CODEWITHSUNDEEP
powershell
Arbelac
Arbelac

Reputation: 1904

Powershell - Azure licence based on ad group

I have been developing AzureAD licence script based on AD Group. So, Find users with a direct assigned, find them in AD, evaluate what group they should be a member of, add them to licensing group. I have hashtable with multiple values $SKUToGroupRev. I can not match hashtable with multiple values with if($ADGroup = $SKUToGroupRev[$SKU.SkuId]) .

From what I want to do :

OR

e.g:

# Get licensed SKUs for the user
$aaduser = get-azureaduser -objectID $user.UserPrincipalName
$SKUs = $aaduser | Select UserPrincipalName,ImmutableID -ExpandProperty AssignedLicenses

e.g output:

UserPrincipalName       ImmutableId              DisabledPlans                           SKUId
-----------------       -----------              -------------                           -------------
[email protected] x+MVG6EKEUWHi3r6zjgzCA==   {041fe683-03e4-45b6-b1af-c0cdc516da4f...   6fd2c87f-b296-42f0-b197-1e91e994b900
[email protected] x+MVG6EKEUWHi3r6zjgzCA==    {}                                        0c266dff-15dd-4b49-8397-2bb16070ed52

Here is my script :

$CSVfile = "C:\temp\LicenseToGroupUsers.csv"

# Import the CSV file
try {
    $users = import-csv $CSVfile
    }
    catch {
        $errorZero = $Error[0]
        write-host "Error: " $errorZero -ForegroundColor Red  #Writes the latest error
        Break
    }


    
write-warning "About to add the following users to license groups for complete SKU:"
foreach ($user in $users){
write-host $user.UserPrincipalName
}
Read-Host -Prompt "Press Enter to continue or CTRL+C to quit"


$e3 = -split "0c266dff-15dd-4b49-8397-2bb16070ed52 6fd2c87f-b296-42f0-b197-1e91e994b900"
$e1 = -split "18181a46-0d4e-45cd-891e-60aabd171b4e 0c266dff-15dd-4b49-8397-2bb16070ed52"

$TEAMS_EXPLORATORY = -split "710779e8-3d4a-4c88-adb9-386c958d1fdf 0c266dff-15dd-4b49-8397-2bb16070ed52"

#$FLOW_FREE_E3 = -split "f30db892-07e9-47e9-837c-80727f46fd3d 6fd2c87f-b296-42f0-b197-1e91e994b900 0c266dff-15dd-4b49-8397-2bb16070ed52"


foreach ($user in $users){
    $groupsToAdd = @()
    $groupsToRemove = @()
    write-host "Processing" $user.UserPrincipalName

# Get licensed SKUs for the user
$aaduser = get-azureaduser -objectID $user.UserPrincipalName
#$SKUs = $aaduser | Select UserPrincipalName,ImmutableID -ExpandProperty AssignedLicenses

#Get the AD ObjectGuid for the group add (cannot use UPN)
$ImmutableID = "" #Null these out otherwise gets reused from previous 
#Have to match using the guid
$ImmutableID = $aaduser.ImmutableID
if ($ImmutableID) {$objectGUID = ([GUID][System.Convert]::FromBase64String($ImmutableID)).Guid}
else {
    write-warning "Error getting ImmutableID for $UPN, user is likely cloud only, skipping"
    Break
    }


   
    # test 1
    $licenses = $aaduser.AssignedLicenses.SkuId
    $is_e1 = !($e1 | ForEach-Object { $licenses.Contains($_) }).Contains($false)
    if($is_e1 -eq "True"){
        try {
        write-host "Adding" $user.UserPrincipalName"to E1Group" -ForegroundColor Green
        Write-Host "Test 1: $is_e1"
        }
         catch {
                    $errorZero = $Error[0]
                    write-host "Error: " $errorZero -ForegroundColor Red  #Writes the latest error
                }
    }

    $is_e3 = !($e3 | ForEach-Object { $licenses.Contains($_) }).Contains($false)
    if($is_e3 -eq "True"){
        try {
        write-host "Adding" $user.UserPrincipalName"to E3Group" -ForegroundColor Green
        Write-Host "Test 3: $is_e3"
        }
                 catch {
                    $errorZero = $Error[0]
                    write-host "Error: " $errorZero -ForegroundColor Red  #Writes the latest error
                }
    }

        $is_TEAMS_EXPLORATORY = !($TEAMS_EXPLORATORY | ForEach-Object { $licenses.Contains($_) }).Contains($false)
    if($is_TEAMS_EXPLORATORY -eq "True"){
        try {
        write-host "Adding" $user.UserPrincipalName"to (TEAMS_EXPLORATORY)E1Group" -ForegroundColor Green
        Write-Host "Test 1: $is_TEAMS_EXPLORATORY"
        }
         catch {
                    $errorZero = $Error[0]
                    write-host "Error: " $errorZero -ForegroundColor Red  #Writes the latest error
                }
    }


