daknetworks.com

As a refresher, get-msoluser and get-azureaduser are similar but provide information differently.

This is a case where it seems to be easier to use get-msoluser.

To see all accounts:

get-msoluser

That returns a maximum of 500 results in a command, so you can check with (20000 represents some really high number because 'unlimited' or 'all' doesn't exist):

get-msoluser -maxresults 20000


To search for a specific account:

get-msoluser -searchstr foo.user

To see if accounts are licensed:

get-msoluser -maxresults 20000 |where {$_.islicensed -eq $true}

To see if accounts are not licensed:

get-msoluser -maxresults 1000 |where {$_.islicensed -eq $false}

To see if accounts are not licensed and filter through the external contacts and healthmailboxes:

get-msoluser -maxresults 1000 |?{$_.islicensed -eq $false} |?{($_.UserPrincipalName -notlike "HealthMailbox*") -and ($_.userprincipalname -notlike "*#EXT#*")}

To see an example of the details of a licensed account for ADHOC:

get-msoluser -UserPrincipalName This e-mail address is being protected from spambots. You need JavaScript enabled to view it |fl |findstr /i licen
IndirectLicenseErrors                  : {}
IsLicensed                             : True
LicenseAssignmentDetails               : {Microsoft.Online.Administration.LicenseAssignmentDetail}
LicenseReconciliationNeeded            : False
Licenses                               : {foodomain:RIGHTSMANAGEMENT_ADHOC}

To see an example of the details of an unlicensed account:

get-msoluser -UserPrincipalName  This e-mail address is being protected from spambots. You need JavaScript enabled to view it |fl |findstr /i licen
IndirectLicenseErrors                  : {}
IsLicensed                             : False
LicenseAssignmentDetails               : {}
LicenseReconciliationNeeded            : False
Licenses                               : {}

To assign a license to an account, you might think that set-msoluser has a key/value but they break it out to set-msoluserlicense (which is weird because there is no get-msoluserlicense). But before that is possible, the account must be set for USAGELOCATION (which is set-msoluser):

set-msoluser -UserPrincipalName  This e-mail address is being protected from spambots. You need JavaScript enabled to view it -usagelocation US

set-msoluserlicense -UserPrincipalName  This e-mail address is being protected from spambots. You need JavaScript enabled to view it -AddLicenses "foodomain:TEAMS_COMMERCIAL_TRIAL"

Likewise for removing the license:

set-msoluserlicense -UserPrincipalName  This e-mail address is being protected from spambots. You need JavaScript enabled to view it -removeLicenses "foodomain:TEAMS_COMMERCIAL_TRIAL"

What options are available for the license key?

Glad you asked. Here is how to get the options for your tenant:

Get-MsolAccountSku

If something doesn't show, it is because it has not been provisioned.