Blocking Self-Service Purchases

On October 23rd, Microsoft announced – a little out of the blue – they were going to introduce self-service purchase options for users on November 19th. The details of this change were put forward in a post in the message center, article MC193609 to be exact. In short, this option would introduce several changes for commercial tenants.

Some of the changes would include:

• Allow end users to purchase Power Platform related subscriptions using their own payment method, e.g. Power Apps, Automate (formerly Flow) or PowerBI Pro.
• These subscriptions could be made in their employee’s tenant, with the exception of government, non-profit and education.
• It would not end with Power Platform subscriptions.
• To make purchases, end users would be able to open a restricted view of the Microsoft 365 Admin Center.

While a handful individuals cheered ‘Power to the end user’, the vast majority of organizations were very unhappy with this announcement to say the least. This adoption booster would not only be opposing Microsoft’s own ‘Cloud on your terms’ and ‘Your tenant, your data’ principles they have been telling customers for years, it could also severely impact enterprise security and governance policies (or absence thereof), let alone lead to discussions when people expense their PowerBI Pro purchase. And I’m not even talking about the absence of admin controls.

So, swiftly after the massive backlash on social media, UserVoice as well as other channels, the announcement was altered, and a Self-service purchase FAQ. The change itself was postponed until January 14th, 2020, and organizations would be handed controls to turn self-service purchases off before roll out.

Rather quietly, details on how to disable self-service purchase have been added to the FAQ. To accomplish this, you need to install yet another PowerShell module from the PowerShell gallery, MSCommerce. Of course, you cannot have enough PowerShell modules installed; I am sure there are good reasons for not adding this functionality to the existing Azure module for example.

So, from a PowerShell session, to install the module and connect to the MSCommerce service, run the following:

Install-Module MSCommerce
Connect-MSCommerce

You should now have the following commands at your disposal:

For now, there is only one policy available, which is the AllowSelfServicePurchase policy. You can retrieve all existing policies using Get-MSCommercePolicies, and to inspect the single policy you can use Get-MSCommercePolicy -PolicyId <Policy>.

The policy has a DefaultValue of Enabled, which implies there should be ways to turn it off overall without fiddling with the underlying setting, but it is what it is.

Now we can inspect all the Product settings belonging to that policy using:

Get-MSCommerceProductPolicies -PolicyId <Policy>

As shown, the self service purchase options for Power Apps, Power BI Pro  and Automate are all enabled. To retrieve a single product setting, use Get-MSCommerceProductPolicy -PolicyId <Policy> -ProductId <Product>. You can fin the ProductId identifiers in the output displayed above.

Now, to turn the self-service purchase option for all these products off, you can use the following one-liner:

Get-MSCommerceProductPolicies -PolicyId AllowSelfServicePurchase | ForEach { Update-MSCommerceProductPolicy -PolicyId $_.PolicyId -ProductId $_.ProductId -Enabled $false }

Be sure to monitor the self-service purchase FAQ for any changes, as in the future new products may receive a self-service purchase option, and you may need to re-run the above command.

Office 365 License Management

Managing Office 365 licenses is no easy task and forecasting for future needs can be exhausting. At ENow, we believe in ‘buy only what you need, and adopt all that you buy’, and our solutions can help you achieve just that.

Efficiently and effectively optimize your Office 365 licenses to make informed licensing decisions with ENow Office 365 License Management reporting, including: customizable trend analysis, real-time licenses user lists, license addition history, and much more.

Access your free 14-day trial today! Be the IT hero and drive out any hidden costs.