Unable to assign Exchange Online Advanced Threat Protection trial licenses to users?

[Jim Williams]

I've had three support cases with Office 365 support, but I still can't get an answer on this so thought somebody here might be able to help.

We are a school and have Office 365 A1 for students and faculty, along with Office 365 A1 Plus (which adds ProPlus). The majority of our users are assigned A1 plus licenses. 

I've activated the free trial of ATP for faculty so that I can understand how it works. The trial comes with 25 user licenses, but I can't assign any of those licenses to users? For users with A1 plus licenses, under product licenses, it states that it can't be used without Office 365 A1 for faculty.

However, if I try the same process with a user who does have Offce 365 A1 license (not Plus), there is no option to assign the license?

The ATP safe attachments and ATP safe links policies are both showing in the Threat Management section of Security & Compliance, and I can edit the policies and assign to individual mailboxes (for testing at this stage) and that's working correctly.

Can someone explain where I go from here? This suggest that I could purchase a single ATP license and then apply policies for all my users? What do the 25 licenses in the trial refer to, and how to I assign them to users? There is even a link in the subscription information to 'Assign to users', but that just takes you to the process I've already tried.

Many thanks for reading and, hopefully, replying.

[#2]

My understanding is that ATP works as soon as licenses exist, whether they're assigned or not. To be license compliant you need to have enough licenses for all your users who have ATP policies scoped to them.

Disclaimer: this is a licensing question, so you're best bet is to contact your account manager for advice.

[#3]

Thanks. That's what I thought. But I came across a article - Advanced Threat Protection Notes from the Field and it shows a screenshot of a license being assigned to a user?

[#4]

Sure, that's my article.

What I can say is that assigning licenses to users as I demo in that article isn't harmful, and works just fine when the user is licensed with SKUs such as Business Premium and E3. ATP also works when licenses aren't assigned, or you have fewer licenses than you technically require.

I have no access to tenants with the type of licenses you have, so no way to look into any quirks in that scenario.

[#5]

Does this mean that when you enable ATP for even one user in a tenant, it's turned on for everyone? 

We want to compare ATP to our current mail hygiene tool and planned to shut off the other tool for the people we enable ATP for while leaving the other service in place for everyone else.

[#6]

No, because you scope your ATP policies to specific domains or recipients. But you could scope it to all domains/recipients if you wanted to.

[#7]

Hi , did you ever resolve this?

We have the same, we are unsure if our ATP is applied or not

[#8]

We assigned ATP policies for safe attachments and safe links to specified domains, rather than our whole tenant.

[#9]

Hi Guys,

We are having the same issue here as well. We have bought ATP for Faculty and they are not showing up in Portal. They are showing up under ATP_ENTERPRISE_FACULTY in Powershell but when trying to assign the licenses to a user, it says ''Set-MsolUserLicense : Unable to assign this license because it is invalid. Use the Get-MsolAccountSku cmdlet to retrieve a list of valid licenses.'' 

Any help would be appreciated!

Thanks

[#10]

Hi, Did you ever manage to get to the bottom of this issue. Experiencing exactly the same thing with ATP_ENTERPRISE_FACULTY. 

This process really does not make any sense compared to the way all other licensing works. 

[#11]

Nope, I just buy the licences and hope for the best

It does look like they are active if i look in security center as I can see things getting caught by ATP

[#12]

Just experienced the same thing at a customers. They are visible through powershell but not in the portal. We understand that we don't need to assign them. But we should be able to follow-up our license count through the portal.

Any one ever found a fix for this?

[#13]

@Jim Williams 

I manage multiple O365 tenants and only experience this issue with my A1 EDU tenants.  With all of the other E3 or Business Standard tenants the ATP licenses show up in the portal and can be assigned to individual users.  If A1 tenants don't need to individually assign ATP licenses, I'd hope that Microsoft would document this somewhere properly.