Disable access to services with Office 365 PowerShell

When an Office 365 account is assigned a license from a licensing plan, Office 365 services are made available to the user from that license. However, you can control the Office 365 services that the user can access. For example, even though the license allows access to the SharePoint Online service, you can disable access to it. You can use PowerShell to disable access to any number of services for a specific licensing plan for:

  • An individual account.
  • A group of accounts.
  • All accounts in your organization.


There are Office 365 service dependencies that can prevent you from disabling a specified service when other services depend on it.

Use the Microsoft Azure Active Directory Module for Windows PowerShell

First, connect to your Office 365 tenant.

Next, use this command to view your available licensing plans, also known as AccountSkuIds:

Get-MsolAccountSku | Select AccountSkuId | Sort AccountSkuId


PowerShell Core does not support the Microsoft Azure Active Directory Module for Windows PowerShell module and cmdlets with Msol in their name. To continue using these cmdlets, you must run them from Windows PowerShell.

For more information, see View licenses and services with Office 365 PowerShell.

To see the before and after results of the procedures in this topic, see View account license and service details with Office 365 PowerShell.

A PowerShell script is available that automates the procedures described in this topic. Specifically, the script lets you view and disable services in your Office 365 organization, including Sway. For more information, see Disable access to Sway with Office 365 PowerShell.

Disable specific Office 365 services for specific users for a specific licensing plan

To disable a specific set of Office 365 services for users for a specific licensing plan, perform the following steps:

Step 1: Identify the undesirable services in the licensing plan by using the following syntax:

$LO = New-MsolLicenseOptions -AccountSkuId <AccountSkuId> -DisabledPlans "<UndesirableService1>", "<UndesirableService2>"...

The following example creates a LicenseOptions object that disables the Office and SharePoint Online services in the licensing plan named litwareinc:ENTERPRISEPACK (Office 365 Enterprise E3).

$LO = New-MsolLicenseOptions -AccountSkuId "litwareinc:ENTERPRISEPACK" -DisabledPlans "SHAREPOINTWAC", "SHAREPOINTENTERPRISE"

Step 2: Use the LicenseOptions object from Step 1 on one or more users.

To create a new account that has the services disabled, use the following syntax:

New-MsolUser -UserPrincipalName <Account> -DisplayName <DisplayName> -FirstName <FirstName> -LastName <LastName> -LicenseAssignment <AccountSkuId> -LicenseOptions $LO -UsageLocation <CountryCode>

The following example creates a new account for Allie Bellew that assigns the license and disables the services described in Step 1.

New-MsolUser -UserPrincipalName allieb@litwareinc.com -DisplayName "Allie Bellew" -FirstName Allie -LastName Bellew -LicenseAssignment litwareinc:ENTERPRISEPACK -LicenseOptions $LO -UsageLocation US

For more information about creating user accounts in Office 365 PowerShell, see Create user accounts with Office 365 PowerShell.

To disable the services for an existing licensed user, use the following syntax:

Set-MsolUserLicense -UserPrincipalName <Account> -LicenseOptions $LO

This example disables the services for the user BelindaN@litwareinc.com.

Set-MsolUserLicense -UserPrincipalName belindan@litwareinc.com -LicenseOptions $LO

To disable the services described in Step 1 for all existing licensed users, specify the name of your Office 365 plan from the display of the Get-MsolAccountSku cmdlet (such as litwareinc:ENTERPRISEPACK), and then run the following commands:

$AllLicensed = Get-MsolUser -All | Where {$_.isLicensed -eq $true -and $_.licenses.AccountSku.SkuPartNumber -contains ($acctSKU).Substring($acctSKU.IndexOf(":")+1, $acctSKU.Length-$acctSKU.IndexOf(":")-1)}
$AllLicensed | ForEach {Set-MsolUserLicense -UserPrincipalName $_.UserPrincipalName -LicenseOptions $LO}

If you use the Get-MsolUser cmdlet without using the All parameter, only the first 500 user accounts are returned.

To disable the services for a group of existing users, use either of the following methods to identify the users:

Method 1. Filter the accounts based on an existing account attribute

To do this, use the following syntax:

$x = Get-MsolUser -All <FilterableAttributes>
$x | ForEach {Set-MsolUserLicense -UserPrincipalName $_.UserPrincipalName -LicenseOptions $LO}

The following example disables the services for users in the Sales department in the United States.

$USSales = Get-MsolUser -All -Department "Sales" -UsageLocation "US"
$USSales | ForEach {Set-MsolUserLicense -UserPrincipalName $_.UserPrincipalName -LicenseOptions $LO}

Method 2: Use a list of specific accounts

To do this, perform the following steps:

  1. Create a text file that contains one account on each line like this:

In this example, the text file is C:\My Documents\Accounts.txt.

  1. Run the following command:
Get-Content "C:\My Documents\Accounts.txt" | foreach {Set-MsolUserLicense -UserPrincipalName $_ -LicenseOptions $LO}

If you want to disable access to services for multiple licensing plans, repeat the above instructions for each licensing plan, ensuring that:

  • The user accounts have been assigned the licensing plan.
  • The services to disable are available in the licensing plan.

To disable Office 365 services for users while you are assigning them to a licensing plan, see Disable access to services while assigning user licenses.

See also

Manage user accounts, licenses, and groups with Office 365 PowerShell

Manage Office 365 with Office 365 PowerShell

Getting started with Office 365 PowerShell