Disabling Self-Service Purchasing

Microsoft has been allowing self-service purchase capabilities for end-users for over a year now. According to their FAQ (opens in new tab), “Customers can make a self-service purchase online from the product websites or from in-app purchase prompts. Customers are first asked to enter an email address to ensure that they’re a user in an existing Azure Active Directory (AD) tenant.” The customer puts their own credit card payment method on file and is responsible for the subscription. This hasn’t been off too big of a concern because:

1. It is not as common for an end user to come across these sites for purchasing
2. There are only a limited subset of products that they could actually get a subscription for.

If you a few cmdlets in PS, you will see all that is available today:

Microsoft recently announced in their message center that there are two more offerings that are coming to this self-service purchase ability on April 19, 2021. I am not sure how many products they intend to add here long-term but I see some major concerns for MSPs:

• License sprawl outside the CSP model and main margin stream
• Products are directly supported by Microsoft instead of being handled through the CSP Provider

Because of uncertainty in Microsoft’s intentions , I wanted to create a simple script that allows you to disable this type of purchasing by end users across all of the tenants that you manage in Partner Center.

The Script#

Write-Host "Checking for MSOnline module..."

$Module = Get-Module -Name "MSOnline" -ListAvailable

if ($Module -eq $null) {
    
        Write-Host "MSOnline module not found, installing MSOnline"
        Install-Module -name MSOnline
    
    }

Write-Host "Please Enter your Partner Center Global Admin Credentials"

Connect-MSolservice -Credential $credential
$tenants = Get-MsolPartnerContract -All




ForEach($tenant in $tenants){

Write-Host "Disabling Self-Service for $($tenant.Name)" -ForegroundColor Green

Set-MsolCompanySettings -Tenant $tenant.tenantID -AllowAdHocSubscriptions $false


}

Github Link (opens in new tab) Credentials You will need to be a Global Admin in Partner Center to run this script. ×

Once the script is running, you will see an output of the setting being disabled in your customer tenants.

The Set-MsolCompanySettings -AllowAdHobSubscriptions cmdlets are defined as follows by Microsoft’s PS documentation: (opens in new tab) “Indicates whether to allow users to sign up for email based subscriptions. This setting is applied company-wide.” For net new customers that you onboard in the future, you may want to add the Set-MsolCompanySettings cmdlets to be part of your onboarding checklist or simply rerun the same script here after you have added yourself as partner of record in their account.

I hope this provides some help for you to ensre end-users aren’t buying subscriptions directly from Microsoft. Let me know if you have any questions in the comments below. For more on self-service purchasing from Microsoft, check out their support article here (opens in new tab)