Get all E3 User with Intune open selected

lalajee 1,811

Hi,

Is it possible to get list of all users who has Intune Option Turn on

I like to get all user which have E3 with Intune Option turn on

Nick Eckermann 466 Reputation points

2023-11-17T16:31:08.4833333+00:00

I would recommend you move to group-based licensing so you can control this better. Direct licensing with some selections for some users and not for others can be a pain.

https://learn.microsoft.com/en-us/entra/fundamentals/concept-group-based-licensing

You can migrate them, but make sure you plan accordingly. You can look at the script examples to help with the migration.

https://learn.microsoft.com/en-us/entra/identity/users/licensing-groups-migrate-users
https://learn.microsoft.com/en-us/entra/identity/users/licensing-ps-examples

2 answers

Crystal-MSFT 46,271 Reputation points Microsoft Vendor

2023-11-17T02:57:37.75+00:00
@lalajee, Thanks or posting in Q&A. Based on my testing, to query the user who has Microsoft Intune license assigned, you can run the following PowerShell commands and enter Global administrator account to query the information:

install-module MSOnline import-module MSOnline Connect-MsolService $Users = Get-MsolUser -All Write-Host "The user who has Intune license assigned" foreach ($User in $Users) { $ServiceStatus = $user.licenses.ServiceStatus $ProvisionName = $ServiceStatus | Where {$_.ServicePlan.ServiceName -eq "INTUNE_A" } $Data = [PSCustomObject]@{ "USER" = $User.UserPrincipalName "Software" = $ProvisionName.ServicePlan.ServiceName "Status" = $ProvisionName.ProvisioningStatus } if($Data.Status -eq "Success" -or $Data.Status -eq "PendingInput") { Write-Host $Data.USER+ $Data.Software } }

Hope the above information can help.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
lalajee 1,811 Reputation points

2023-11-17T12:36:36.9066667+00:00

@Crystal-MSFT

Thank you for the script but its picking up all intune lic.

Is it possible to only have account which are E3 with Intune

Script pickup this account but this account doesnt have E3 it has "Microsoft Teams Rooms Standard"

Crystal-MSFT 46,271 Reputation points Microsoft Vendor

2023-11-20T05:44:31.4633333+00:00

@lalajee, Thanks for your reply. You can run the following command with an account who has Microsoft Teams Rooms standard license assigned and see what the name for the Microsoft Intune Plan 1 in it is. then change the "Intune_A" with the name in the above script to get the user with such license.

$user = Get-MsolUser -UserPrincipalName <user upn> $ServiceStatus = $user.licenses.ServiceStatus $ServiceStatus

Note: change the user principle name with the one in your environment.

https://learn.microsoft.com/en-us/powershell/module/msonline/get-msoluser?view=azureadps-1.0

Hope the information can help.

Crystal-MSFT 46,271 Reputation points Microsoft Vendor

2023-11-22T02:21:18.5633333+00:00

@lalajee, Hope things are going well. If there's anything else we can help, feel free to let us know.
Sign in to comment

Nick Eckermann 466

I would recommend you move to group-based licensing so you can control this better. Direct licensing with some selections for some users and not for others can be a pain.

https://learn.microsoft.com/en-us/entra/fundamentals/concept-group-based-licensing

You can migrate them, but make sure you plan accordingly. You can look at the script examples to help with the migration.

https://learn.microsoft.com/en-us/entra/identity/users/licensing-groups-migrate-users
https://learn.microsoft.com/en-us/entra/identity/users/licensing-ps-examples

As far as fixing the script for just E3 users

Run Get-MsolAccountSku to find your E3 SKU name

Then modify this section.

$Users = Get-MsolUser -All | Where-Object {$_.Licenses.AccountSkuId -eq 'tenantName:SKU'}

lalajee 1,811 Reputation points

2023-11-19T22:26:04.8366667+00:00

This is exactly what i'm doing.

But I need to know which account has which option tun on as we dont allow everything for allusers
lalajee 1,811 Reputation points

2023-11-20T08:48:10.01+00:00

Is it also possible to export all user which have lic from group and which has lic from direct

Nick Eckermann 466

Yes. Here are some old scripts I have used in the past, but they may need to be a little updated. I haven't had to migrate a custom to group based in a while.

