SOLVED

The announcement regarding self-service purchase capabilities for Power Platform products??

Bronze Contributor

Just found this in the message center: " Self-service purchase capabilities for Power Platform products will be available for commercial cloud customers starting 11/19. Today, individuals within your organization are unable to purchase subscriptions or assign licenses for themselves or their departments without contacting you, their admin. Based on customer demand, we’ll soon be enabling self-service purchase and license management capabilities, which will allow users within your organization to purchase products directly, starting with the Power Platform family of products: Power BI, PowerApps, and Flow."

 

Does anyone have more info on this? Does this mean that end users willing to pay for a license will be able to connect company data to other sources and bypass their admins altogether? I'm finding this to be a bit insane - would love to hear other feedback. @adam deltinger   @Chris Webb adding you both to this as you always provide great insights. Thanks in advance!

64 Replies

@Tony Redmond 

 

You are correct, Microsoft is in this business to make money, and they are good at it. (I had an Identity PFE tell me that once) But, what is upsetting to me is that Microsoft made this announcement, out of the blue, and there is no way for admins to say no, we do not wish for this feature to be enabled.

 

Microsoft does listen to its customers and they are doing their best to answer and solve all issues and requests. Kudos to them, but, normally, Microsoft has always had a way for Admins to stop the new features from coming and this time there is no option.

 

I think that you are right in your assessment, Microsoft's view on this is a bit skewed and might need to revisit this topic. I think they will eventually see the error of their ways (or at least the people who requested this feature) and things will be reversed or at least give us the ability to disable this feature.

@ahayes no. Not Microsoft. If I don’t agree I must be MS?
I enjoy environments where users are trusted and not held back by legacy IT systems or worse, IT admins that are stuck in a comfortable environment not wanting to progress with new technologies.
Yes IT need to control these but if your user wants to use power BI at the moment he will sign up to a new tenant, one that you know nothing about and import your data. With the changes yes he spins up a new instance but under your tenant with you having visibility and the option to pull into your volume agreement. I see that as the best option allowing for better control of that environment.
Just my humble opinion though and yes having the ability to turn it off I think would be a good idea as allowing admins the choice is always the best way.
So admins who try to oblige to enterprise procedures are "baddies" and those who leak corporate data to uncontrolled/unsecure side tenant are "progressive" ones :) If they do this, they should be fired, they probably brake lots of compliance rules that not even IT enforce in the first place (like GDPR and so on). They will be a reason of million dollars fines. And they won't be satisfied with Power BI and at some point import your data to some other who knows what 3d party system. And what if you are not in charge of the finances and will have to explain to higher execs how come you can't control these not planned expenses. Which will probably grow exponentially once the users see that they can do whatever they want. Unless companies create policies to charge such unsanctioned subscriptions from their salaries. But as some have mentioned already, such policies and accommodating takes time and this change is too sudden. Heck, their promise private channels in Teams for years and yet they release this a few weeks after the announcement. Bad priorities..
I have 62 tenant accounts under management (all separate business entities)
For each I have to justify and manage functional access, enterprise policy and expenditure
Without the ability to control how users access these elements I will not be able to migrate future business to Microsoft (and at renewal will need to move the existing away )

As I have commented earlier, for those businesses seeing this development as advantageous and desirable , they should certainly have this option available
However , this is a “deal breaker” for my existing and potential new clients
I have neither the time nor inclination to spend hours unnecessarily (and unpaid)
With powershell scripts to enforce and monitor compliance, where a simple option
To allow or disallow “features” is not made available
Microsoft this is not the way to develop your business
best response confirmed by Michael Curnutt (Microsoft)
Solution

At Microsoft, we’ve been listening to all of the feedback regarding the rollout of our self-service purchase capabilities for Power Platform products.  To those of you who provided your input, thank you!  Based on your feedback, we’ve adjusted our approach to better address the needs of both IT admins and end users within organizations.  We’re making the following changes to our plan:

 

  • On November 19th, we will provide IT admins a way to turn off self-service purchasing on a per product basis via PowerShell.  
  • To provide more time to prepare for this change, we are updating the launch for self-service purchase capabilities for Power Platform products to start with Power BI on January 14th for all commercial cloud customers. 

You can find more details about self-service purchase at the Self-service purchase FAQ.  Thank you again for taking the time to provide your feedback. We look forward to a continued partnership to help empower all organizations to achieve more.

@Matthew Kotler While it's nice when Microsoft takes user feedback seriously and withdraws from a position that embarrassed the company, it would be so much better if some folks in Redmond asked people in the field before making assumptions that Office 365 tenants would like this sort of thing.

