Office 365 - PowerShell Script To Disable Specific License Services

This is my first blog. To introduce myself, I have over 13 years of experience in a messaging environment and have automated my tasks using PowerShell.

Being an Office365 Admin, you might have entered into a difficult situation where Microsoft has rolled out new license features, like (Todo, TEAMS, Staffhub, Flow....etc.) in E1, E3, E4, or E5. And, your IT security team wants to disable this feature license for all the users immediately. This script will help you to disable that specific license without impacting other licenses.

The following script will help you to disable a specific service plan from each license.

Let me explain the script.

$Users = Import-Csv .\Users.csv

The above line gets the input from the CSV file, updates the path of the CSV file where the CSV file is located and make "users.csv" your input file. Have the header called "Email" and the header value will be Userprincipalname.

$ldo += “BPOS_S_TODO_2”,"STREAM_O365_E3"

This line is the important one. Mention the service plan you want to disable. For each license service plan, the Name will differ.

You can get the service plan by executing the below cmdlet.

$t = Get-MsolUser -UserPrincipalName <UPN>
$t.Licenses[0].servicestatus
if($ld.AccountSkuId -eq “<AccountSkuId>”)

You need to specify the AccountSKUID. You will find the accountskuid by running the below cmdlet.

Get-MsolAccountSKU Cmdlet in Azure Msol

At the end, the script will give you the following output logs.

