In October 2019, Microsoft announced that it would enable end users to buy and manage their own licenses within their corporate account. At that time this “feature” was announced for the Power Platform: PowerApps, Flow (now Power Automate) and Power BI.
After that announcement Microsoft received critical feedback from tenant administrators where eventually Microsoft allowed tenant administrators to disable this functionality using PowerShell, the self-service feature is enabled by default in every tenant though.
Last week, on August 12th Microsoft announced that they will expand this functionality and also allow end users to buy Visio and Project licenses in the same way starting September 15th 2020 (at time of writing in less than a month).
How does it work from an end-user perspective?
If enabled, any user with a non-guest user account in a managed Azure AD tenant has the option to buy a license for a supported product via credit card payment either via the product page, or by using in-app purchase prompts. The user can buy one or more subscriptions, and will be provided with a limited view in the Microsoft 365 admin center where they can assign licenses to other people within their organization.
From an end-user perspective this is a smooth experience, and I firmly believe that in some circumstances this will fill-in a requirement. I don’t see that requirement though for organizations where the environment is managed by an IT Department, and software purchases are centralized. Having the option enabled also gives some “challenges” for example when the user who bought the subscription is leaving the organization, or later wants to move the bought subscription under corporate control.
Microsoft since July 30th now provides a way to move subscriptions from self-service purchase to another subscription or to cancel a subscription made by self-service purchase but this also involves administrative tasks.
And Microsoft has also announced that for organization who don’t want this self-service functionality enabled, a License Request workflow will be made available, allowing organizations to either use a license request workflow provided by Microsoft, or provide a link to an organization request form to allow users to request software.
As you can see, Microsoft is doing everything in its power to make Self-service purchase work for end users, which in my opinion should be something they should have provided from the beginning as the default option for at least Enterprise subscription owners.
So, how do we disable Self-Service purchase?
For this we can use the MSCommerce PowerShell module, the PowerShell Module can be used to access the Microsoft Commerce APIs.
You can install the module using the install-module -name MSCommerce command within a PowerShell session. Once installed you can import the module using the import-module -name MSCommerce command and once done connect to the environment using the connect-MSCommerce command which will ask you to login.
Check current settings within your environment
You can check the current status of the settings by providing the following command:
Get-MSCommerceProductPolicies -PolicyID AllowSelfServicePurchase
This will provide the following output.
Disable Self Service Purchase
In order to disable a product for self-service purchase you need to know the ProductID, and you can disable self-service purchase using the following command.
Update-MSCommerceProductPolicy -PolicyID AllowSelfServicePurchase -ProductID <ProductID> -Enabled $False
Conclusion
Sometimes Microsoft makes decision which are hard to understand, or driven by (assuming) commercial interest. I believe this is decision is one of them. Leaving this option enabled within your organization is asking for trouble and until Microsoft provides a better solution (which shouldn’t take long) my advice would be to disable this functionality within your tenant using the guidance provided in this article.
Once Microsoft makes the License Request workflow available (which should be somewhere next month, see MC219225), you could enable the License Request workflow either using the Microsoft provided solution or by redirecting the user to your own self service portal providing the capability to request a license via normal procedures.
Make sure to keep reading service announcements, since we can expect more products to be added in the future, and you might want to disable the functionality before it’s being offered to your end users.
More information
Microsoft to Office 365 Users: Have Your Credit Cards Ready
Use AllowSelfServicePurchase for the MSCommerce PowerShell module