Microsoft 365 – How To Stop Self-Service Purchases

Last year Microsoft introduced the capability for end-users within an organization to self-service purchase a sub-set of Microsoft subscription products.  The list of published self-service programs is available here Using self-service sign up in your organization – Microsoft 365 admin | Microsoft Docs 

For most end-customers this can cause challenges, some possible reasons would be: 

• Licensing may end up being purchased through multiple paths 
• Purchase is outside the control of IT management and budget 
• Use of applications may result in exposure or release of information that has not been considered by the end-user. 

For Partners, this is also particularly challenging:  

• Self-service license purchases are direct with Microsoft, they bypass the CSP licensing model, this means the partner does not receive any margin on the sale of these products. 
• From a support standpoint, the products purchased in this way are directly supported by Microsoft, but any of the products purchased by the partner are still supported by the partner – this is hard for the end–user and the partner. 
• Administration becomes complicated for the partner, the subscriptions are not fully under their control. 

At present this applies to a sub-set of products – the Power BI products were the initial products but Visio and Project are options that are being added in the near future (if not already available). 

It is possible to disable self-service purchasing, when you disable self-service purchasing, a new mechanism then comes into play Manage license requests | Microsoft Docs – this means that the end-user can request licenses but the administrator has to approve them.  There is also a mechanism for replacing the default workflow process with a message which redirects the user to the correct process. 

 

Recommendations for Partners.   

1. Change your default on-boarding process to disable self-service purchasing within the customer‘s tenant. 

The following Powershell script will disable this within the tenant, when prompted, you will need to enter a global admin user within the tenant to make the change.

 

[code language=”powershell”]
Install-Module -Name MSOnline
Connect-MsolService

Get-MsolCompanyInformation | fl AllowAdHocSubscriptions

Set-MsolCompanySettings – llowAdHocSubscriptions $false
[/code]

Use the –TenantID to specify a tenant – in this case, you will need to run as a CSP Global admin and ensure that you already have admin rights over the tenant.

 

2. If it is not possible to disable this globally, you can disable at the product level – the following script will Disable self-service purchasing across all products, you can however specify individual products if required. 

[code language=”powershell”]
Install-Module -name MSCommerce
Connect-MSCommerce

Get-MSCommercePolicy -PolicyId AllowSelfServicePurchase

$products = Get-MSCommerceProductPolicies -PolicyId
AllowSelfServicePurchase
foreach ($p in $products)
{

Update-MSCommerceProductPolicy -PolicyId AllowSelfServicePurchase
ProductId $p.ProductId -Enabled $False
}
[/code]

3. Adjust the workflow settings within each tenant so that requests are directed to the correct process for each customer. 

(a) Log in to the tenant as Office 365 Admin (https://admin.microsoft.com) 

(b) Select Billing > Licenses 

(c) Select “Requests”, then “Use your existing request process instead” 

(d) Check the box and update the details to match your process.

 

Step 3 is still important, even if you have disabled purchasing, Microsoft will still drive the users through the process.  If this is not configured, the request will result in a request in the admin portal for the tenant administrator.   

The latest information from Microsoft is available here: Manage self-service purchases (Admins) | Microsoft Docs 

 

Summary 

Self-service for purchasing certain licenses (mainly Power platform, but soon to be Visio and Project) is actively encouraged by Microsoft and enabled by default, this by-passes most processes and will mean that licenses are not purchased through the partner. 

You can disable self-service, but you can only do this using PowerShell. 

Once self-service is disabled, the options for end-users will continue to encourage them to purchase their own licenses, however, the requests will be directed to the Microsoft 365 tenant administrator. 

If you have a process for users to purchase licenses, you can now adjust the mechanism so that the end–user is given the correct support message. 

 

For Microsoft CSP partners, Atria automates the setup and configuration of Microsoft 365 tenants and subscriptions.