Powershell transcript file. <Transcript-DD-MM-YYYY-T>

License before disabling. <Disable_LicensePlan_Before-DD-MM-YYYY-T>

License after disabling <Disable_LicensePlan_After-DD-MM-YYYY-T>

Script

#Variable declaration
$Global: Eventlog = @()
$Global: Eventlog1 = @()
$Logfiles = @()
$currentUser = [Environment]::UserName
$TimeStamp = get - date - uformat "%d-%m-%Y-%T"
$Logfilename = "Disable_LicensePlan_Before-$($TimeStamp.Replace(": ",$null)).csv"
$Logfilename1 = "Disable_LicensePlan_After-$($TimeStamp.Replace(": ",$null)).csv"
$Trans = "Transcript-$($TimeStamp.Replace(": ",$null)).txt"
Start - Transcript - Path ".\$trans"###
Funtion
for Logs
Function Logwrite([String] $UPN, [String] $Loginfo) {
$Emailaddress = $UPN
$Loginformation = $Loginfo
$Admin = [Environment]::UserName
$Logstatus = $Status
# Write - host
$Status
$TimeStamp = get - date - uformat "%d-%m-%Y-%T"
$Logs = New - Object PsObject
$Logs | add - member - membertype NoteProperty - name "TimeStamp" - value $TimeStamp
$Logs | add - member - membertype NoteProperty - name "UserprincipalName" - value $Emailaddress
$Logs | add - member - membertype NoteProperty - name "Log Information" - value $Loginfo
$Logs | add - member - membertype NoteProperty - name "Script Executedby" - value $currentUser
$Logfiles += $logs
Return $Logfiles
}
$Users = Import - Csv.\Users.csv
Foreach($act in $users) {
$upn = $act.Email
# current licenses(this pulls the top level, like Office 365 Enterprise, Project Online etc.$Lic = Get - MsolUser - UserPrincipalName $upn - ErrorAction 0 If($Lic.UserPrincipalName - notlike $null) {
$ouserlicense = $Lic.Licenses | Select - Object - ExpandProperty ServiceStatus
$EnabledServices_Before = ($ouserlicense | Where - Object - Property ProvisioningStatus - EQ "Success").ServicePlan.ServiceName
$DisablededServices_Before = ($ouserlicense | Where - Object - Property ProvisioningStatus - EQ "Disabled").ServicePlan.ServiceName
$CurrentLic = $Lic.Licenses.AccountSkuId
$Log1 = Logwrite "$upn"
"Current Enabled Plan: $CurrentLic : $EnabledServices_Before"
$Global: Eventlog += $Log1
$Log2 = Logwrite "$upn"
"Current Disabled Plan:$CurrentLic : $DisablededServices_Before"
$Global: Eventlog += $Log2
$licensedetails = (Get - MsolUser - UserPrincipalName $upn).Licenses
#Using an array to pull all of my disabled plans together– and start with the new one I want to disable
$ldo = @()
$tmp = @()
$ldo_Disable
# = @()
$DisabledServicesNew = @()
<
#You can add the service name you want to disable below.,
if you want to add mulitple service add each service separated by comma line below“ SWAY”, "FLOW_O365_P1", "POWERAPPS_O365_P1", "TEAMS1", "Deskless"
Following are the service plan you can see in E3 Subscription.
ServicePlan Description
-- -- -- -- -- - -- -- -- -- -- -- -- -- - MYANALYTICS_P2 MyAnalytics
BPOS_S_TODO_2 TODO
FORMS_PLAN_E3 Forms
STREAM_O365_E3 Stream
Deskless Staff Hub
FLOW_O365_P2 Flow
POWERAPPS_O365_P2 PowerApps
TEAMS1 Teams
PROJECTWORKMANAGEMENT Microsoft Planner
SWAY Sway
INTUNE_O365 Intune MDM
YAMMER_ENTERPRISE YAMMER
RMS_S_ENTERPRISE Azure Rights Management
OFFICESUBSCRIPTION Office Proplus
MCOSTANDARD Skype
for Business
SHAREPOINTWAC Office Online
SHAREPOINTENTERPRISE SharePoint Online
EXCHANGE_S_ENTERPRISE Exchange Online
# > $ldo += “BPOS_S_TODO_2”, "STREAM_O365_E3"
$ldo_Disable = $ldo
$Log1 = Logwrite "$upn"
"Selected plan to disable: $ldo"
$Global: Eventlog += $Log1
$licensedetails.Count;
#Making sure there are some licenses
if ($licensedetails.Count - gt 0) {
foreach($ld in $licensedetails) {
#AccountSkuId = Provide the AccountSKUid
for License E1 / E3 / E5 etc.
#You can get AccountSkuid using Get - MsolAccountSKU Cmdlet in Azure Msol.
if($ld.AccountSkuId - eq“ < AccountSkuId > ”) {
$UPN
$CurrentLic
$ld.ServiceStatus
foreach($lds in $ld.ServiceStatus) {
if ($lds.ProvisioningStatus - like“ Success”) {
#looking for ones that are already Enabled and adding them to my array
$Temp1 = $lds.ServicePlan.ServiceName.ToString()
$ldo_Success = $ldo + $Temp1
}
if ($lds.ProvisioningStatus - like“ Disabled”) {
#looking for ones that are already disabled and adding them to my array
$temp2 = $lds.ServicePlan.ServiceName.ToString()
$temp2
Foreach($l in $ldo) {
#$l
If($l - eq $temp2) {
$AlreadyDisabled = $l
Write - host "Plan already Disabled $l"
}
}
if ($AlreadyDisabled - eq $temp2) {
#Write - host "Plan already Disabled $l"
}
Else {
$tmp = $tmp + $temp2
}
}
}
$ldo_Disable = $ldo + $tmp
$ldo_Disable
$tmp = $null
Write - host "Following Plan will be disabled $ldo_Disable for $upn"
#then create a new license option– and set the DisabledPlans to my array– Planner plus the others it finds
Try {
$LO = New - MsolLicenseOptions - AccountSkuId“ AccountSKUID” - DisabledPlans $ldo_Disable
Set - MsolUserLicense - UserPrincipalName $upn - LicenseOptions $LO - Erroraction Stop
}
Catch {
$ErrorMessage = $_.Exception.Message
Write - host "ERROR: $ErrorMessage" - Foreground red
$Log = Logwrite "$upn"
"ERROR occured during execution $ErrorMessage"
$Global: Eventlog += $Log
Break
}
$ldo_Disable = $null
}
Else {
Write - host "Error: The account $upn User License deosn't Match with AccountSKUID" - Foreground red
$Log = Logwrite "$upn"
"ERROR: The User License deosn't Match with AccountSKUID"
$Global: Eventlog += $Log
}
}
}
$Lic = Get - MsolUser - UserPrincipalName $upn
$ouserlicense = $Lic.Licenses | Select - Object - ExpandProperty ServiceStatus
$EnabledServices = ($ouserlicense | Where - Object - Property ProvisioningStatus - EQ "Success").ServicePlan.ServiceName
$DisablededServices = ($ouserlicense | Where - Object - Property ProvisioningStatus - EQ "Disabled").ServicePlan.ServiceName
$Log2 = Logwrite "$upn"
"Enabled Plan Post Change $CurrentLic :$EnabledServices"
$Global: Eventlog1 += $Log2
$Log3 = Logwrite "$upn"
"Disabled Plan Post Change $CurrentLic : $DisablededServices"
$Global: Eventlog1 += $Log3
}
Else {
Write - host "The account $upn deosn't exist in cloud" - Foreground red
$Log3 = Logwrite "$upn"
"The account deosn't exist in cloud"
$Global: Eventlog += $Log3
}
}
If($Global: Eventlog1 - ne $null) {
$Global: Eventlog1 | Export - csv.\$Logfilename1 - notype
}
If($Global: Eventlog - ne $null) {
$Global: Eventlog | Export - csv.\$Logfilename - notype
}
Stop - Transcript