Menu
Modern Workplace Blog
  • Home
  • About: Kenneth van Surksum
  • Cookie Policy
Modern Workplace Blog
August 17, 2020August 17, 2020

Self Service Purchasing for Power Platform, Visio and Project, should you keep it enabled or disable the functionality?

In October 2019, Microsoft announced that it would enable end users to buy and manage their own licenses within their corporate account. At that time this “feature” was announced for the Power Platform: PowerApps, Flow (now Power Automate) and Power BI.

After that announcement Microsoft received critical feedback from tenant administrators where eventually Microsoft allowed tenant administrators to disable this functionality using PowerShell, the self-service feature is enabled by default in every tenant though.

Last week, on August 12th Microsoft announced that they will expand this functionality and also allow end users to buy Visio and Project licenses in the same way starting September 15th 2020 (at time of writing in less than a month).

MC220282 Announcement

How does it work from an end-user perspective?

If enabled, any user with a non-guest user account in a managed Azure AD tenant has the option to buy a license for a supported product via credit card payment either via the product page, or by using in-app purchase prompts. The user can buy one or more subscriptions, and will be provided with a limited view in the Microsoft 365 admin center where they can assign licenses to other people within their organization.

From an end-user perspective this is a smooth experience, and I firmly believe that in some circumstances this will fill-in a requirement. I don’t see that requirement though for organizations where the environment is managed by an IT Department, and software purchases are centralized. Having the option enabled also gives some “challenges” for example when the user who bought the subscription is leaving the organization, or later wants to move the bought subscription under corporate control.

Microsoft since July 30th now provides a way to move subscriptions from self-service purchase to another subscription or to cancel a subscription made by self-service purchase but this also involves administrative tasks.

Take control of subscription functionality

And Microsoft has also announced that for organization who don’t want this self-service functionality enabled, a License Request workflow will be made available, allowing organizations to either use a license request workflow provided by Microsoft, or provide a link to an organization request form to allow users to request software.

License Request workflow configuration

As you can see, Microsoft is doing everything in its power to make Self-service purchase work for end users, which in my opinion should be something they should have provided from the beginning as the default option for at least Enterprise subscription owners.

So, how do we disable Self-Service purchase?

For this we can use the MSCommerce PowerShell module, the PowerShell Module can be used to access the Microsoft Commerce APIs.

You can install the module using the install-module -name MSCommerce command within a PowerShell session. Once installed you can import the module using the import-module -name MSCommerce command and once done connect to the environment using the connect-MSCommerce command which will ask you to login.

Check current settings within your environment

You can check the current status of the settings by providing the following command:

Get-MSCommerceProductPolicies -PolicyID AllowSelfServicePurchase

This will provide the following output.

  • Request current configuration (all enabled)
  • Users can self-service purchase subscription

Disable Self Service Purchase

In order to disable a product for self-service purchase you need to know the ProductID, and you can disable self-service purchase using the following command.

Update-MSCommerceProductPolicy -PolicyID AllowSelfServicePurchase -ProductID <ProductID> -Enabled $False

  • Self-service disabled using PowerShell
  • Users are not allowed to self-purchase licenses

Conclusion

Sometimes Microsoft makes decision which are hard to understand, or driven by (assuming) commercial interest. I believe this is decision is one of them. Leaving this option enabled within your organization is asking for trouble and until Microsoft provides a better solution (which shouldn’t take long) my advice would be to disable this functionality within your tenant using the guidance provided in this article.

Once Microsoft makes the License Request workflow available (which should be somewhere next month, see MC219225), you could enable the License Request workflow either using the Microsoft provided solution or by redirecting the user to your own self service portal providing the capability to request a license via normal procedures.

Make sure to keep reading service announcements, since we can expect more products to be added in the future, and you might want to disable the functionality before it’s being offered to your end users.

More information

Microsoft to Office 365 Users: Have Your Credit Cards Ready

Self-service purchase FAQ

Use AllowSelfServicePurchase for the MSCommerce PowerShell module

Tweet
Follow me
Tweet #WPNinjasNL

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Founding member of:

Recent Posts

  • Azure AD Conditional Access authentication context now also available for Azure AD Privileged Identity Management
  • December 2022 update of the conditional access demystified whitepaper and workflow cheat sheet.
  • Conditional Access public preview functionality reviewed (22H2) – Part 3: Granular control for external user types
  • Conditional Access public preview functionality reviewed (22H2) – Part 2: Conditional Access filters for Apps and Workload Identities
  • Conditional Access public preview functionality reviewed (22H2) – Part 1: Authentication Strength

