PS Script: Assign license based on WAAD Security Group

A lot of customers buy Package of Plans within Office 365, like Enterprise or MidSize. These Package of License Plans are just build up With the single Plans, but they don’t work the same way when assigning the Licenses With PowerShell.

Therefore I made a PowerShell Script that assigns the License Plans underneath a Package, and I need this because these customers doesn’t want to give away everything inside Office 365 at the same time.

Scenario 1: SharePoint Online isn’t ready yet, but we wanne use Exchange Online, Lync Online or any other service.

Scenario 2: Campaigns. Microsoft regular sells Office 365 License Packs for a discounted price, either on an Agreement or for some deployment reason. But still you might not wanne confuse Your users by enabling all services, which you do by assigning all Licenses within a Package.

Pre reqs:
PowerShell v3
MS Online Services Sign-In Assistant
Security Group With members synchronized to Azure Active Directory

AAD Security Group Name: Lync_Users

The Script:

 Script that assigns Office 365 licenses based on Group membership in WAAD.
 The script assigns license Lync Online Plan 1/2/3 based on Group Membership and that the user doesn't have a license.
 It can seem abit reverse as we enable EnterPrisePack, but disables everything but what we want to keep.
 This is just the way it works when workin with Plan Packages, compared to single Plans.
 Author: Roy Apalnes
 Email: roy.apalnes(a)
 The script are provided “AS IS” with no guarantees, no warranties, and they confer no rights.
 Feel free to contact me for assistance.
 Modifier: Roy Apalnes
 Modified for Customer X

$Office365Credentials = Get-Credential

# Connect to Microsoft Online
 Import-Module MSOnline
 Connect-MsolService -Credential $Office365credentials

write-host "Connecting to Office 365..."

#Disabled Plans for assigning Lync Online only
 $disabledPlans= @()
 $disabledPlans +="OFFICESUBSCRIPTION"
 $disabledPlans +="SHAREPOINTWAC"
 $disabledPlans +="RMS_S_ENTERPRISE"
 $disabledPlans +="YAMMER_ENTERPRISE"
 $disabledPlans +="EXCHANGE_S_ENTERPRISE"

#Create a LicenseOption with ENTERPRISEPACK and disable all Plans but Lync Online
 $LyncOnly = New-MsolLicenseOptions -AccountSkuId syndication-account:ENTERPRISEPACK -DisabledPlans $disabledPlans

#Country Location is mandatory for license assigning
 $UsageLocation = "NO"

#Find ObjectId of every Security Group
 $Groups = Get-MsolGroup | Select ObjectId,DisplayName

#Placeholder for our Lync Online Security Group Object Id
 $LyncGroupObjectId = $Groups | where {$_.DisplayName -eq "Lync_Users"} | Select ObjectId

#Placeholder for ObjectIds of every member of Security Group Lync_Users
 $LyncGroup = Get-MsolGroupMember -GroupObjectId $LyncGroupObjectId.ObjectId

#Placeholder for ObjectIds of every member without a License.
 $UnlicensedLyncUsers = $LyncGroup | where {-not $_.islicensed} | Select ObjectId

#Set UsageLocation
Set-MsolUser -ObjectId $UnlicensedLyncUsers.ObjectId -UsageLocation $_.UsageLocation

#Set LicensOption Lync Online Only
Set-MsolUserLicense -ObjectId $UnlicensedLyncUsers.ObjectId -AddLicenses syndication-account:ENTERPRISEPACK -LicenseOptions $LyncOnly


As of now it only assigns Licenses to users which doesn’t have any License, so this is ment for implementation and New users that should only have Lync Online.

I will later post a script for each Plan within a Enterprise Package, and we can take away the part that collects only unlicensed users if we wanne give the users several Plan Licenses. Also make sure the Script further on uses the $LyncGroup and not $UnlicensedLyncUsers.

A thanks goes out to my friends at for delivering input to my script. Have a look at their script for assigning Licenses for single plans and removing the plans according to Security Group membership.


I am Roy Apalnes, a Microsoft Cloud Evangelist working av Sopra Steria. Main focus in Microsoft Security and Endpoint Management, with a bigger picture in mind.

Featured Posts