Disable access to services with Office 365 PowerShell

Summary: Explains how to use Office 365 PowerShell to disable access to Office 365 services for users in your organization.

When an Office 365 account is assigned a license from a licensing plan, Office 365 services are made available to the user from that license. However, you can control the Office 365 services that the user can access. For example, even though the license allows access to SharePoint Online, you can disable access to it. In fact, you can use Office 365 PowerShell to disable access to any number of services for:

  • An individual account.

  • A group of accounts.

  • All accounts in your organization.

Before you begin

Specific Office 365 services for specific users for a single licensing plan

To disable a specific set of Office 365 services for users from a single licensing plan, perform the following steps:

  1. Identify the undesirable services in the licensing plan by using the following syntax:

    $LO = New-MsolLicenseOptions -AccountSkuId <AccountSkuId> -DisabledPlans "<UndesirableService1>", "<UndesirableService2>"...
    

    The following example creates a LicenseOptions object that disables the Office Online and SharePoint Online services in the licensing plan named litwareinc:ENTERPRISEPACK (Office 365 Enterprise E3).

    $LO = New-MsolLicenseOptions -AccountSkuId "litwareinc:ENTERPRISEPACK" -DisabledPlans "SHAREPOINTWAC", "SHAREPOINTENTERPRISE"
    
  2. Use the LicenseOptions object from Step 1 on one or more users.

    • To create a new account that has the services disabled, use the following syntax:
    New-MsolUser -UserPrincipalName <Account> -DisplayName <DisplayName> -FirstName <FirstName> -LastName <LastName> -LicenseAssignment <AccountSkuId> -LicenseOptions $LO -UsageLocation <CountryCode>
    

    The following example creates a new account for Allie Bellew that assigns the license and disables the services described in Step 1.

    New-MsolUser -UserPrincipalName allieb@litwareinc.com -DisplayName "Allie Bellew" -FirstName Allie -LastName Bellew -LicenseAssignment litwareinc:ENTERPRISEPACK -LicenseOptions $LO -UsageLocation US
    

    For more information about creating user accounts in Office 365 PowerShell, see Create user accounts with Office 365 PowerShell.

    • To disable the services for an existing licensed user, use the following syntax:
    Set-MsolUserLicense -UserPrincipalName <Account> -LicenseOptions $LO
    

    This example disables the services for the user BelindaN@litwareinc.com.

    Set-MsolUserLicense -UserPrincipalName belindan@litwareinc.com -LicenseOptions $LO
    
    • To disable the services described in Step 1 for all existing licensed users, specify the name of your Office 365 plan from the display of the Get-MsolAccountSku cmdlet (such as litwareinc:ENTERPRISEPACK), and then run the following commands:
    $acctSKU="<AccountSkuId>"
    $AllLicensed = Get-MsolUser -All | Where {$_.isLicensed -eq $true -and $_.licenses[0].AccountSku.SkuPartNumber -eq ($acctSKU).Substring($acctSKU.IndexOf(":")+1, $acctSKU.Length-$acctSKU.IndexOf(":")-1)}
    $AllLicensed | ForEach {Set-MsolUserLicense -UserPrincipalName $_.UserPrincipalName -LicenseOptions $LO}
    
    • To disable the services for a group of existing users, use either of the following methods to identify the users:

    • Filter the accounts based on an existing account attribute To do this, use the following syntax:

    $x = Get-MsolUser -All <FilterableAttributes>
    $x | ForEach {Set-MsolUserLicense -UserPrincipalName $_.UserPrincipalName -LicenseOptions $LO}
    

    The following example disables the services for users in the Sales department in the United States.

    $USSales = Get-MsolUser -All -Department "Sales" -UsageLocation "US"
    $USSales | ForEach {Set-MsolUserLicense -UserPrincipalName $_.UserPrincipalName -LicenseOptions $LO}
    
    • Use a list of specific accounts To do this, perform the following steps:
  3. Create a text file that contains one account on each line like this:

    akol@contoso.com
    tjohnston@contoso.com
    kakers@contoso.com
    

    In this example, the text file is C:\My Documents\Accounts.txt.

  4. Run the following command:

    Get-Content "C:\My Documents\Accounts.txt" | foreach {Set-MsolUserLicense -UserPrincipalName $_ -LicenseOptions $LO}
    

To disable Office 365 services for users while you are assigning them to a licensing plan, see Disable access to services while assigning user licenses.

Specific Office 365 services for users from all licensing plans

To disable Office 365 services for users in all available licensing plans, perform the following steps:

  1. Copy and paste this script into Notepad.

    $AllLicensingPlans = Get-MsolAccountSku
    for($i = 0; $i -lt $AllLicensingPlans.Count; $i++)
    {
     $O365Licences = New-MsolLicenseOptions -AccountSkuId $AllLicensingPlans[$i].AccountSkuId -DisabledPlans "<UndesirableService1>", "<UndesirableService2>"...
     Set-MsolUserLicense -UserPrincipalName <Account> -LicenseOptions $O365Licences
    }
    
  2. Customize the following values for your environment:

    • In this example, we'll use Office Online and SharePoint Online.

    • In this example, we'll use belindan@litwareinc.com.

      The customized script looks like this:

    $AllLicensingPlans = Get-MsolAccountSku
    for($i = 0; $i -lt $AllLicensingPlans.Count; $i++)
    {
     $O365Licences = New-MsolLicenseOptions -AccountSkuId $AllLicensingPlans[$i].AccountSkuId -DisabledPlans "SHAREPOINTWAC", "SHAREPOINTENTERPRISE"
     Set-MsolUserLicense -UserPrincipalName belindan@litwareinc.com -LicenseOptions $O365Licences
    }
    
  3. Save the script as RemoveO365Services.ps1 in a location that's easy for you to find. For this example, we'll save the file in C:\\O365 Scripts.

  4. Run the script in Office 365 PowerShell by using the following command.

    & "C:\O365 Scripts\RemoveO365Services.ps1"
    

Note

To reverse the effects of any of these procedures (that is, to re-enable the disabled services), run the procedure again, but use the value $null for the DisabledPlans parameter.

Return to top

All Office 365 services for all users for a single licensing plan

To disable all Office 365 services for all users in a specific licensing plan, specify the licensing plan name for $acctSKU (such as litwareinc:ENTERPRISEPACK), and then run these commands in the PowerShell command window:

$acctSKU="<AccountSkuId>"
$servicesList=(Get-MsolAccountSku | Select -ExpandProperty ServiceStatus).ServicePlan.ServiceName
$lo = New-MsolLicenseOptions -AccountSkuId $acctSKU -DisabledPlans $servicesList
$AllLicensed = Get-MsolUser -All | Where {$_.isLicensed -eq $true -and $_.licenses[0].AccountSku.SkuPartNumber -eq ($acctSKU).Substring($acctSKU.IndexOf(":")+1, $acctSKU.Length-$acctSKU.IndexOf(":")-1)}
$AllLicensed | ForEach {Set-MsolUserLicense -ObjectID $_.ObjectID -LicenseOptions $lo}

New to Office 365?

Tip

LinkedIn logo New to Office 365?

Discover free video courses for Office 365 admins and IT pros, brought to you by LinkedIn Learning.

See also

See the following additional topics about managing users with Office 365 PowerShell:

For more information about the cmdlets that are used in these procedures, see the following topics: