Microsoft Licenses#

Overview#

Automate can be used to assign, modify, and remove Microsoft user licenses.

To allow Automate to manage Microsoft user licenses, you will need to enable the following setting in the site’s site defaults (MS Teams tab): Manage Licenses and Allow User Staging

When Automate is enabled for license management:

  • Admins can use Quick user to optionally configure the correct licensing and MS Teams configuration when onboarding new users.

  • Microsoft license data can be synced in to Automate from the Microsoft cloud, and specified in the Quick Add Group (QAG) configuration templates as part of the provisioning workflow.

Important

If Enable Microsoft User License Enforcement is set to Yes in the Global Settings, a user can only be added if the license allocation limit for the user’s hierarchy is not exceeded. For details, see Microsoft license management and alerting in the Core Feature Guide.

Users are placed in staging (an unsaved state) while license data is synced in to Automate. A licensed user may be assigned with a line and available number in Automate.

Targeted syncs may be scheduled from Automate to poll the Microsoft cloud for changes at regular intervals. Users are automatically provisioned in Automate, based on their service profiles and assigned licenses. The sync process moves Microsoft users to appropriate sites with the correct configuration, based on the site defaults, filter criteria, and user service profiles. The number assigned to the user is added to a number inventory in Automate, and is flagged with the user’s name.

Note

  • To view staged users, go to User Staging.

  • Starting with Automate v21.3-PB1, you can, with immediate effect, un-stage a user waiting in the staging queue. This executes a direct sync to the Microsoft cloud to determine whether the user has appeared in MS Teams after their licensing update.

Managing licenses for Microsoft users when onboarding and offboarding#

Automate requires the LicenseAssignment permission to manage Microsoft licenses.

To avoid system errors, it is recommended that you do not use Azure AD User (MSOL) (Msoluser device model, device/msgraph/msoluser) to make changes, particularly when license permissions aren’t assigned. Instead, it is recommended that you use the Microsoft User Details page (relation/MicrosoftSubscriber) or other Automate functionality to update users.

If a user has any group assigned license, Automate won’t attempt any direct license assignment at all, via onboarding or via updates on the Microsoft User Details page (relation/MicrosoftSubscriber), regardless of what may be included in Automate configuration templates or in the Microsoft portal.

When offboarding, if Automate is set up to remove a user’s direct licenses, this is only possible when Automate is also removing all the license groups. If any license group remains, the direct licenses aren’t removed. For example, if a user has base licenses (for example, E3) assigned via group, and you want Automate to add MCOEV as a direct license, this won’t be possible. In this case, it is only possible to add the MCOEV license via a group license assignment, since it is possible to assign or remove additional groups.

The group license assignment during onboarding and offboarding is not only used for licenses, so it can be used to add or remove non-license groups together with direct licensing, or for no licensing, as needed.

Related topics

View Microsoft licenses by customer#

To view all Microsoft licenses synced currently synced in to Automate, go to the Licenses page. The Licenses summary list view provides the following license details per customer:

  • License name (see the Microsoft License Names list for the mapping of the SKU ID number to the License Name)

  • Number of active licenses

  • Number of used licenses

  • Customer name

Licensing users for MS Teams and Teams Phone by group membership#

Automate provides options to manage licensing by group membership. Licenses associated with the group apply to members of the group.

Important

In Automate, licensing by group membership has priority over user licensing, so that if a user already had any individual licenses prior to group membership, these are replaced by the group license. Similarly, if a user that was licensed by group membership is removed from the group, the user becomes unlicensed.

Such licensing can be configured:

  • For subscriber on-boarding and off-boarding by the selected Quick Add Groups in the case of:

    • Microsoft Quick User

    • Offboard User

      Selected in the Offboard User configuration template (for target model view/MicrosoftSubscriberQas)

    • Flow Through Provisioning

      Flow through provisioning uses the associated Subscriber Profile that selects an item from Quick Add Groups.

    This option requires the selection of specific configuration templates for Microsoft in the user Quick Add Groups associated with users:

    • MS Groups Add Template

    • MS Groups Remove Template

    For details on configuring these templates, refer to the Configuration Templates for MS Groups section below.

  • Manually, via Manage Group Membership. For details around configuring settings on this page, see Manage group membership.

    You can also use the Multi-vendor Quick Action to open this form - see: Configure quick actions for multi vendor users.

Configuration templates for MS groups#

Automate ships with reference configuration templates that can be cloned to a hierarchy, renamed and modified in order to customize the group membership that will be affected by the operation associated with the configuration template.

The templates display on the Configuration Templates page. The menu and model associated with the configuration templates is view/MsGraphManageGroup.

  • Reference Microsoft Groups Add Template

    Add one or more entries to the Group list to provide group membership to a user.

    If a user is already a member of a group, the corresponding entry is ignored.

  • Reference Microsoft Groups Remove Template

    Add one or more entries to the Group list to remove group membership from a user.

    If a user is not a member of a group, the corresponding entry is ignored.

The Group names need to be typed in, and the list can be inspected via the Groups page. If MS licenses are associated with the groups, these will be applied or removed according to the configuration template Operation function. (For cloned templates, the User and Operation values do not have to be modified if the operation of the original template is to remain the same.)

Important

If the Add and Remove configuration templates contain the same list of groups, these should not both be selected when creating a Quick Add Group, since the result of applying the Quick Add Group will then be to both add and remove the overlapping group.

The best practice is to create separate Quick Add groups to apply for on-boarding and off-boarding a user, each containing only the required configuration template.

However, in cases where administrators wish to ensure only a standard set of groups apply during on-boarding or off-boarding, the configuration templates can be combined to achieve the desired set.

These created configuration templates can now be applied to the relevant created Quick Add Groups for use in on-boarding, off-boarding and flow-through provisioning.

Related topics

View a user’s Microsoft licenses#

To view the license details of individual users via the user management functionality:

  1. Go to the Manage Users list view.

  2. Click on a user to open the Manage Users [user name] page.

  3. Select the MS Licenses tab.

  4. View currently enabled licenses for the user.

Related topics