Office 365 Cloud App Security Licensing

[TheM365Guy]

Hey guys,

I have a question regarding cloud app security - I know office 365 cloud app security comes with Office 365 E5 - we have just 10 licenses in the tenant - but as I can see - the feature is then available for everybody. Also for my E1 and E3 users. So is there a way to disable this feature? The thing is - I don't want to be sub-licensed. Hope you getting the idea what I mean. 

[#2]

@TheM365Guy 

Yes, you can un-assign (disable) the license app (service) if the app is not assigned at the organization level. For Cloud App Security Licensing, this is user level license, so you can disable for some users and keep the app for other users.

Refer the below post if you looking for the Powershell script.

https://docs.microsoft.com/en-us/microsoft-365/enterprise/disable-access-to-services-with-microsoft-... 

[#3]

@Kevin Morgan 

This is great! Thank you. But one thing confuses me. The Cloud App Security is only on for 5 users - they also have an E5 plan, but yet in the Security center I also see events from users with E1 or E3 plans. Why?

[#4]

@TheM365Guy 

I believe, the license is to restrict or allow admin users from accessing Cloud App Security admin portal. Once your tenant got a license which includes the component Cloud App Security, security alert and events will be automatically logged for all users. Hope to detect threats, we do not need a user-level license.

[#5 · Accepted solution]

Who needs to be licensed for Microsoft Cloud App Security?

Each user must be licensed for Microsoft Cloud App Security to use or benefit from it. For customers who license a subset of users, services enforced at the tenant level are not licensed for the other users. They are not entitled to use or benefit from the service, regardless of whether the service is technically accessible. To be compliant, customers must license any user that they intend to benefit from the service.

More info: https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2NXYO

[#6]

Yes, you can disable the license service if the app is not assigned at the organization level.

[#7]

@boneyfrancis 

This helped me a lot! Thanks!