使用 PowerShell 管理 Intune 许可证Manage Intune licenses using PowerShell

适用于:经典门户中的 IntuneApplies to: Intune in the classic portal
在寻找有关 Azure 门户中 Intune 的文档吗?Looking for documentation about Intune in the Azure portal? 请转到此处Go here.

本主题指导管理员如何使用 PowerShell 管理 Intune 用户许可证。This topic tells administrators how they use PowerShell to manage Intune user licenses.

在登录以使用 Intune 服务或将设备注册到管理组件之前,你必须首先为每个用户分配一个 Intune 订阅的许可证,如管理 Intune 许可证中所述。Before users can sign in to use the Intune service or enroll their devices into management, you must first assign each user a license to your Intune subscription, as described in Manage Intune licenses. 但是,使用 Microsoft 企业移动性 + 安全性的组织可能会有只需要 Azure Active Directory Premium 或 EMS 包中的 Intune 服务的用户。However, organizations that use Microsoft Enterprise Mobility + Security might have users who only require Azure Active Directory Premium or Intune services in the EMS package. 你可以使用 Azure Active Directory PowerShell cmdlet 分配一个或一部分服务。You can assign one or a subset of services using Azure Active Directory PowerShell cmdlets.

若要有选择性地为 EMS 服务分配用户许可证,请使用已安装的用于 Windows PowerShell 的 Azure Active Directory 模块在计算机上以管理员身份打开 PowerShell。To selectively assign user licenses for EMS services, open PowerShell as an administrator on a computer with the Azure Active Directory Module for Windows PowerShell installed. 你可以在本地计算机或 ADFS 服务器上安装 PowerShell。You can install PowerShell on a local computer or on an ADFS server.

必须创建仅应用于所需服务计划的新许可证 SKU 定义。You must create a new license SKU definition that applies only to the desired service plans. 若要执行此操作,请禁用不想应用的计划。To do this, disable the plans you don’t want to apply. 例如,你可以创建一个不分配 Intune 许可证的许可证 SKU 定义。For example, you might create a license SKU definition that does not assign an Intune license. 若要查看从可用服务的列表,请键入:To see a list of available services, type:

(Get-MsolAccountSku | Where {$\_.SkuPartNumber -eq "EMS"}).ServiceStatus

你可以运行下面的命令来排除 Intune 服务计划。You can run the following command to exclude the Intune service plan. 你可以使用相同的方法来扩展整个安全组,或者使用更精细的筛选器。You can use the same method to expand to an entire security group or you can use more granular filters.

示例 1 在命令行上创建一个新用户,并在不启用许可证的 Intune 部分的情况下分配一个 EMS 许可证:Example 1 Create a new user on the command line and assign an EMS license without enabling the Intune portion of the license:

Connect-MsolService

New-MsolUser -DisplayName “Test User” -FirstName FName -LastName LName -UserPrincipalName user@<TenantName>.onmicrosoft.com –Department DName -UsageLocation US

$CustomEMS = New-MsolLicenseOptions -AccountSkuId "<TenantName>:EMS" -DisabledPlans INTUNE_A
Set-MsolUserLicense -UserPrincipalName user@<TenantName>.onmicrosoft.com -AddLicenses <TenantName>:EMS -LicenseOptions $CustomEMS

验证方式:Verify with:

(Get-MsolUser -UserPrincipalName "user@<TenantName>.onmicrosoft.com").Licenses.ServiceStatus

示例 2 为已获得许可证的用户禁用 EMS 许可证的 Intune 部分:Example 2 Disable the Intune portion of EMS license for a user that is already assigned with a license:

Connect-MsolService

Set-MsolUserLicense -UserPrincipalName user@<TenantName>.onmicrosoft.com -RemoveLicenses IAPProdPartnerTest:EMS

$CustomEMS = New-MsolLicenseOptions -AccountSkuId "<TenantName>:EMS" -DisabledPlans INTUNE_A
Set-MsolUserLicense -UserPrincipalName user@<TenantName>.onmicrosoft.com -AddLicenses <TenantName>:EMS -LicenseOptions $CustomEMS

验证方式:Verify with:

(Get-MsolUser -UserPrincipalName "user@<TenantName>.onmicrosoft.com" .Licenses.ServiceStatus

PoSH-AddLic-Verify

后续步骤Next steps

祝贺你!Congratulations! 你刚刚完成了 Intune 快速入门指南的步骤 4。You have just completed step 4 of the Intune quick start guide.

(/intune/custom-domain-name-configure) 将用户同步到 Intune 组织用户和设备(/intune/custom-domain-name-configure) Sync users to Intune Organize users and devices