Books

System Center 2012 Service Manager Unleashed
Amazon
System Center 2012 R2 Configuration Manager Unleashed: Supplement to System Center 2012 Configuration Manager
Amazon
System Center Configuration Manager Current Branch Unleashed
Amazon
Mastering Windows 7 Deployment
Amazon
System Center 2012 Configuration Manager (SCCM) Unleashed
Amazon

Archives

  • February 2023
  • December 2022
  • November 2022
  • October 2022
  • September 2022
  • August 2022
  • May 2022
  • February 2022
  • January 2022
  • December 2021
  • November 2021
  • October 2021
  • September 2021
  • July 2021
  • June 2021
  • May 2021
  • April 2021
  • March 2021
  • February 2021
  • January 2021
  • December 2020
  • November 2020
  • October 2020
  • September 2020
  • August 2020
  • July 2020
  • June 2020
  • May 2020
  • April 2020
  • March 2020
  • February 2020
  • January 2020
  • December 2019
  • November 2019
  • October 2019
  • August 2019
  • July 2019
  • November 2016
  • November 2015
  • June 2015
  • May 2015
  • November 2014
  • July 2014
  • April 2014
  • March 2014
  • February 2014
  • January 2014
  • November 2013
  • August 2013
  • April 2013
  • March 2013
  • January 2013
  • December 2012
  • November 2012
  • August 2012
  • July 2012
  • June 2012

Meta

  • Log in
  • Entries feed
  • Comments feed
  • WordPress.org

Categories

  • ABM (3)
  • Advanced Threat Protection (4)
  • Announcement (42)
  • Azure (3)
  • AzureAD (65)
  • Certification (2)
  • Cloud App Security (3)
  • Conditional Access (50)
  • Configuration Manager (24)
  • Events (11)
  • Exchange Online (7)
  • Identity Protection (3)
  • Intune (17)
  • Licensing (2)
  • Microsoft Endpoint Manager (35)
  • Mobile Application Management (1)
  • Modern Workplace (65)
  • Office 365 (10)
  • Overview (10)
  • Power Platform (1)
  • PowerShell (2)
  • Presentations (7)
  • Privileged Identity Management (5)
  • Role Based Access Control (2)
  • Security (50)
  • Service Manager (4)
  • Speaking (22)
  • Troubleshooting (4)
  • Uncategorized (11)
  • Windows 10 (14)
  • Windows 11 (4)
  • Windows Update for Business (3)
  • WMUG.nl (16)
  • WPNinjasNL (30)

Tags

#AzureAD #community #conditionalaccess #ConfigMgr #IAM #Intune #m365 #MEM #MEMCM #microsoft365 #modernworkplace #office365 #security #webinar #wmug_nl ATP AzureAD Branding Community Conditional Access ConfigMgr ConfigMgr 2012 Configuration Manager Email EXO Identity Intune Licensing M365 MCAS Modern Workplace Office 365 OSD PIM Policy Sets Presentation RBAC roles Security Service Manager SSP System Center troubleshooting webinar Windows 10

Recent Comments

  • Mike on A guide to implementing Applocker on your Modern Workplace
  • Kenneth on December 2022 update of the conditional access demystified whitepaper and workflow cheat sheet.
  • John Barnes on December 2022 update of the conditional access demystified whitepaper and workflow cheat sheet.
  • Intune Newsletter - 24th February 2023 - Andrew Taylor on Azure AD Conditional Access authentication context now also available for Azure AD Privileged Identity Management
  • Azure AD Conditional Access authentication context now also available for Azure AD Privileged Identity Management | Modern Workplace Blog on A first look at Azure AD Conditional Access authentication context

This information is provided “AS IS” with no warranties, confers no rights and is not supported by the author.

Copyright © 2021 by Kenneth van Surksum. All rights reserved. No part of the information on this web site may be reproduced or posted in any form or by any means without the prior written permission of the publisher.

Shorthand: Don’t pass off my work as yours, it’s not nice.

©2023 Modern Workplace Blog | Powered by WordPress and Superb Themes!
This website uses cookies to improve your experience. We'll assume you're ok with this, but you can opt-out if you wish. Cookie settingsACCEPT
Privacy & Cookies Policy

Privacy Overview

This website uses cookies to improve your experience while you navigate through the website. Out of these cookies, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may have an effect on your browsing experience.
Necessary
Always Enabled
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Non-necessary
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.
SAVE & ACCEPT