Assign selective license in Office 365 using Powershell - "Unable to assign this license ..."

[Zeff Wheelock]

I am trying to remove some services from users.  I have the following script:

$ApprovedPlans="EXCHANGE_S_ENTERPRISE","SHAREPOINTENTERPRISE","SHAREPOINTWAC","MCOSTANDARD","OFFICESUBSCRIPTION","RMS_S_ENTERPRISE","YAMMER_ENTERPRISE"
$AccountSkuID = (Get-MsolAccountSku).AccountSkuID
$AvailablePlans = (Get-MsolAccountSku).ServiceStatus.ServicePlan.ServiceName
$DisabledPlans = @()
Foreach ($Plan in $AvailablePlans) {if ($ApprovedPlans -notcontains $Plan) {$DisabledPlans+=$Plan}}
$LicenseOptions=New-MsolLicenseOptions -AccountSkuId $AccountSkuID[0] -DisabledPlans $DisabledPlans
$Exceptions="name1@domain.com","name2@domain.com"
$AllUsers=Get-MSOLUser -all | where {$_.IsLicensed -eq "True"} | sort DisplayName
$Count = 0
Foreach ($User in $AllUsers)
{
[String]$UPN = $User.UserPrincipalName
$Count = $Count + 1
$Processing="Processing " + $Count + " of " + $AllUsers.Count + "..." + $UPN
Write-Host -NoNewline $Processing.padright(($host.ui.rawui.windowsize.width)-2)"`r"
if (Get-ADUser -f {UserPrincipalName -eq $UPN} -SearchBase "OU=Users,DC=XXXXXX,DC=DOMAIN,DC=COM")
{
if ($Exceptions -notcontains $UPN) {Set-MsolUserLicense -UserPrincipalName $UPN -LicenseOptions $LicenseOptions}
}
}
Write-Host ""
Write-Host -NoNewline "Disconnecting From MSOLService".PadRight(38,".")
Get-PSSession | Remove-PSSession
Write-Host "Done."

I have tried to remove license (set-MSOLUserLicense -UserPrincipalName $UPN -RemoveLicense $AccountSKUID[0] (the license does get removed)) and then add it using the above and I get the same error. What am I missing here? Thanks!

Zeff

[#2]

You should be covering two scenarios:

1) The user already has the same license applied, so only provide the LicenseOptions

2) The user does not have this license applied, so provide both the SKU and License options

And of course the LicenseOptions should match the SKU set, which you have hardcoded to $AccountSkuID[0]. Not every licensed user might have this same SKU assigned, make sure you check for that.

[#3]

So, instead of having:

$LicenseOptions=New-MsolLicenseOptions -AccountSkuId $AccountSkuID[0] -DisabledPlans $DisabledPlans

I should put:

$LicenseOptions=New-MsolLicenseOptions -DisabledPlans $DisabledPlans

?

Zeff

[#4]

No, simply make sure that the SKU you use to build the LicenseOptions variable is indeed assigned to the user. For example, you can adjust your filter to get only users with said SKU:

Get-MsolUser | ? {$_.Licenses.AccountSkuId -eq "tenant:EMS"}

or whichever SKU corresponds to $AccountSkuID[0] in your tenant.

[#5]

OK, I changed the $AllUsers line to read:

$AllUsers=Get-MSOLUser -all | ? {$_.Licenses.AccountSkuId -eq "tenant:ENTERPRISEPACK"} | sort DisplayName

and this line:

$LicenseOptions=New-MsolLicenseOptions -AccountSkuId "tenant:ENTERPRISEPACK" -DisabledPlans $DisabledPlans

Got the same error:

Set-MsolUserLicense : Unable to assign this license because the license options are invalid.
At O:\office365\SetLicenses.ps1:57 char:45
+ ... ains $UPN) {Set-MsolUserLicense -UserPrincipalName $UPN -LicenseOptio ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OperationStopped: (:) [Set-MsolUserLicense], MicrosoftOnlineException
+ FullyQualifiedErrorId : Microsoft.Online.Administration.Automation.InvalidUserLicenseOptionException,Microsoft.O
nline.Administration.Automation.SetUserLicense

[#6]

Again, how many SKUs do you have in your tenant? When you do this:

$AccountSkuID = (Get-MsolAccountSku).AccountSkuID
$AvailablePlans = (Get-MsolAccountSku).ServiceStatus.ServicePlan.ServiceName

you get a combined set of SKUs/ServicePlans, which you then use to set up the license options. This can end up with an incompatible combination. For example, in my tenant it results in this:

PS C:\> $LicenseOptions.AccountSkuId

ExtensionData AccountName SkuPartNumber            
------------- ----------- -------------            
              michev      POWERAPPS_INDIVIDUAL_USER



PS C:\> $LicenseOptions.DisabledServicePlans
POWERVIDEOSFREE
POWERFLOWSFREE
POWERAPPSFREE
EXCHANGE_S_FOUNDATION
BI_AZURE_P2
Deskless
FLOW_O365_P2
POWERAPPS_O365_P2
TEAMS1
PROJECTWORKMANAGEMENT
SWAY
INTUNE_O365
EXCHANGE_S_FOUNDATION
BI_AZURE_P0
RMS_S_PREMIUM
INTUNE_A
AAD_PREMIUM
MFA_PREMIUM

which is invalid. Either set it to the specific (enterprise?) SKU you want to configure, or do a proper cycle that covers each individual SKU and disables services accordingly.

[#7]

DOH!  Now that makes sense!  We have two SKUs, PowerApps and ENTERPRISEPACK.  I made the following change:

$AvailablePlans = (Get-MsolAccountSku)[0].ServiceStatus.ServicePlan.ServiceName

Now I am getting the correct information! Thank you very much.  It was driving me crazy.