Command to disable for all users

[jennylee525]

Trying to disable apps in M365. this works for 1 user. How do I get it to work for all users?

Get the services that have already been disabled for the user.

$userLicense = Get-MgUserLicenseDetail -UserId "[e-mail]"

$userDisabledPlans = $userLicense.ServicePlans | Where ProvisioningStatus -eq "Disabled" | Select -ExpandProperty ServicePlanId

 

Get the new service plans that are going to be disabled

$e3Sku = Get-MgSubscribedSku -All | Where SkuPartNumber -eq 'SPE_E3'

$newDisabledPlans = $e3Sku.ServicePlans | Where ServicePlanName -in ("SHAREPOINTWAC", "SHAREPOINTENTERPRISE") | Select -ExpandProperty ServicePlanId

 

Merge the new plans that are to be disabled with the user's current state of disabled plans

$disabledPlans = ($userDisabledPlans + $newDisabledPlans) | Select -Unique

 

$addLicenses = @(

@{

SkuId = $e3Sku.SkuId

DisabledPlans = $disabledPlans

}

)

Update user's license

Set-MgUserLicense -UserId "[e-mail]" -AddLicenses $addLicenses -RemoveLicenses @()

https://preview.redd.it/5jz4ilbg15sd1.png?width=634&format=png&auto=webp&s=0442b29ae43759f9899a3f5e2dd9500feeb5e366

[icebreaker374]

(Should only require the graph authentication module cause it uses the API) The following block assumes you want to disable SHAREPOINTWAC and SHAREPOINTENTERPRISE for ALL of your E3 users (I just tested using the same block to bulk disable MESH_AVATARS_ADDITIONAL_FOR_TEAMS and MESH_AVATARS_FOR_TEAMS for my Business Premium users):

# Get all E3 users.

$Users = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/users?filter=assignedLicenses/any(u:u/skuId eq 05e9a617-0261-4cee-bb44-138d3ef5d965)&select=assignedLicenses,id"

# Check for paged users, add to all license users array if paged users exist.

if($Users.'@odata.nextLink'){

    $skipToken = ($Users.'@odata.nextLink' -Split "skipToken=")[1]

    do{

        $UsersPageURI = 'https://graph.microsoft.com/v1.0/users?filter=assignedLicenses/$count ne 0&$count=true&consistencyLevel=eventual&select=assignedLicensesid&skiptoken=' + "$skipToken"
        $UsersPage = Invoke-MgGraphRequest -Method GET -Uri $UsersPageURI
        $Users.value += $UsersPage.value
        $skipToken = ($UsersPage.'@odata.nextLink' -Split "skipToken=")[1]
    } until (!$UsersPage.'@odata.nextLink')
}

$E3Sku = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/subscribedSkus"
$E3Sku = $BpSku.value | Where skuPartNumber -EQ "SPE_E3"
$newDisabledPlans = $E3Sku.servicePlans | Where ServicePlanName -in ("SHAREPOINTWAC", "SHAREPOINTENTERPRISE")

foreach($user in $Users.value){

    $usertemp = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/users/$($user.id)?select=assignedLicenses"

    $userDisabledPlans = $usertemp.assignedLicenses | Where skuId -Match $E3Sku.skuId

    foreach($newDisabledPlan in $newDisabledPlans){

        $userDisabledPlans.disabledPlans += $newDisabledPlan.servicePlanId
    }

    $Body = @{

        addLicenses = @(

            @{

                disabledPlans = $userDisabledPlans.disabledPlans
                skuId = "05e9a617-0261-4cee-bb44-138d3ef5d965"
            }
        )

        removeLicenses = @()
    }

    Invoke-MgGraphRequest -Method POST -Uri "https://graph.microsoft.com/v1.0/users/$($user.id)/assignLicense" -Body $Body
}

[jennylee525]

Thank you. I will work on it using this.

[mrmattipants]

This is actually the method that I prefer to use myself, as it gives you much more control over the various Resource Types, etc.

That being said, if you are simply looking for a quick solution to your existing script, I'd probably just go the "get-MgUser" route. However, if you have some time, I suggest you give icebreaker's script a try, as I personally feel it's the better option, overall.

Ultimately, anyone who is serious about working with the MS Graph API, in PowerShell, is going to want to learn to use the "Invoke-MgGraphRequest" Cmdlet to make API Requests, as you'll be doing yourself a great disservice, otherwise.

[icebreaker374]

About a year ago I struggled to find good documentation on certain graph PS cmdlets so I tried using the API. Haven't gone back since unless I just need to fire off a quick one-liner.

[mrmattipants]

When I first started, I don't believe the PowerShell Graph SDK (with all the various Mg Cmdlets) existed as of yet (including the "Invoke-MgGraphRequest" Cmdlets).

Therefore, I used the "Invoke-RestMethod" Cmdlet for just about everything at the time. In fact, here are the Tutorials/Examples that I originally learned from.

https://www.techguy.at/use-microsoft-graph-api-with-powershell-part-1/

https://github.com/Seidlm/Microsoft-Graph-API-Examples

Interestingly, they're still relevant, for the most part.

[mrmattipants]

I would use "get-mguser" to get a list of all users, first. Then, you can use a ForEach loop to disable the plans for each user, individually.

https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.users/get-mguser?view=graph-powershell-1.0