10, 2023Iron Contributor
Hi,
Thanks for the feedback. Well, based on the link you posted, I made 3 types of tests, but still trying to figure out how to extract the information I need.
1st - I went to compliance.microsoft.com and created an audit search for the activities
"Change user license" and "Update User", for my user. As a result I can see 3 "Update User" activities and 1 "Change user license" activity. When I open each activity to see it's details, I can see the basic data, and some JSON values on "ExtendedProperties", "ModifiedProperties", "Actor" and "Target". I would say that the values that would of interest (the license that was issued) should be on "ModifiedProperties", but that field is always empty. Also, I cannot see PowerBI anywhere.
2nd - I found a nice script here: https://office365itpros.com/2022/10/14/azure-ad-license-assignment-report/ for my purpose. I run the script, but the results are a bit inconsistent and in the end the column that should display the license is empty. Screenshot attached.
3rd - I went to AzureAD, to my user and to Audit Logs. I can see the same 3 "Update User" activities and 1 "Change user license" activity. In this case the "Update user" activity has some populated fields on "Additional Details", on a field named "b", with a lot of information. I can see the text "PowerBI" there, but I don't know how to parse this information. Screenshot attached.
So my conclusion is that only on Azure AD I have the correct information. Do you know how to parse this information?
Thanks
Thanks
VasilMichev
Jan 11, 2023MVP
Modified Properties should contain the AssignedLicenses blob and its values before and after the changes. If you want to do a search, use the SKU GUID, not the name.
- dmarquesgnJan 11, 2023Iron ContributorYou mean "Modified Properties" in what of the above scenarios? 1st, 2nd or 3rd?