Error running Powershell script in Adaxes

Question

I am having an issue running a powershell script through Adaxes. I am trying to have this run as a business rule when a user has an office365 license assigned to the user. This script disables OneDrive for that user. I am receiving no errors running this on the server (Powershell v4) but receive the error code below. Has anyone attempted to do this before or knows how to get around this error?

Exception setting "DisabledServicePlans": "Cannot convert the "ONEDRIVESTANDARD" value of type "System.String" to type "System.Collections.Generic.List`1[System.String]"."

The code I am running is here. (Note: I did remove the company name and the code providing the PSCreds)

import-module MSOnline
#license and options
Connect-MsolService -Credential $creds 
$optOffice = New-MsolLicenseOptions –AccountSkuId "companyName:OFFICESUBSCRIPTION"
$optoffice.DisabledServicePlans = "ONEDRIVESTANDARD"
 Set-MsolUserLicense -UserPrincipalName %userPrincipalName% -LicenseOptions $optOffice

Answer 1

Hello,

There are a few issues with your script. First of all, how many Office 365 Tenants do you have? The thing is that Office 365 allows connection to only 1 Office 365 Tenant from 1 process at a time. A single Windows process is not allowed to connect to 2 or more tenants simultaneously. For this purpose, if you have multiple tenants registered, Adaxes needs to connect to the registered Office 365 tenants queuing up requests to a certain specific tenant and reconnecting between tenants from time to time. To reconnect to another tenant, Adaxes uses the Connect-MsolService cmdlet.

In your script, you also use this cmdlet. If you have only 1 tenant registered in Adaxes, this won't make any harm (though this is not necessary since Adaxes is already connected to your tenant via PowerShell remoting), however if you have multiple tenants registered, this will disrupt the whole queue that Adaxes builds to correctly connect to the tenants. This can result in unpredictable results, for which purpose we usually don't recommend using the Connect-MsolService cmdlet in scripts run by Business Rules, Custom Commands and Scheduled Tasks.

Secondly, you are assigning the DisabledServicePlans property of an MsolLicenseOptions object to a single string, however the property requires a string list, not a single string.

Probably, when you setting the property via the PowerShell console, PowerShell v. 4 converts a string into a string list consisting of 1 item. However, in Business Rules, Scheduled Tasks and Custom Commands Adaxes loads PowerShell v. 2.0, which, probably, does not perform such an automatic conversion.

Here's a version of your script that will work if you have only 1 tenant registered in Adaxes:

Import-Module MSOnline

$disabledLicensePlans = @()
$disabledLicensePlans += "ONEDRIVESTANDARD"

$optOffice = New-MsolLicenseOptions –AccountSkuId "companyName:OFFICESUBSCRIPTION" -DisabledPlans $disabledLicensePlans
Set-MsolUserLicense -UserPrincipalName %userPrincipalName% -LicenseOptions $optOffice

A version that will work in an environment with multiple tenants will be a bit more complicated. This version of the script creates a new powershell.exe session as a separate Windows process. Since it is another powershell.exe session, not the one that's created by Adaxes by default, the limit of having only 1 tenant connection does not apply, and connecting to Office 365 in this separate thread won't create issues for Adaxes. However, you need to keep in mind that this workaround has a drawback: if an error occurs while running this script, you won't be able to see the error in Adaxes.

# Get Office 365 Tenant credentials
$office365Cred = $Context.GetOffice365Credential()
$adminName = $office365Cred.Username
$password = $office365Cred.GetNetworkCredential().Password

$scriptBlock = {
    Import-Module MSOnline

    # Connect to Office 365
    $password = ConvertTo-SecureString -AsPlainText -Force -String $password
    $credential = New-Object System.Management.Automation.PsCredential($adminName,$password)

    Connect-MsolService -Credential $credential

    $disabledLicensePlans = @()
    $disabledLicensePlans += "ONEDRIVESTANDARD"

    $optOffice = New-MsolLicenseOptions –AccountSkuId "companyName:OFFICESUBSCRIPTION" -DisabledPlans $disabledLicensePlans
    Set-MsolUserLicense -UserPrincipalName %userPrincipalName% -LicenseOptions $optOffice
}

# Start Windows PowerShell as a separate process and run the script block in that process
$powershellPath = "$env:windir\system32\windowspowershell\v1.0\powershell.exe"
Start-Process $powershellPath -NoNewWindow -ArgumentList ("-ExecutionPolicy Bypass -noninteractive -noprofile `$adminName = '$adminName'; `$password = '$password'; `$objectId = '$objectId'; `$objectLocation = '$objectLocation';" + $scriptBlock )

Pay attention that the script uses the $Context.GetOffice365Credential() method of the built-in $Context variable that allows you to retrieve credentials of an Office 365 tenant associated with a user.