How to manage and control self-service purchases in your Microsoft 365 tenant

Last week, I saw a post come across that Microsoft, by default, allows users to make self-service purchases for Microsoft 365 Copilot licenses. This means that end users can test or purchase licenses themselves.

To be honest, Microsoft’s decision to allow this by default still seems dangerous. My advice is not to allow this. To change this, go to the Microsoft 365 admin center | Copilot | Settings | Microsoft 365 Copilot self-service purchases and set this to “Do not allow“. Then choose Save.

After a tip on Linkedin, it turns out that these Self-service purchases are present not only for Microsoft 365 Copilot but also for other licenses. In this blog post, I explore this in more detail and show you how to disable this in your Microsoft 365 tenant.

What are Self-service purchases in Microsoft 365?

Self-service purchases in Microsoft 365 allow users to independently buy certain Microsoft 365 products and services without needing to ask the IT department. The reason is to provide and empower users to quickly access the tools they need to be productive. But do you want this in your organization from an IT professional point of view? Let’s check some key points about Self-service purchases.

• Independence: Users can purchase subscriptions directly from the product websites or in-app purchase prompts.
• Management: Users are responsible for managing their subscriptions, including buying more licenses, assigning or unassigning licenses, and canceling subscriptions.
• Administrator visibility: Administrators have a read-only view of any self-service purchases made by users in their organization. They can see details such as product name, subscriptions purchased, expiration date, purchase price, and assigned users.
• Control: Admins can control whether users in their organization can make self-service purchases or sign up for trials through the Microsoft 365 admin center.

As a Modern Workplace consultant, I’m not a big fan of giving end users the ability to purchase trial or active licenses themself. You don’t want your tenant to be polluted with trial and unneeded licenses. So for me, the last key point is the important one. Get control as an administrator of those self-service purchases. Let me show you how you can easily manage this with Powershell.

How to manage self-service purchases in Microsoft 365

The fastest way to manage self-service purchases in Microsoft 365 is with Powershell and MSCommerce Powershell Module.

Install the MSCommerce Powershell module

Open Powershell on your device and Run it as Administrator. The first thing we need to do is to install the MSCommerce Powershell module.

Install-Module -Name MSCommerce

Connect to your tenant

The next step is to connect to your tenant, you need at least the Billing Administrator role to manage self-service purchases. Sign in with that account to connect to your tenant.

Connect-MSCommerce

In the following step, we will get an overview of all products where self-service purchases are available for our Microsoft 365 tenant.

Get an overview of all self-service purchase options

The following PS command will give you a full overview of all

Get-MSCommerceProductPolicies -PolicyId AllowSelfServicePurchase

In the image below you’ll see a list of all self-service purchase options available in my tenant and also notice they are all enabled, except the ones I’ve already Disabled for testing.

Now I will show how you easily can disable those options (all at once or for a specific product)

Disable a specific self-service purchase product

To disable a specific self-service purchase product, you only need the ProductId from the above list. In our example, we are going to disable the self-service purchase option for Project Plan 3. This can be done by running the following command.

Update-MSCommerceProductPolicy -PolicyId AllowSelfServicePurchase -ProductId CFQ7TTC0HDB0 -Enabled $False

In the screenshot below you can see I’ve disabled the self-service purchase option for Project Plan 3 in my Microsoft 365 tenant.

The last option I will show is to disable all self-service purchase options with one single Powershell command.

Disable all self-service purchase products

To disable all self-service purchase options, you can run the following PowerShell command.

Get-MSCommerceProductPolicies -PolicyId AllowSelfServicePurchase | ForEach {Update-MSCommerceProductPolicy -PolicyId AllowSelfServicePurchase -ProductId $_.ProductId -Enabled $False}

As you can see all options are becoming disabled while running this command.

If we want to double-check, we can rerun the command to get an overview and see that all self-service purchase options for all products are disabled.

Conclusion

As you can see, there are many self-service purchase options available on your Microsoft 365 tenant. There may be advantages for end-users, but as an IT administrator, you may prefer to be in control. Of course, this varies from organization to organization, but I prefer to start with all options disabled and enable them when needed.

Hope this post was informative and hope to see you soon!