How to disable features at a global/license level, without touching individual users?

[Matthew Gudites]

I'm trying to figure out the answer to something that should be an easy question, but I can't seem to find the documentation I'm looking for, and as per usual O365 tier-1 support has been abysmal.

How do we disable a feature either globally, or at the license level? Like for example, what if I want to turn SharePoint off, or, Microsoft Teams, or any of the other features that we don't want our users using? I understand how to auto-license users via Azure, and I've seen the documentation on how to select a bunch of users and update which products they have access to all at once. But, we don't want to have to do this each time we create users. How do I simply tell Office 365 "anyone with xyz type license should only have abc products, PERIOD???" This can't be this difficult...

[#2]

Group-based licensing might be an option? https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-licensing-what...

[#3]

OK so if I'm reading that correctly, I can assign a license (and whatever products I check while making the assignment) to a group, and then anyone who is in that security group will automatically get that "version" of the license with just those products assigned to it?

[#4]

I've looked through the documentation and I still don't see a way to do what I'm trying to do. I successfully created a new AD group and used Azure portal to assign a license to that group, and only the services I want, but then when I add new people to that group, that license doesn't get applied.

Is there a way to create a NEW license altogether, which only contains the products I want in it? 

[#5]

Not every service/feature in O365 is enforcing license requirements, so you cannot rely on this method across the board. Take SPO as an example, every user in the organization can happily browse any sites which are opened to the whole company, regardless of what licenses it has.

You can still use this to limit access to those services that do enforce licensing requirements, and combine it with service-level controls for (some of) the others.

[#6]

Ok, but then if using the "Licensing" feature isn't the way to do it, how do I just turn stuff off? What if I want to disable SharePoint across the board, or Yammer, and so forth?? Where's the "off switch"? When I go to the Admin Center -> Products, the "Products" page just brings up the list of licenses and the products associated with them, with no way to turn a "product" off. 

[#7]

Hey @Matthew Gudites,

This is a problem I had to handle all the time for my clients.

Unfortunately I never found an efficient way to do this in bulk/automatically. I will give you the two options I presented to my clients, and it was up to them to choose.

1. A simple PowerShell script can do this, and in a way you are creating a "New License" like you say. This blog post does a great job of showing the steps to create a new variable that has the options you may want step by step - https://exitcodezero.wordpress.com/2013/03/14/how-to-assign-selective-office-365-license-options/

Lets say I create the Variable $license = New-MsolLicenseOptions -AccountSkuId TenantName:ENTERPRISEPACK -DisabledPlans RMS_S_ENTERPRISE, MCOSTANDARD, SHAREPOINTENTERPRISE

I would then just need to loop through all my users, and assign the license. If you have just one type this is easy:
Get-MsolUser -All | where {$_.isLicensed -eq $true} | Set-MsolUserLicense -UserPrincipalName user@domain.com -AddLicenses TenantName:ENTERPRISEPACK -LicenseOptions $license

If it was a subset of users, you would just need to modify your where statement to filter further.

I would just give them a script that did this, and have them run it once a week.

2. I would recommend they build the assignment into their user creation process, through either manually selecting the options to enable in the GUI, or through a similar PS command.

Hope this helps!
Adam

[#8]

As I said, it depends on the service. In general, Microsoft's mantra is "enabled by default" and unfortunately not all services can be toggled. SPO is one such example, if you really must disable it, you can use the Conditional access controls, or toggle the IP-based restrictions in the SPO/ODFB admin center.

[#9]

Adam, that's cool -- similar to the autolicense script we're already using, but I guess I didn't realize you could also specify products as part of it. I will work on tweaking what we've got, using some of the parameters I'm seeing in that article. Thanks!!

[#10]

Another question I have is, regarding some of these features -- I don't understand why I would want students to have these? Why would Microsoft think that a student should have "Azure Active Directory Basic" or "Azure Rights Management?"