Merge pull request #249662 from bhaimicrosoft/update-licensing-powershell-graph-examples

Updated section remove direct licenses for users with group licenses …

Author: v-regandowner

articles/active-directory/enterprise-users/licensing-powershell-graph-examples.md

@@ -260,47 +260,96 @@ The purpose of this script is to remove unnecessary direct licenses from users w
 
 
 ```powershell
-Import-Module Microsoft.Graph
+# Import the Microsoft.Graph.Users and Microsoft.Graph.Groups modules
+Import-Module Microsoft.Graph.Users -Force
+Import-Module Microsoft.Graph.Authentication -Force
+Import-Module Microsoft.Graph.Users.Actions -Force
+Import-Module Microsoft.Graph.Groups -Force
 
-# Connect to the Microsoft Graph
-Connect-MgGraph
+Clear-Host
 
-# Get the group to be processed
-$groupId = "48ca647b-7e4d-41e5-aa66-40cab1e19101"
-
-# Get the license to be removed - Office 365 E3
-$skuId = "contoso:ENTERPRISEPACK"
-
-# Minimum set of service plans we know are inherited by this group
-$expectedDisabledPlans = @("Exchange Online", "SharePoint Online", "Lync Online")
-
-# Get the users in the group
-$users = Get-MgUser -GroupObjectId $groupId
-
-# For each user, get the license for the specified SKU
-foreach ($user in $users) {
-    $license = GetUserLicense $user $skuId
-
-    # If the user has the license assigned directly, continue to the next user
-    if (UserHasLicenseAssignedDirectly $user $skuId) {
-        continue
-    }
-
-    # If the user is inheriting the license from the specified group, continue to the next user
-    if (UserHasLicenseAssignedFromThisGroup $user $skuId $groupId) {
-        continue
-    }
+if ($null -eq (Get-MgContext)) {
+    Connect-MgGraph -Scopes "Directory.Read.All, User.Read.All, Group.Read.All, Organization.Read.All" -NoWelcome
+}
 
-    # Get the list of disabled service plans for the SKU
-    $disabledPlans = GetDisabledPlansForSKU $skuId $expectedDisabledPlans
+# Get all groups with licenses assigned
+$groupsWithLicenses = Get-MgGroup -All -Property AssignedLicenses, DisplayName, Id | Where-Object { $_.assignedlicenses } | Select-Object DisplayName, Id -ExpandProperty AssignedLicenses | Select-Object DisplayName, Id, SkuId
 
-    # Get the list of unexpected enabled plans for the user
-    $extraPlans = GetUnexpectedEnabledPlansForUser $user $skuId $expectedDisabledPlans
+$output = @()
 
-    # If there are any unexpected enabled plans, print them to the console
-    if ($extraPlans.Count -gt 0) {
-        Write-Warning "The user $user has the following unexpected enabled plans for the $skuId SKU: $extraPlans"
+# Check if there is any group that has licenses assigned or not
+if ($null -ne $groupsWithLicenses) {
+    # Loop through each group
+    foreach ($group in $groupsWithLicenses) {
+        # Get the group's licenses
+        $groupLicenses = $group.SkuId
+    
+        # Get the group's members
+        $groupMembers = Get-MgGroupMember -GroupId $group.Id -All
+
+        # Check if the group member list is empty or not
+        if ($groupMembers) {
+            # Loop through each member
+            foreach ($member in $groupMembers) {
+                # Check if the member is a user
+                if ($member.AdditionalProperties.'@odata.type' -eq '#microsoft.graph.user') {
+                    # Get the user's direct licenses
+                    Write-Host "Fetching license details for $($member.AdditionalProperties.displayName)" -ForegroundColor Yellow
+                    
+                    # Get User With Directly Assigned Licenses Only
+                    $user = Get-MgUser -UserId $member.Id -Property AssignedLicenses, LicenseAssignmentStates, DisplayName | Select-Object DisplayName, AssignedLicenses -ExpandProperty LicenseAssignmentStates | Select-Object DisplayName, AssignedByGroup, State, Error, SkuId | Where-Object { $_.AssignedByGroup -eq $null }
+
+                    $licensesToRemove = @()
+                    if($user)
+                    {
+                        if ($user.count -ge 2) {
+                            foreach ($u in $user) {
+                                $userLicenses = $u.SkuId
+                                $licensesToRemove += $userLicenses | Where-Object { $_ -in $groupLicenses }
+                            }
+                        }
+                        else {
+                            $userLicenses = $user.SkuId
+                            $licensesToRemove = $userLicenses | Where-Object { $_ -in $groupLicenses }
+                        }  
+                    } else {
+                        Write-Host "No conflicting licenses found for the user $($member.AdditionalProperties.displayName)" -ForegroundColor Green
+                    }
+                    
+                                       
+        
+                    # Remove the licenses from the user
+                    if ($licensesToRemove) {
+                        Write-Host "Removing the license $($licensesToRemove) from user $($member.AdditionalProperties.displayName) as inherited from group $($group.DisplayName)" -ForegroundColor Green
+                        $result = Set-MgUserLicense -UserId $member.Id -AddLicenses @() -RemoveLicenses $licensesToRemove
+                        $obj = [PSCustomObject]@{
+                            User                      = $result.DisplayName
+                            Id                        = $result.Id
+                            LicensesRemoved           = $licensesToRemove
+                            LicenseInheritedFromGroup = $group.DisplayName
+                            GroupId                   = $group.Id
+                        }
+
+                        $output += $obj
+
+                    } 
+                    else {
+                        Write-Host "No action required for $($member.AdditionalProperties.displayName)" -ForegroundColor Green
+                        }
+        
+                }
+            }
+        }
+        else {
+            Write-Host "The licensed group $($group.DisplayName) has no members, exiting now!!" -ForegroundColor Yellow
+        }   
+        
     }
+    
+    $output | Format-Table -AutoSize
+}
+else {
+    Write-Host "No groups found with licenses assigned." -ForegroundColor Cyan
 }
 ```