You will want to update the export locations and you could probably remove the module section.


# Install/Update MSOnline PowerShell Module
# https://docs.microsoft.com/en-us/office365/enterprise/powershell/connect-to-office-365-powershell#connect-with-the-microsoft-azure-active-directory-module-for-windows-powershell
$ModuleName = "MSOnline"
if (! (Get-InstalledModule -Name $ModuleName -AllVersions -ErrorAction SilentlyContinue)){
            # If Module not installed, install it
            Write-Host -Object "Required: Install the Microsoft Online Services Sign-In Assistant for IT Professionals RTW" -BackgroundColor Red -ForegroundColor Black
            Start "https://www.microsoft.com/en-us/download/details.aspx?id=28177"
            Write-Host -Object "Installing $ModuleName PowerShell Module" -BackgroundColor Yellow -ForegroundColor Black
            Install-Module -Name $ModuleName -AllowClobber
            Write-Host -Object "$ModuleName PowerShell module has been installed" -BackgroundColor Green
} else { 
        # Module is installed so check for module updates
        # Get PSGallery Version
        $Online = Find-Module -Name $ModuleName -Repository PSGallery -ErrorAction Stop
        # Get Installed Version
        $InstalledModule = Get-InstalledModule $ModuleName
        # Update if installed version is old
         if ($Online.version -gt $InstalledModule.version){
        Write-Host -Object "Updating $ModuleName PowerShell Module" -BackgroundColor Yellow -ForegroundColor Black
        Update-Module -Name $ModuleName -Force
        Write-Host -Object "$ModuleName PowerShell module has been updated" -BackgroundColor Green
        }else {Write-Host -Object "The latest $ModuleName PowerShell module version is already installed" -BackgroundColor Green}
}

# Modify this path to folder for export files
$FolderforExport = 'C:\Users\XXXXX\Documents\Clients\XXXX'


# Get all licensing Skus
$skuIds = (Get-MsolAccountSku).AccountSkuId

foreach ($skuId in $skuIds){
$SkuName = $skuId.Split(':')[-1]
$FileforExport =  "$SkuName.csv"

# Find all users that have the SKU license assigned
Get-MsolUser -All | where {$_.isLicensed -eq $true -and $_.Licenses.AccountSKUID -eq $skuId} | select `
    UserPrincipalName, `
    ObjectId, `
    @{Name="SkuId";Expression={$skuId}}, `
    @{Name="AssignedDirectly";Expression={(UserHasLicenseAssignedDirectly $_ $skuId)}}, `
    @{Name="AssignedFromGroup";Expression={(UserHasLicenseAssignedFromGroup $_ $skuId)}} |
    Export-Csv -NoTypeInformation -Path "$FolderforExport\$FileforExport"
}


# Returns TRUE if the user has the license assigned directly
function UserHasLicenseAssignedDirectly
{
    Param([Microsoft.Online.Administration.User]$user, [string]$skuId)

    foreach($license in $user.Licenses)
    {
        # We look for the specific license SKU in all licenses assigned to the user
        if ($license.AccountSkuId -ieq $skuId)
        {
            # GroupsAssigningLicense contains a collection of IDs of objects assigning the license
            # This could be a group object or a user object (contrary to what the name suggests)
            # If the collection is empty, this means the license is assigned directly - this is the case for users who have never been licensed via groups in the past
            if ($license.GroupsAssigningLicense.Count -eq 0)
            {
                return $true
            }

            # If the collection contains the ID of the user object, this means the license is assigned directly
            # Note: the license may also be assigned through one or more groups in addition to being assigned directly
            foreach ($assignmentSource in $license.GroupsAssigningLicense)
            {
                if ($assignmentSource -ieq $user.ObjectId)
                {
                    return $true
                }
            }
            return $false
        }
    }
    return $false
}
# Returns TRUE if the user is inheriting the license from a group
function UserHasLicenseAssignedFromGroup
{
    Param([Microsoft.Online.Administration.User]$user, [string]$skuId)

    foreach($license in $user.Licenses)
    {
        # We look for the specific license SKU in all licenses assigned to the user
        if ($license.AccountSkuId -ieq $skuId)
        {
            # GroupsAssigningLicense contains a collection of IDs of objects assigning the license
            # This could be a group object or a user object (contrary to what the name suggests)
            foreach ($assignmentSource in $license.GroupsAssigningLicense)
            {
                # If the collection contains at least one ID not matching the user ID this means that the license is inherited from a group.
                # Note: the license may also be assigned directly in addition to being inherited
                if ($assignmentSource -ine $user.ObjectId)
                {
                    return $true
                }
            }
            return $false
        }
    }
    return $false
}

