Provisioning o365 accounts using Google SAML App and assign licences using power shell

The final piece of our puzzle is provisioning of Office 365 Education (o365) automatically. To recap, we started out by using Moodle as the directory reference, modified Moodle plugin called Configurable Reports to synchronize Moodle user accounts to our LDAP server, and used Google Cloud Directory Sync (GCDS) to provision Google accounts from our LDAP server.

Microsoft does not have the equivalent of Google’s GCDS which is a great pity. In general it has been very painful to deal with directory synchronization with Microsoft. I finally gave up and used a very useful SAML App provided by Google to do this. Here is the documentation for this App. I couldn’t get the SSO to work since federating my custom domain was a huge pain and after several tries I gave up. However, the user provisioning part works!

Provisioning doesn’t assign licenses though. So a final step is to assign licenses. While you can do this from the admin panel it is convenient to do this using a powershell script (I did this on a Windows 10 machine):

# Open MS Azure AD Module for Windows Power Shell on your Windows 10 machine
# The next command connects to your Windows Office 365 admin login
# Enter your email and password successively for your ADMIN account
#
Connect-MsolService
#
# Now get your account SKU ID by running the next command
#
$acctSKU = Get-MsolAccountSku
#
# Get all unset accounts and set their location to IN
#
$AllIn = Get-MsolUser -All | where {$_.UsageLocation -eq $null}; $AllIn | foreach {Set-MsolUser -ObjectId $_.ObjectID -UsageLocation "IN"}
#
# Get all unlicensed users into an object
#
$AllUn = Get-MsolUser -All -UnlicensedUsersOnly
#
# Set the services to be disabled for all users to whom licenses need to be issued per your need
#
$LO = New-MsolLicenseOptions -AccountSkuId $acctSKU -DisabledPlans "EXCHANGE_S_STANDARD", "BPOS_S_TODO_2","STREAM_O365_E3","TEAMS1","Deskless","FLOW_O365_P2","POWERAPPS_O365_P2","RMS_S_ENTERPRISE","OFFICE_FORMS_PLAN_2","SWAY","INTUNE_O365","YAMMER_EDU"
#
#Assign licenses to the unlicensed with the disable services also specified
#
$AllUn | ForEach {Set-MsolUserLicense -UserPrincipalName $_.UserPrincipalName -AddLicenses $acctSKU -LicenseOptions $LO}

Posted in Directory Services, G-Suite, Office 365 Education and tagged .

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.