 <#    $is_FLOW_FREE_E3 = !($FLOW_FREE_E3 | ForEach-Object { $licenses.Contains($_) }).Contains($false)
    if($is_FLOW_FREE_E3 -eq "True"){
        try {
        write-host "Adding" $user.UserPrincipalName"to (FLOWFREE)E3Group" -ForegroundColor Green
        Write-Host "Test 1: $is_FLOW_FREE_E3"
        }
         catch {
                    $errorZero = $Error[0]
                    write-host "Error: " $errorZero -ForegroundColor Red  #Writes the latest error
                }
    }#>



}

Upvotes: 0

Views: 491

Answers (1)

Theo
Theo

Reputation: 61013

To test agains a combination of SkuID's, using a lookup hashtable as in your first approach is not the easiest way I think. Your current approach looks much better to me, only I would not put the ID's in array variables, but test them literally against the ID's as they are found in the users AssignedLicenses.

Something like this:

$CSVfile = "C:\temp\LicenseToGroupUsers.csv"

# Import the CSV file
$users = Import-Csv -Path $CSVfile

Write-Warning "About to add the following users to license groups for complete SKU:"
$users.UserPrincipalName -join [environment]::NewLine
Write-Host
$answer = Read-Host -Prompt "Press Enter to continue or Q to quit"
if ($answer[0] -eq 'Q') { Clear-Host; exit }

foreach ($user in $users) {
    Write-Host "Processing" $user.UserPrincipalName

    $ImmutableID = $null # Null these out 
    $ADGroup     = $null

    # Get licensed SKUs for the user
    $aaduser = Get-AzureADUser -objectID $user.UserPrincipalName
    # Get the AD ObjectGuid for the group add (cannot use UPN)
    # Have to match using the guid
    $ImmutableID = $aaduser.ImmutableID
    if (![string]::IsNullOrWhiteSpace($ImmutableID)) {
        $objectGUID = ([GUID][System.Convert]::FromBase64String($ImmutableID)).Guid}
    else {
        Write-Warning "Error getting ImmutableID for $($user.UserPrincipalName), user is likely cloud only, skipping"
        continue   # skip this one and proceed with the next user
    }

    $licenses = @($aaduser.AssignedLicenses.SkuId)  # force it to be an array

    ##########################################################################################
    # Apparently, SkuId '0c266dff-15dd-4b49-8397-2bb16070ed52' is needed for all combinations,
    # so we could already rule out users that do not have that ID in their $licenses..
    # if that is indeed the case, you can simplify al other tests by not having to check
    # for this ID every time..
    # for now, this is an assumption, so commented out.

    # if (!($licenses -contains '0c266dff-15dd-4b49-8397-2bb16070ed52')) {
    #    Write-Warning "Could not determine a group for user $($user.UserPrincipalName)"
    #    continue   # skip this one and proceed with the next user
    # }
    ##########################################################################################

    # test E1:  'Microsoft 365 Audio Conferencing' and 'OFFICE 365 E1'
    if ($licenses -contains '0c266dff-15dd-4b49-8397-2bb16070ed52' -and 
        $licenses -contains '18181a46-0d4e-45cd-891e-60aabd171b4e') {
        # Add this user to group 'O365_E1_Users'
        $ADGroup = 'O365_E1_Users'
    }
    # test E3:  'Microsoft 365 Audio Conferencing' and 'OFFICE 365 E3'
    elseif ($licenses -contains '0c266dff-15dd-4b49-8397-2bb16070ed52' -and 
            $licenses -contains '6fd2c87f-b296-42f0-b197-1e91e994b900') {
        if ($licenses -contains 'f30db892-07e9-47e9-837c-80727f46fd3d') {  # also 'MICROSOFT FLOW FREE' ?
            # Add this user to group 'FLOW_FREE_E3'
            $ADGroup = 'FLOW_FREE_E3'
        }
        else {
            # Add this user to group 'O365_E3_Users'
            $ADGroup = 'O365_E3_Users'
        }
    }
    # test 'Microsoft 365 Audio Conferencing' and 'MICROSOFT TEAMS EXPLORATORY'
    elseif ($licenses -contains '0c266dff-15dd-4b49-8397-2bb16070ed52' -and 
            $licenses -contains '710779e8-3d4a-4c88-adb9-386c958d1fdf') {
        # Add this user to group 'TEAMS_EXPLORATORY'
        $ADGroup = 'TEAMS_EXPLORATORY'
    }

    # finished the conditions, now see if we can add the user to one of the groups
    if (![string]::IsNullOrWhiteSpace($ADGroup)) {
        try {
            Write-Host "Adding $($user.UserPrincipalName) to $ADGroup" -ForegroundColor Green
            # Add-ADGroupMember -Identity $ADGroup -Members $objectGUID
        }
        catch {
            Write-Host "Error: $($_.Exception.Message)" -ForegroundColor Red
        }
    }
    else {
        Write-Warning "Could not determine a group for user $($user.UserPrincipalName)"
    }
}

Upvotes: 1

Related Questions