# Install/Update MSOnline PowerShell Module
# https://docs.microsoft.com/en-us/office365/enterprise/powershell/connect-to-office-365-powershell#connect-with-the-microsoft-azure-active-directory-module-for-windows-powershell
$ModuleName = "MSOnline"
if (! (Get-InstalledModule -Name $ModuleName -AllVersions -ErrorAction SilentlyContinue)){
            # If Module not installed, install it
            Write-Host -Object "Required: Install the Microsoft Online Services Sign-In Assistant for IT Professionals RTW" -BackgroundColor Red -ForegroundColor Black
            Start "https://www.microsoft.com/en-us/download/details.aspx?id=28177"
            Write-Host -Object "Installing $ModuleName PowerShell Module" -BackgroundColor Yellow -ForegroundColor Black
            Install-Module -Name $ModuleName -AllowClobber
            Write-Host -Object "$ModuleName PowerShell module has been installed" -BackgroundColor Green
} else { 
        # Module is installed so check for module updates
        # Get PSGallery Version
        $Online = Find-Module -Name $ModuleName -Repository PSGallery -ErrorAction Stop
        # Get Installed Version
        $InstalledModule = Get-InstalledModule $ModuleName
        # Update if installed version is old
         if ($Online.version -gt $InstalledModule.version){
        Write-Host -Object "Updating $ModuleName PowerShell Module" -BackgroundColor Yellow -ForegroundColor Black
        Update-Module -Name $ModuleName -Force
        Write-Host -Object "$ModuleName PowerShell module has been updated" -BackgroundColor Green
        }else {Write-Host -Object "The latest $ModuleName PowerShell module version is already installed" -BackgroundColor Green}
}

# https://www.jijitechnologies.com/blogs/how-to-list-all-o365-users-with-license-type-using-powershell

function Users-LicenseType
{
    Param(
    [System.Management.Automation.PSCredential]$cred
         )
    Connect-MsolService -Credential $cred
    $Gplist= @{}
    $Group = Get-MsolGroup -All
    # Get all groupname with group objectId
    foreach($gp in $Group)
    {
    $Gplist+=@{$gp.ObjectId.ToString() = $gp.DisplayName}
    }
    $users= Get-MsolUser -All
    $AllUser = @()
    # Find Users License Type 
    foreach($user in $users)
    {
        $UserList = "" | Select "UserPrincipalName","LicenseType"  
        $lic=$user.Licenses.GroupsAssigningLicense.Guid
        if($lic -ne $null)
        {
         $GpName = ''
         foreach($lc in $lic)
         {
            If($GpName) {
                         if($Gplist.Item($lc.ToString()) -ne $null)
                         {
                         $GpName=$GpName + ";" + $Gplist.Item($lc.ToString())
                         }
                     } 
                Else {
                        if($Gplist.Item($lc.ToString()) -ne $null)
                         {
                         $GpName=$Gplist.Item($lc.ToString())
                         }
                      }          
          }
          $UserList.UserPrincipalName = $user.UserPrincipalName
          $UserList.LicenseType = "Inherited("+$GpName+")"
          $AllUser+= $UserList
          $UserList =$null
 
        }
 
        Else
        {
        $UserList.UserPrincipalName = $user.UserPrincipalName
        $UserList.LicenseType = "Direct"
        $AllUser+= $UserList
        $UserList =$null
 
        }
    }
    return $AllUser
}
 
$cred =Get-Credential
 
$Listofusers = Users-LicenseType -cred $cred
 
$Listofusers|Export-Csv -NoTypeInformation 'C:\Users\XXXXX\Documents\_Clients\XXX\LicenseDetails.csv'

Share via

Get all E3 User with Intune open selected

2 answers