They listened - https://docs.microsoft.com/en-us/microsoft-365/commerce/subscriptions/self-service-purchase-faq

 

  • On November 19th, we will provide IT admins a way to turn off self-service purchasing on a per product basis via PowerShell. More details will be forthcoming.
  • To provide more time to prepare for this change, we are updating the launch for self-service purchase capabilities for Power Platform products to start with Power BI on January 14th for all commercial cloud customers.

@Kelly_Edinger  we're annoyed when Microsoft announced this feature. Now, We're glad to know that Microsoft updated policy to control self service. Thank you Microsoft.

Hi @Kelly_Edinger, With an environment strategy in place, couldn't the risk of data loss/misuse be significantly mitigated? (refer PowerApps Blog about creating an environment strategy) When you have the underlying structures and governance in place, if a maker can only design and make in an environment they have been granted access to through an AAD security group, would this self-service of licenses continue to be a big issue?

Hi @Robyn Eisler - yes that could help mitigate. Happy that Microsoft reversed their stance on this, but my two main issues were: 1. The 1st time we heard about it was a quiet post to the message center, not a major announcement 2. most IT depts are not ready - they're still trying to keep up with all the changes in O365 in general.

Even with proper data governance this will persist to be a HUGE issue for orgs that have procurement requirements, not to mention that this is the commoditization of shadow IT (no if and or buts about it) which IT will eventually have to support/manage.

Microsoft heard the voice of the community and released a dedicated PowerShell module 'MSCommerce' to manage Office 365 Self-service Purchase.

 

https://blog.admindroid.com/block-self-service-purchase-for-power-platform-products-using-powershell...

 

If you have decided to turn-off self-service purchase for your organization, then you shall disable it now.

 

I'm unable to Connect to MSCommerce. I installed the module (no errors), I import the module (no messages or errors). When I run Connect-MSCommerce I get this error:

 

New-Object : Cannot find type [Microsoft.IdentityModel.Clients.ActiveDirectory.PlatformParameters]: verify that the assembly containing this type is loaded.
At C:\Program Files\WindowsPowerShell\Modules\MSCommerce\1.2\MSCommerce.psm1:91 char:21
+ ... ormParams = New-Object "Microsoft.IdentityModel.Clients.ActiveDirecto ...

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidType: (:) [New-Object], PSArgumentException
+ FullyQualifiedErrorId : TypeNotFound,Microsoft.PowerShell.Commands.NewObjectCommand

 

Cannot find an overload for "AcquireTokenAsync" and the argument count: "4".
At C:\Program Files\WindowsPowerShell\Modules\MSCommerce\1.2\MSCommerce.psm1:93 char:3
+ $token = $authCtx.AcquireTokenAsync($Resource, $ClientId, $Redirect ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [], MethodException
+ FullyQualifiedErrorId : MethodCountCouldNotFindBest

 

Connect-MSCommerce : Unable to establish connection
At line:1 char:1
+ Connect-MSCommerce
+ ~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorException
+ FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Connect-MSCommerce

 

Thoughts?

@Alex Carlock  Did you happen to try to connect during the outage from Microsoft? That could have been the issue.

 

I was able to connect and see all of the Power Pack Applications set to allow to be purchased.

@Shaun Jennings I just tried it today and again a couple of minutes ago.  Do you know if there are dependancies on other modules like AzureAD?  I have AzureADPreview version 2.0.2.62 installed.  If I connect to that first, and then run connect-MSCommerce the "New-Object : Cannot find type" error goes away, but I still have the errors starting from "Cannot find an overload".

 

@Alex Carlock  No, I have not seen any dependencies. It was just as easy as Install-Module, Import-Module, Connect-MSCommerce. 

 

I am running PSVersion 5.1.18362.145

 

I even tried it on PS 7 Preview and it worked.

@Alex CarlockAre you trying from Windows 10? or if you are in proxy network, then try configuring proxy in your active PowerShell session.

Not to much to add, but I want to track this issue, so I continue to document it here:

 

Microsoft Releases Control for Self-Service Purchases in Office 365 Tenants

The prospect of allowing user-controlled purchases of Power Platform apps in an Office 365 tenant maddened many administrators. Microsoft promised to release a method to allow administrators control self-service purchases in a tenant. The MSCommerce PowerShell module is now available. Here’s how to use it to disable self-service purchases.

https://office365itpros.com/2019/11/20/microsoft-releases-control-self-service-purchases/

 

@Robert Luck It's Windows 10 and there's no Proxy involved.  I just tested on another system and it works fine there.  At least I can make progress, but I'm still not sure why it's not working on my primary system.