Dynamic group for O365 licenses

Question

Hi,

I am looking for a solution to create dynamic groups, based on users assigned O365 licenses. For example everyone having Co-Pilot assigned, shout be part of a group.

At the moment I did it this way via scheduled task... but this takes a while ...

I also checked Business units... but no filter available.

We have about 12k objects with remote user or shared mailbox to be checked.

Answer 1

Hello,

Using a scheduled task is the best option as it takes into account license assignments performed outside of Adaxes. Unfortunately, there is no possibility to use rule-based groups or business units.

Comments

Hi,

scheduled task is running since 4 hours... with PowerShell it was done in <10 seconds... that can't be a solution.

$user = Get-MsolUser -All | Where-Object {($_.licenses).AccountSkuId -match "Microsoft_365_Copilot"}

I tried now to do the same with Adaxes, but connection to MSOL is not working properly. Any updates there?

I tried this https://www.adaxes.com/sdk/ServerSideScripting/#running-the-script-as-a-specific-user

# Get saved credentials.
$username = $Context.RunAs.UserName
$password = $Context.RunAs.Password | ConvertTo-SecureString -AsPlainText -Force
$credential = New-Object System.Management.Automation.PsCredential($username, $password)

# Use credentials.
Connect-MsolService -Credential $credential

Getting

---

Hello,

The behavior is expected as the MSOnline module (Connect-MsolService comes from it) is deprecated since long ago. Also, there is no need to use any scripts at all. There are dedicated actions and conditions exactly as in your screenshot. The timing depends on the number of users you need the scheduled task to process. The recommended approach is to have two separate action sets instead of Else if blocks with each set starting with the group membership condition.

---

So, changing the action to this?

Or split them into two tasks? First running remove, then running add?

The timing depends on the number of users you need the scheduled task to process.

As mentioned earlier ... around 12.000 objects No clue how to trim this - I did already a business unit and included only user with remote user and shared mailboxes. Would be cool if we could set filter "is licensed in O365" or similar.

---

Hello,

So, changing the action to this?

Yes, that is correct. But it is also a good idea to have the conditions checking group membership first. Just select the condition and click the up-arrow on the right at the bottom of the configuration window.

Also, it is a good idea to make sure that only direct membership is checked:

Or split them into two tasks? First running remove, then running add?

This will not have any influence. You will just have more configuration objects to manage.

I did already a business unit and included only user with remote user and shared mailboxes.

If the business unit includes all the objects you need, you can add the unit to the Activity Scope of the task.

---

Hi,

ok, tried everything, but still having 12k objects and task is running a while ...

any solution or workaround how to use MSOL Connection with Adaxes currently?

---

Hello,

As it was mentioned above, the module was deprecated. If you still want to use a script, you need to do it via MgGraph, not MSOnline.

---

Ok, I installed MSGraph module and getting results

One more question, how would it be possible to run this in local PS ISE?

I want to see fata in $user and how to extract them like I need

Import-Module Microsoft.Graph.Users

$token = $Context.CloudServices.GetAzureAuthAccessToken("https://graph.microsoft.com")
$token = $token | ConvertTo-SecureString -AsPlainText -Force
Connect-MgGraph -AccessToken $token

$user = Get-MgUser -Filter "assignedLicenses/any(x:x/skuId eq 639dec6b-bb19-468b-871c-c5c441c4b0cb)"
$userCount = $user.count

$Context.LogMessage("$($userCount)", "Information")

---

Hello,

Unfortunately, there is no such possibility. The $Context variable only works in Adaxes scripts. You will need to use native Microsoft methods and cmdlets in Windows PowerShell ISE.

---

Ok, Adaxes script is working well and it takes <1 minute now to update the group : )

If anyone is looking for a similar script:

Import-Module Microsoft.Graph.Users

[System.Collections.ArrayList]$userAD = @()
[string]$licenseID = "639dec6b-bb19-468b-871c-c5c441c4b0cb" # Microsoft_365_Copilot    https://learn.microsoft.com/en-us/entra/identity/users/licensing-service-plan-reference
[string]$group = "User With Active M365 Co-Pilot License"

$token = $Context.CloudServices.GetAzureAuthAccessToken("https://graph.microsoft.com")
$token = $token | ConvertTo-SecureString -AsPlainText -Force

Connect-MgGraph -AccessToken $token

$user = Get-MgUser -Filter "assignedLicenses/any(x:x/skuId eq $($licenseID))"
$userCount = $user.count
$Context.LogMessage("User count: $($userCount)", "Information")

$groupUser = Get-AdmGroupMember $group -AdaxesService localhost
$groupCount = $groupUser.Count
$Context.LogMessage("Group member count: $($groupCount)", "Information")

$user | %% {
    $userAD.add($(Get-ADMUser -Filter 'UserPrincipalName -like $_.UserPrincipalName' -AdaxesService localhost)) | Out-Null
}

$itemsToAdd = Compare-Object -ReferenceObject $groupUser -DifferenceObject $userAD -PassThru | Where-Object { $_.SideIndicator -eq '=>' }
$itemsToRemove = Compare-Object -ReferenceObject $groupUser -DifferenceObject $userAD -PassThru | Where-Object { $_.SideIndicator -eq '<=' }

$itemsToRemove | %% {
    Remove-AdmGroupMember -Identity $group -Members $_ -Confirm:$false -AdaxesService localhost
    $Context.LogMessage("REMOVE $($_)", "Information")
}

$itemsToAdd | %% {
    Add-AdmGroupMember -Identity $group -Members $_ -Confirm:$false -AdaxesService localhost
    $Context.LogMessage("ADD $($_)", "Information")
}